Bug 855917 - Minor nsAbsoluteContainingBlock code cleanup.  r=dholbert
Bug 729519 - Use SafelyDestroyFrameListProp also for the OverflowList.  r=bzbarsky
Bug 729519 - Simplify DestroyOverflowList() by requiring that the list is empty.  r=bzbarsky
Bug 729519 - Allocate nsFrameList::sEmptyList from the .rodata segment, not the heap.  r=bzbarsky
Bug 729519 - Make frames destroy all child frames and remove their nsFrameList properties when destroyed.  r=bzbarsky

Specifically, this wasn't done for the OutsideBullet list which was
destroyed by the property destructor, potentially after the entire
frame tree was gone.  Now we'll assert that the property destructor
isn't called.

Use SafelyDestroyFrameListProp when destroying PushedFloat and
OverflowOutOfFlows frame lists since it's more robust.

Destroy [Excess]OverflowContainers frame lists if they exist, regardless
of the IsFrameOfType(nsIFrame::eCanContainOverflowContainers) bit
(since the oveflow continuation tracker doesn't check that before
creating these lists -- this was the source of crash bugs before
that bit was added to ColumnSetFrame).

Assert in SetPropTableFrames that the property doesn't exist, because
if it does the property destructor will run, which isn't supported.
Bug 729519 - Allocate heap nsFrameLists from the shell arena.  r=bzbarsky

"new nsFrameList()" becomes "new (shell) nsFrameList()".
"delete list" becomes "if (list) list->Delete(shell)" - note also that
an additional assertion was added that list is empty when deleted.

"nsAutoPtr<nsFrameList> list(StealSomeFrames())" becomes
"AutoFrameListPtr list(aPresContext, StealSomeFrames())"
Bug 856383 - Update pdf.js to version 0.7.423. r=yury