IDL compiler: Union member types for named property getters

This completes special operations.
This CL is a bit complicated; it can't effectively be broken up,
as we only use union types in this one (complicated) context.

1. Add union types to general type handling
This basically treats union types as a list; indeed, post-Perl we can
just have a union type be a list of other types.

2. Move .release() handling into v8_set_return_value
For union types, we need to handle .release() separately for each member type,
so this is easiest to handle at the bottom level in v8_set_return_value.
This actually lets us move most uses of .release() into a simple flag.

3. Actual template
Quite simple; the Perl code for this is *v.* confusing.

There are a few clever twists to simplify the code (fluent interface,
nested generator), otherwise pretty straightforward.

BUG=239771
R=haraken
NOTRY=true

Review URL: https://codereview.chromium.org/147493006

git-svn-id: svn://svn.chromium.org/blink/trunk@166293 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Extend applying document.execCommand() protection to all commands

Before this patch, preventing recursive call of |document.execCommand()| and delaying DOM mutation event after editing command completion to ensure assumption of DOM tree in editing command, are applying to part of editing commands invoked by |CompositeEditCommand::apply()|, which is introduced by blink@162080.

However, editing commands are also invoked by |document.execCommand()| not via |CompositeEditCommand::apply()|.

This patch changes to move recursive call checking to |document.execCommand()|, because it is entry point for scripts, to postpone DOM mutation event until |document.execCommand()| finished. We still need to postpone DOM mutation event during |CompositeEditCommand::apply()|, which |DragController| calls.

This patch also updates test expectations for test scripts which calls |document.execCommand()| recursively; all of them are for crash testing caused by recursive document.execCommand calls.

Note: Preventing recursive call of |document.execCommand()| is right way to do so. Although, recursive call of |document.execCommand()| isn't common case, rather it is done by attacker. This patch reduces chances of attacking.

BUG=338558
TEST=LayoutTests/editing/inserting/insert-with-mutation-event.html

Review URL: https://codereview.chromium.org/141103006

git-svn-id: svn://svn.chromium.org/blink/trunk@166294 bbb929c8-8fbe-4397-9dbb-9b2b20218538