Fix pepper crash when reattaching plugins in style recalc

Method document::updateLayoutTree creates ScriptForbiddenScope.

An HTML plugin can be reattached while updating layout tree. Pepper plugin
can be destroyed while reattaching and executes some scripts. This execution
produces crash on ScriptForbidden assert.

BUG=550427
R=pfeldman@chromium.org,dcheng@chromium.org,dgozman@chromium.org

Review URL: https://codereview.chromium.org/1693003002

Cr-Commit-Position: refs/heads/master@{#376084}

third_party/WebKit/Source/core/dom/Document.cpp

@@ -1729,6 +1729,10 @@ void Document::updateLayoutTree(StyleRecalcChange change)
     ASSERT(isMainThread());
 
     ScriptForbiddenScope forbidScript;
+    // We should forbid script execution for plugins here because update while layout is changing,
+    // HTMLPlugin element can be reattached and plugin can be destroyed. Plugin can execute scripts
+    // on destroy. It produces crash without PluginScriptForbiddenScope: crbug.com/550427.
+    PluginScriptForbiddenScope pluginForbidScript;
 
     if (!view() || !isActive())
         return;