Oilpan: Replace most of RefPtrs of Event objects with oilpan's transition types

- Basically, this CL does the following three things:

(1) Replace PassRefPtr<xxxEvent> with PassRefPtrWillBeRawPtr<xxxEvent>.

(2) Replace RefPtr<xxxEvent> in on-heap objects with RefPtrWillBeMember<xxxEvent>.

(3) Replace RefPtr<xxxEvent> in off-heap objects with RefPtrWillBePersistent<xxxEvent>.

- This CL is not replacing any raw pointers with Members/Persistents, so it won't produce new memory leaks.

- This CL uses ListHashSet<Persistent<Event>> for DOMWindowEventQueue::m_queuedEvents, because HeapListHashSet is not yet implemented.

- This CL uses Deque<Persistent<Event>> for WebSocket::m_events, because HeapDeque is not yet implemented.

- In follow-up CLs, I will move more Event related objects to the heap and reduce Persistent handles introduced in this CL.

BUG=340522

Review URL: https://codereview.chromium.org/216523002

git-svn-id: svn://svn.chromium.org/blink/trunk@170733 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Oilpan: Add safe point scope around web socket wait operation.

Limit the scope of the loader safe point scope in case cancel
can lead to some actual work that might want to allocate
in the heap.

R=haraken@chromium.org, oilpan-reviews@chromium.org, vegorov@chromium.org

Review URL: https://codereview.chromium.org/220723004

git-svn-id: svn://svn.chromium.org/blink/trunk@170734 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add MediaControlTimelineElement FIXME for "timeline offset"

The problem was raised but not correctly addressed in
https://codereview.chromium.org/219283004/

BUG=312699
NOTRY=true

Review URL: https://codereview.chromium.org/221823007

git-svn-id: svn://svn.chromium.org/blink/trunk@170735 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Move DragImageTest to platform/.

This ends up allocating in the rendering partition, which requires that
the partition allocator be initialized. So the platform unit test runner
is correspondingly adjusted to set up the partition allocator.

Accessing RenderTheme in a platform unit test is highly suspect (and
doesn't build when this test is moved), so it now uses a FontDescription
in the test itself, constructed the same way RenderThemeChromiumSkia
does.

BUG=353585

Review URL: https://codereview.chromium.org/221703003

git-svn-id: svn://svn.chromium.org/blink/trunk@170736 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix crash when a demoted FORM element is moved into a ShadowRoot.

We can't assume the parent node of a demoted FORM element always
have its renderer if we use ShadowRoots.

BUG=343463
TEST=automated

Review URL: https://codereview.chromium.org/218753003

git-svn-id: svn://svn.chromium.org/blink/trunk@170737 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Enable unprefixed CSS Transforms by default

As discussed on blink-dev[1]. This change enables unprefixed CSS
Transforms[2] properties by default, it does not remove the
prefixed versions.

[1] https://groups.google.com/a/chromium.org/d/topic/blink-dev/vjyd8It--3Y/discussion
[2] http://www.w3.org/TR/css3-transforms/

BUG=154772

Review URL: https://codereview.chromium.org/223243002

git-svn-id: svn://svn.chromium.org/blink/trunk@170738 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix ref leak when assigning Lengths with the same calc value

This patch adds a check to Length's assignment/copy constructor
to avoid taking an unnecessary ref of a calc object.

No regressions observed in the smoothness.tough_animation_cases
benchmark after this change.
Test command: tools/perf/run_benchmark --browser=android-content-shell --pageset-repeat=5 smoothness.tough_animation_cases
Device: Nexus 10

BUG=355303

Review URL: https://codereview.chromium.org/209843003

git-svn-id: svn://svn.chromium.org/blink/trunk@170739 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[webcrypto] Expose crypto.subtle to web workers.

This corresponds with the spec update:
https://dvcs.w3.org/hg/webcrypto-api/rev/9f1f378595fc

BUG=245025

Review URL: https://codereview.chromium.org/222553007

git-svn-id: svn://svn.chromium.org/blink/trunk@170740 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Oilpan: Support the HTML parser thread in oilpan

After r170314, the HTML parser thread allocates on-heap objects such as CSSValues. So this CL supports the HTML parser thread in oilpan. Also this CL marks the CSSValue hierarchy with ThreadAffinity=AnyThread because CSSValue can be allocated by both main thread and parser threads.

BUG=340522

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=170564

Review URL: https://codereview.chromium.org/216203006

git-svn-id: svn://svn.chromium.org/blink/trunk@170741 bbb929c8-8fbe-4397-9dbb-9b2b20218538