Make WebPrivatePtr capable of wrapping garbage collected objects.

Extend WebPrivatePtr to let it safely hold on to garbage collected
objects, via a strong, persistent object reference.

As an example of use, adopt it for the Speech API platform layer
objects.

The implementation of WebPrivatPtr is courtesy of Vyacheslav Egorov <vegorov@chromium.org>

R=haraken@chromium.org,ager@chromium.org,jochen@chromium.org,tkent@chromium.org
BUG=340522

Review URL: https://codereview.chromium.org/168963003

git-svn-id: svn://svn.chromium.org/blink/trunk@167391 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix issue in which removing a class does not always
invalidate style on the element losing the class.

The situation in which it fails is the following:

.class1 .class2 {}
<div class='class1'>
  <div id='inner' class='class2'>
  </div>
</div>

then code like:
document.querySelector('#inner').className = '' 

Previously, an invalidation run would be scheduled, which
calls RuleFeatureSet::invalidateStyleForClassChange, but
since the class that is being mutated does not exist on the
inner element, the variable thisElementNeedsStyleRecalc was
never set to true. What we should do instead is set a local
style recalc on every element which has a pending
invalidation list, because a pending invalidation list means
that code must have done something to that element with
CSSOM, and hence we should assume style needs to be
recomputed. (In fact we do know that for sure since code
excecuted earlier verifies that the CSSOM mutation needs
some sort of style recalc.)

BUG=344376

Review URL: https://codereview.chromium.org/170873004

git-svn-id: svn://svn.chromium.org/blink/trunk@167392 bbb929c8-8fbe-4397-9dbb-9b2b20218538