Oilpan: Replace most of RefPtrs of Event objects with oilpan's transition types

- Basically, this CL does the following three things:

(1) Replace PassRefPtr<xxxEvent> with PassRefPtrWillBeRawPtr<xxxEvent>.

(2) Replace RefPtr<xxxEvent> in on-heap objects with RefPtrWillBeMember<xxxEvent>.

(3) Replace RefPtr<xxxEvent> in off-heap objects with RefPtrWillBePersistent<xxxEvent>.

- This CL is not replacing any raw pointers with Members/Persistents, so it won't produce new memory leaks.

- This CL uses ListHashSet<Persistent<Event>> for DOMWindowEventQueue::m_queuedEvents, because HeapListHashSet is not yet implemented.

- This CL uses Deque<Persistent<Event>> for WebSocket::m_events, because HeapDeque is not yet implemented.

- In follow-up CLs, I will move more Event related objects to the heap and reduce Persistent handles introduced in this CL.

BUG=340522

Review URL: https://codereview.chromium.org/216523002

git-svn-id: svn://svn.chromium.org/blink/trunk@170733 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Oilpan: Add safe point scope around web socket wait operation.

Limit the scope of the loader safe point scope in case cancel
can lead to some actual work that might want to allocate
in the heap.

R=haraken@chromium.org, oilpan-reviews@chromium.org, vegorov@chromium.org

Review URL: https://codereview.chromium.org/220723004

git-svn-id: svn://svn.chromium.org/blink/trunk@170734 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add MediaControlTimelineElement FIXME for "timeline offset"

The problem was raised but not correctly addressed in
https://codereview.chromium.org/219283004/

BUG=312699
NOTRY=true

Review URL: https://codereview.chromium.org/221823007

git-svn-id: svn://svn.chromium.org/blink/trunk@170735 bbb929c8-8fbe-4397-9dbb-9b2b20218538