Remove setToNodesInDocumentTreeScope().

No one calls this since I removed ConfusingAndOftenMisusedDisallowShadowContent.

Review URL: https://codereview.chromium.org/394123002

git-svn-id: svn://svn.chromium.org/blink/trunk@178232 bbb929c8-8fbe-4397-9dbb-9b2b20218538
showContextMenu should use the host, not the user agent shadow elements.

This code does not expect to hit the inside of user agent shadow elements,
so we need to call setToShadowHostIfInUserAgentShadowRoot().

I'm not sure how to test this, it seems we have very little test coverage
for context menus?

BUG=393406

Review URL: https://codereview.chromium.org/393023005

git-svn-id: svn://svn.chromium.org/blink/trunk@178234 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix possible crash in Element::normalizeAttributes()

Fix possible crash in Element::normalizeAttributes() caused by the ElementData
becoming unique while we are iterating over the Element's attributes.

A call to Attr::normalize() can cause an attribute's value to be updated, thus
causing the Element's ElementData to become unique if it was previously
shareable. The issue is that we were iterating over the Element's attributes,
which relies on the internal representation of the ElementData. When the
ShareableElementData gets replaced by a UniqueElementData, the internal
representation goes away and what we are iterating on no longer exists.

The solution adoped in this CL is to iterate of the Element's attrNodeList()
Vector instead, since what we are really interested in are Attr Nodes and not
Attribute objects. The attrNodeList() method returns a pointer to a Vector
stored in ElementRareData, and thus never shared between Elements. We anyway
make a copy of that vector before iterating because attributes can potentially
be added / removed by JS listeners while we are iterating (see
fast/dom/normalize-attributes-mutation-event-crash.html layout test).

BUG=394026
TEST=fast/dom/Element/normalize-crash2.html
R=esprehn@chromium.org, tkent@chromium.org

Review URL: https://codereview.chromium.org/398653003

git-svn-id: svn://svn.chromium.org/blink/trunk@178235 bbb929c8-8fbe-4397-9dbb-9b2b20218538
AnimatableValueKeyframe::PropertyValueMap should use an on-heap hash map

Off-heap hash maps of on-heap objects should be replaced with on-heap hash maps.

BUG=340522

Review URL: https://codereview.chromium.org/396633003

git-svn-id: svn://svn.chromium.org/blink/trunk@178236 bbb929c8-8fbe-4397-9dbb-9b2b20218538