FrameView::updateLayoutAndStyleIfNeededRecursive should walk the frame tree rather than the widget tree

Prior to this CL, we walked the widget tree to find child FrameViews, which
meant we'd skip over display: none iframes (because they wouldn't exist in the
widget tree). That caused a problem when moving the layout timer to
requestAnimationFrame because we need to layout display: none iframes in order
to load plugins (yuck!).

After this CL, we walk the frame tree instead, which means we recurse into all
iframes, whether they are display: none or not. In the common case, we won't
actually do much more work because these frames won't be in need of layout.
Note that even prior to this CL we were often laying out display: none iframes
via the layout timer.

BUG=340357
R=ojan@chromium.org

Review URL: https://codereview.chromium.org/149393013

git-svn-id: svn://svn.chromium.org/blink/trunk@166354 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Enable sticky positioning for table elements.

Also includes fix for bug ​https://bugs.webkit.org/show_bug.cgi?id=105654
I don't have access to this bug, but from commit message I assume it says about "Heap use after free problem".
Debugging showed that it wasn't heap use after free. The real problem that RenderObject::container() returns object which is not RenderBlock and it is used as RenderBlock in
RenderBox::containingBlockLogicalHeightForPositioned() method.

BUG=231751

Review URL: https://codereview.chromium.org/143653008

git-svn-id: svn://svn.chromium.org/blink/trunk@166355 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Remove NodeList's anonymous named getter

Remove NodeList's anonymous named getter as this is not part of the
specification:
http://dom.spec.whatwg.org/#nodelist

The new behavior is consistent with Firefox 26 and IE11. This was tested using:
http://jsfiddle.net/HQ5Nf/3/

NodeList's named getter used to get needed when getElementsByClassName() /
getElementsByTagName*() wrongly returned a NodeList instead of an
HTMLCollection. However, this has been fixed in r166263. HTMLCollection does
have an anonymous named getter.

BUG=235008
R=arv, haraken, tkent

Review URL: https://codereview.chromium.org/144313014

git-svn-id: svn://svn.chromium.org/blink/trunk@166356 bbb929c8-8fbe-4397-9dbb-9b2b20218538