Fix crash when the value of input[type=color] with an author ShadowRoot is updated.

We should not call ColorInputType::updateColorSwatch directly from
ColorInputType because it is view-related. This CL renames updateColorSwatch to
updateView, and replace updateColorSwatch callsites with element().updateView()
to use null InputTypeView::updateView when an author ShadowRoot is attached.

BUG=351880
TEST=automated

Review URL: https://codereview.chromium.org/198813002

git-svn-id: svn://svn.chromium.org/blink/trunk@169198 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix the broken menulist-oninput-fired.html test

Review URL: https://codereview.chromium.org/195943006

git-svn-id: svn://svn.chromium.org/blink/trunk@169199 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[SVG] SVGImage destructor crash.

An SVGImage object can be deleted before having a chance to instantiate
its ChromeClient and Page (before all data is received - if the
connection gets reset for example).

The destructor needs to guard access to m_page and m_chromeClient.

BUG=350791
R=pdr@chromium.org,fs@opera.com,kouhei@chromium.org

Review URL: https://codereview.chromium.org/197233003

git-svn-id: svn://svn.chromium.org/blink/trunk@169200 bbb929c8-8fbe-4397-9dbb-9b2b20218538