Move .data off DOM nodes

 * For now it stores in .dataobject, freeing up .data to
   handle <object> elements.

 * Adds a test that crashes master.

Bug: 57394
Change-Id: I4207d76ad9dab660e890008b2ee5014554ce52c8