Fixing use after free error in Canvas2DLayerBridge due to vector reallocation

The released MailboxInfo object needs to be referenced by array index
rather than by pointer, in case the m_mailboxes vector is reallocated.

BUG=339610

Review URL: https://codereview.chromium.org/150903002

git-svn-id: svn://svn.chromium.org/blink/trunk@166334 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Make StyleChange parameter explicit in setNeedsStyleRecalc.

The SubtreeStyleChange is a very expensive change, yet the default parameter
used for changeType in setNeedsStyleRecalc. It is made non-default here in
order to enforce a more conscious choice when adding calls to
setNeedsStyleRecalc.

BUG=None

Review URL: https://codereview.chromium.org/152623002

git-svn-id: svn://svn.chromium.org/blink/trunk@166335 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Clean up setting state of HistoryItems and associated enums.

BUG=none

Review URL: https://codereview.chromium.org/144753005

git-svn-id: svn://svn.chromium.org/blink/trunk@166336 bbb929c8-8fbe-4397-9dbb-9b2b20218538