Merge 178976 "Call insertedInto or removedFrom before childrenCh..."

Merge 178976 "Call insertedInto or removedFrom before childrenCh..."

> Call insertedInto or removedFrom before childrenChanged
> 
> We must notify nodes that they were removed before calling childrenChanged
> because childrenChanged could run script. If don't then the script can remove
> the parent and then Element::removedFrom doesn't think the parent is
> inTreeScope or inDocument so it'll fail to clean up the TreeScope hash maps
> like the id map.
> 
> I tried this once before for a different reason in:
> https://src.chromium.org/viewvc/blink?revision=175732&view=revision
> but that got rolled out because it caused crashes http://crbug.com/382160
> 
> By looking at the code it appears that the reason for this is that
> m_element in the WebPluginContainerImpl is a raw ptr, and so nothing is
> keeping the element alive inside the UpdateSuspendScope. In this patch
> I didn't remove the NodeVector, a future patch will attempt to do that.
> 
> Unfortunately even when I did remove the NodeVector I couldn't reproduce
> the crashes mentioned in the bug, but by code inspection and the crash
> stacks it appears to be the situation I described.
> 
> BUG=387389
> 
> Review URL: https://codereview.chromium.org/418133003

TBR=esprehn@chromium.org

[esprehn, 2014-08-12 23:16:19]

Landed as http://src.chromium.org/viewvc/blink?view=revision&revision=180117