Have DOMPatchSupport and DocumentFragment deal with Document references

Have DOMPatchSupport and DocumentFragment deal with Document references instead
of using pointers with assertions to make sure the pointers are non-null.

The DocumentFragment constructor still takes a Document pointer in argument
because of ShadowRoot which passes 0 as Document until it is set later on
by TreeScope. I need to investigate more to determine if the DocumentFragment
constructor can take a reference in.

BUG=281400

Review URL: https://chromiumcodereview.appspot.com/23453033

git-svn-id: svn://svn.chromium.org/blink/trunk@157237 bbb929c8-8fbe-4397-9dbb-9b2b20218538