Revert delayed frame destruction in SVGImage and the follow-up changes.

The frame destruction was delayed because Oilpan did not allow allocation during finalization. Oilpan now supports allocation during finalization and the delaying should not be necessary.

Keep the regression tests.

R=eseidel@chromium.org, fs@opera.com, kouhei@chromium.org, pdr@chromium.org
BUG=350907

Review URL: https://codereview.chromium.org/197793006

git-svn-id: svn://svn.chromium.org/blink/trunk@169233 bbb929c8-8fbe-4397-9dbb-9b2b20218538
HTMLLIElement and RenderListItem should consider distribution.

BUG=339754
TEST=fast/dom/shadow/shadow-and-list-elements.html,w3c/web-platform-tests/shadow-dom/shadow-trees/lower-boundary-encapsulation/distribution-001.html,w3c/web-platform-tests/shadow-trees/lower-boundary-encapsulation/distribution-002.html

Review URL: https://codereview.chromium.org/169273003

git-svn-id: svn://svn.chromium.org/blink/trunk@169234 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix isCandidate consistency between PositionIterator and Position for br elements with childlen.

If PositionIterator traverses on a DOM tree which includes a br element with children(of course it's a strange DOM tree),
PositionIterator.isCandidate() on the br element returns true but converted Position.isCandidate() returns false.

If conditions lose consistency, VisiblePosition::canonicalPosition will fail on  |canonicalizeCandidate(previousCandidate(position))| because previousCandidate returns a Position converted from a "Candidate" PositionIterator and cannonicalizeCandidate(Position) assumes the Position is "Candidate".

To keep the consistency, change PositionIterator.isCandidate() to return false when it traverses on tail of the br element.

BUG=344280

Review URL: https://codereview.chromium.org/197223006

git-svn-id: svn://svn.chromium.org/blink/trunk@169235 bbb929c8-8fbe-4397-9dbb-9b2b20218538
DevTools: show layer snapshots captured with Timeline

BUG=

Review URL: https://codereview.chromium.org/195873010

git-svn-id: svn://svn.chromium.org/blink/trunk@169236 bbb929c8-8fbe-4397-9dbb-9b2b20218538
DevTools: More lazy initialization when getting debugger call stacks.

Speed improvement up to 20%.

BUG=340285
R=yurys

Review URL: https://codereview.chromium.org/198253003

git-svn-id: svn://svn.chromium.org/blink/trunk@169237 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Prevent destruction of self in SMILTimeContainer with 'discard'

If discarding the <svg> root an animation update could end up destroying
the SVGSVGElement owning the SMILTimeContainer, leading to use-after-free.
Make sure to keep an additional reference to the owning SVGSVGElement
across affected callsites.

BUG=351316

Review URL: https://codereview.chromium.org/195233003

git-svn-id: svn://svn.chromium.org/blink/trunk@169239 bbb929c8-8fbe-4397-9dbb-9b2b20218538
DevTools: InjectedScriptExterns.js followup fix after r169226

TBR=pfeldman

Review URL: https://codereview.chromium.org/200113004

git-svn-id: svn://svn.chromium.org/blink/trunk@169240 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Stretch Allocation and Statistics view to occupy all awailable space

BUG=277984
R=alph@chromium.org

Review URL: https://codereview.chromium.org/200223006

git-svn-id: svn://svn.chromium.org/blink/trunk@169241 bbb929c8-8fbe-4397-9dbb-9b2b20218538