Merge 187602 "ScopedStyleResolver should be cleared when ShadowR..."

Merge 187602 "ScopedStyleResolver should be cleared when ShadowR..."

> ScopedStyleResolver should be cleared when ShadowRoot is removed from document.
> 
> If a shadow root (=treescope), which has a style element, is moved from a document to another document, a new ShadowStyleSheetCollection is created for the shadow root.
> 
> The ShadowStyleSheetCollection has no active stylesheets, but the treescope's scopedStyleResolver has an active stylesheet.
> 
> The active stylesheet has been already cleared (i.e. clearOwnerNode is invoked) while moving.
> However, StyleEngine cannot clear the treescope's resolver, because the ShadowStyleSheetCollection has no information. This causes heap-use-after-free.
> 
> BUG=443017
> TEST=fast/html/marquee-clone-crash.html
> 
> Review URL: https://codereview.chromium.org/809343002

TBR=tasak@google.com

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=187669

[kochi, 2014-12-24 02:02:52]

Committed patchset #1 (id:1) manually as r187669 (tree was closed).