Introduce toSVGFESpecularLightingElement(), and use it

As a step to clean-up static_cast<SVGXXX>, toSVGFESpecularLightingElement() is added to clean-up
static_cast<SVGFESpecularLightingElement*>.

BUG=N/A

Review URL: https://chromiumcodereview.appspot.com/23480021

git-svn-id: svn://svn.chromium.org/blink/trunk@156963 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Null-out the HashTable pointer on destruction.

This may help with certain class of use-after-free bugs.

In addition, fix egregious use of signed types to represent storage sizes, and
add a missing integer overflow defense in expanding the table.

+10KB of binary size on a GCC 64-bit build. This is more than catered for by a
-100KB binary change in flight for similar tweaks to Vector.

BUG=270545

Review URL: https://chromiumcodereview.appspot.com/23530009

git-svn-id: svn://svn.chromium.org/blink/trunk@156965 bbb929c8-8fbe-4397-9dbb-9b2b20218538