Fix crash when we start dragging a input[type=range] thumb on the padding area.

BUG=303772

Review URL: https://codereview.chromium.org/25603005

git-svn-id: svn://svn.chromium.org/blink/trunk@158914 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Implement AP2 Promises

This patch implements AP2 Promises, replace the existing Promises with
it and test it with the existing and newly added test cases.
The implementation has almost 1:1 correspondence to the spec.

In the latest draft, ThenableCoercions is used to attach private members
to arbitrary objects without any modification on the objects.
However V8 doesn't expose WeakMap to embedders and it is unavailable
if the harmony flag isn't set. Since V8 GC may relocate the object
addresses, we cannot use them as WeakMap's key. As a result, we cannot
implement O(1) WeakMap in the Blink-side[1].
So instead of using WeakMap, we use V8 hidden properties to attach
private members to the arbitrary objects.

[1]: https://chromiumcodereview.appspot.com/24403002/

BUG=295420

Review URL: https://codereview.chromium.org/24980002

git-svn-id: svn://svn.chromium.org/blink/trunk@158915 bbb929c8-8fbe-4397-9dbb-9b2b20218538