Ensure that there's only one MainThreadPendingTaskRunner.

This is important because it's otherwise possible for too
many MainThreadPendingTaskRunners to starve out other tasks
posted on the main thread under some circumstances (e.g.
tough_scheduling_cases/raf.html?heavy_first_frame).

BUG=391005

Review URL: https://codereview.chromium.org/503293002

git-svn-id: svn://svn.chromium.org/blink/trunk@180916 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Don't call RO::mapRectToPaintInvalidationBacking with invalidation container twice.

Instead, call RenderLayer::mapRectToPaintBackingCoordinates directly.
This avoids a bug due to the fact that PaintInvalidationState is only able to map rects from
a child of the invalidation container into it. Mapping from the invalidation container to itself
is not supported.

BUG=402983

Review URL: https://codereview.chromium.org/503923002

git-svn-id: svn://svn.chromium.org/blink/trunk@180917 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add an extra guard to replaceDocument()

The key of this change is to add an extra guard against rude JS in unload event
handlers.

To add the change in a sane way, this change also includes some refactoring:

 * Moving |shouldReuseDefaultView| local variable, which should be computed
   beforehand to DocumentInit.
 * Splitting replaceDocument into DocuentLoader and FrameLoader.
 * Renaming them to replaceDocumentWriteExecutingJavaScriptURL() for clarity.
 * Using the FrameLoader API instead of DocumentLoader one from ScriptController.

TEST=unload-mutation-crash.html
R=esprehn@chromium.org, dglazkov@chromium.org, abarth@chromium.org
BUG=405745

Review URL: https://codereview.chromium.org/495743003

git-svn-id: svn://svn.chromium.org/blink/trunk@180918 bbb929c8-8fbe-4397-9dbb-9b2b20218538