[CSSRegions] Add a test to make sure that it is safe to collect a html element in a named flow.

BUG=301481

Review URL: https://codereview.chromium.org/25219002

git-svn-id: svn://svn.chromium.org/blink/trunk@158652 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix the partitionFreeGeneric API so that the size does not need to be passed in.

In usage, the API proved to be extremely error prone, and said errors were
probably security bugs.

Now, partitionAlloc can track and tell internally whether a pointer is a
partition pointer or not. This also provides a useful primitive to put in an
ASSERT on partitionFree (the non-generic version). This ASSERT would have saved
lots of debugging time in the past.

We may want to implement a 32-bit specific optimization, if the partition
mapping(s) get fragmented in the 32-bit address space. I'll tackle it in a
follow-up CL if it proves necessary.

In the process, I discovered that the MappingCollision test is broken and that
is fixed in this CL too. (This test is needed to test a code path that is
otherwise extremely unlikely to hit on 64-bit.)

Review URL: https://codereview.chromium.org/25381002

git-svn-id: svn://svn.chromium.org/blink/trunk@158653 bbb929c8-8fbe-4397-9dbb-9b2b20218538