Add logic for catching unsafe scoped_refptr conversions to T* in returns

The tool doesn't attempt to handle all potential unsafe conversions. It
only attempts to catch a conservative subset of the conversions that are
definitely unsafe, such as returning a local scoped_refptr<T> or
temporary.
If it encounters something that isn't simple to resolve as safe/unsafe
(for example, a reference may be bound to a variable with local storage,
which is unsafe, or it may be bound to a member, which is probably safe),
it prefers to skip rewriting anything at all, so it can be manually
resolved.

BUG=110610
R=rsleevi@chromium.org

Review URL: https://codereview.chromium.org/472923002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@290225 0039d316-1c4b-4281-b951-d872f2087c98
7 files changed