Harden the machinery around updateWidgetPositions()

updateWidgetPositions() can blow away the RenderView by running script or
calling into plugins. This patch moves it from RenderView to FrameView
since having this method on RenderView which might destroy itself is not
safe. It also switches to using normal RefPtr instead of manually managing
the refcount and finally adds RefPtr to callers of updateWidgetPositions()
to avoid use-after-frees.

There's one final call inside RenderLayerScrollableArea::setScrollOffset
which is not safe but is difficult to mitigate since we're way down a
callstack by the time this call is made which can destroy the render tree
and the RenderLayerScrollableArea. This patch adds a RELEASE_ASSERT to
kill the renderer in case we get into a sitaution where this happens.
In the future we should detangle this concept entirely so such an
ASSERT isn't needed and so that the render tree can never destroy itself
from the inside.

It's not clear how to write a test for this since you need to get us to
go into the scrolling code with a dirty tree or have a plugin that does
something nefarious.

BUG=322891

Review URL: https://codereview.chromium.org/132913002

git-svn-id: svn://svn.chromium.org/blink/trunk@165052 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[SVG] SVGAnimatedBoolean migration to new SVG property impl.

This CL replaces SVGAnimatedBoolean class with NewSVGProperty implementation.

For details, see design doc: https://docs.google.com/document/d/1bg7CUyUszqdwmENY3JX6_PoQD6uHRCNcRPJMlC4qlkw/edit?usp=sharing

BUG=308818

Review URL: https://codereview.chromium.org/131253002

git-svn-id: svn://svn.chromium.org/blink/trunk@165053 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Adding owner access from WebMediaStreamTrack::ExtraData
Like WebMediaStreamSource having access to the owner of the ExtraData
object simplifies the chromium code significantly.
Also taking the opportunity to clean up the ExtraData code in
MediaStreamSource after the last of the non-standard code added for
WebAudio has been refactored away.

Review URL: https://codereview.chromium.org/133733004

git-svn-id: svn://svn.chromium.org/blink/trunk@165054 bbb929c8-8fbe-4397-9dbb-9b2b20218538