Ensure iframe navgations are properly constructed in the history tree

If an iframe's first real navigation does not trigger the
HistoryController::updateForInitialLoadInChildFrame() case, the history tree's
cloneAndReplace() will incorrect skip over that frame.

I haven't seen a sample of this outside of pushState() usage in the webui.

BUG=323077

Review URL: https://codereview.chromium.org/84503003

git-svn-id: svn://svn.chromium.org/blink/trunk@163299 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Introduce DEFINE_INLINE_BOX_TYPE_CASTS, and use it

As a step to use DEFINE_TYPE_CASTS, this cl introduce DEFINE_INLINE_BOX_TYPE_CASTS.
InlineFlowBox, InlineTextBox, SVGInlineTextBox, SVGInlineFlowBox, and
SVGRootInlineBox can use it to generate toFoo() type case helper functions.

BUG=309516

Review URL: https://codereview.chromium.org/104593005

git-svn-id: svn://svn.chromium.org/blink/trunk@163300 bbb929c8-8fbe-4397-9dbb-9b2b20218538