Ensure invalidation in LayoutBlockChildNode::removeChildNodes() without notifyLayoutObject

Ensure invalidation in LayoutBlockChildNode::removeChildNodes() without notifyLayoutObject

Some callers of LayoutBlockChildNode::removeChildNodes() passes
notifyLayoutObject=false and we missed invalidation of the painting
layer and the object.

The test case is converted from a cluster-fuzz test case.

BUG=628146
Review-Url: https://codereview.chromium.org/2160723006
Cr-Commit-Position: refs/heads/master@{#406436}
Committed: https://chromium.googlesource.com/chromium/src/+/f3d584d7a3188951128b5daa2b1d9f15e5306b52

[Xianzhu, 2016-07-21 06:01:51]

Description was changed from

==========
Ensure invalidation in LayoutBlockChildNode::removeChildNodes() without
notifyLayoutObject

Some callers of LayoutBlockChildNode::removeChildNodes() passes
notifyLayoutObject=false and we missed invalidation of the painting
layer and the object.

The test case is converted from a cluster-fuzz test case.

BUG=628146

Review-Url: https://codereview.chromium.org/2160723006
Cr-Commit-Position: refs/heads/master@{#406436}
==========

to

==========
Ensure invalidation in LayoutBlockChildNode::removeChildNodes() without
notifyLayoutObject

Some callers of LayoutBlockChildNode::removeChildNodes() passes
notifyLayoutObject=false and we missed invalidation of the painting
layer and the object.

The test case is converted from a cluster-fuzz test case.

BUG=628146

Review-Url: https://codereview.chromium.org/2160723006
Cr-Commit-Position: refs/heads/master@{#406436}
Committed:
https://chromium.googlesource.com/chromium/src/+/f3d584d7a3188951128b5daa2b1d...
==========

[Xianzhu, 2016-07-21 06:01:52]

Committed patchset #1 (id:1) manually as
f3d584d7a3188951128b5daa2b1d9f15e5306b52.