V8AbstractEventListener should hold a ScriptState

- Basically, this CL replaces V8AbstractEventListener::m_world with V8AbstractEventListener::m_scriptState.

- This CL uses the ScriptState in a lot of places about event listeners and cleans up the code (for example, this CL removes an empty creation context from toV8()).

- The complicated part is that V8LazyEventListener does not know the ScriptState when it's created. Thus, V8AbstractEventListener::m_scriptState can be null if the listener is a V8LazyEventListener until the V8LazyEventListener is called back from Blink (i.e., either of handleEvent(), callListenerFunction() and getEventListener() is called).

- This CL changes web-exposed behavior. In a case where the frame that registered an onload event handler (say Frame1) is different from the frame that triggers the onload event (Frame2), before this CL, the onload event handler is invoked in the context of Frame2. After this CL, the onload event handler is not triggered if Frame1 != Frame2. This behavior is not speced but aligns with Firefox. See comment #17 and #19 for more details.

BUG=357144

Review URL: https://codereview.chromium.org/293053007

git-svn-id: svn://svn.chromium.org/blink/trunk@175241 bbb929c8-8fbe-4397-9dbb-9b2b20218538