Manage FloatingObjects using hashmaps

Previously, FloatingObject objects are kept in a list referenced
by a member variable in RenderBlock. There have been many special
cases in which these objects end up in lists that are not cleared
properly due to mutations of the render tree, resulting in
security bugs.

This patch changes FloatingObject tracking to use 2 global
hashmaps, one of which replaces the member variable pointer
in RenderBlock, and the other of which stores container
references, so that we can easily find all RenderBlocks that
have a given FloatingObject in their maps.

R=inferno@chromium.org
BUG=245727

Review URL: https://chromiumcodereview.appspot.com/16827004

git-svn-id: svn://svn.chromium.org/blink/trunk@154194 bbb929c8-8fbe-4397-9dbb-9b2b20218538