PartitionAlloc: fix a leak of freed page pointers.

This in turn causes us to leak address space leading to OOM crashes on 32-bit,
and we also leak smaller amounts of actual memory in the metadata.
It is a nasty bug.

Credit to jl@opera.com for diagnosing this, which was the hard part. I'm
redoing his patch in an alternative manner, and adding a tricky test.

BUG=332333

Review URL: https://codereview.chromium.org/173163004

git-svn-id: svn://svn.chromium.org/blink/trunk@167494 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Do not crash when removing focus from a frame with showModalDialog in its blur handler.

The code was:
    if (!m_focusedFrame)
        setFocusedFrame(m_page->mainFrame());
    if (m_focusedFrame->view()) {

It looks m_focusedFrame at the last line is not NULL. However
setFocusedFrame is not a simple setter, and it rejects to update
m_focusedFrame in a case of reentrance, and it dispatches events.
So, m_focusedFrame can be NULL.

This CL has no tests. It seems there are no ways to call
FocusController::setFocused correctly in content_shell's DRT mode.

BUG=343809
TEST=Open the testcase in the bug, then press Tab key.

Review URL: https://codereview.chromium.org/172873010

git-svn-id: svn://svn.chromium.org/blink/trunk@167495 bbb929c8-8fbe-4397-9dbb-9b2b20218538