Don't leave stale pointers into m_grid

Don't leave stale pointers into m_grid

Sometimes grid children are wrapped into an anonymous blocks to become grid
items. Those anonymous blocks could be eventually removed by
RenderBlock::removeLeftoverAnonymousBlock() (called for example when adding
a new child to the grid). That method does not notify the hierarchy about
the removal since those anonymous blocks are not part of the
DOM. This means that further accesses to the m_grid contents will trigger
invalid accesses to the already deleted RenderObjects (the anonymous blocks).

To fix it we invalidate the contents of m_grid by setting the dirty flag in
the grid.

Based on the previous work in r161127 by <jchaffraix@chromium.org>;

BUG=313293
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=175912

[esprehn, 2014-06-04 18:51:50]

jchaffraix is your best reviewer here. jchaffraix@ can you take a look at this?

[Julien - ping for review, 2014-06-10 00:18:32]

lgtm, it's annoying that we have so many different ways of removing an object
from the tree :(

https://codereview.chromium.org/302083005/diff/1/LayoutTests/fast/css-grid-la...
File LayoutTests/fast/css-grid-layout/stale-grid-layout.html (right):

https://codereview.chromium.org/302083005/diff/1/LayoutTests/fast/css-grid-la...
LayoutTests/fast/css-grid-layout/stale-grid-layout.html:3: <div style="display:
grid;">The test checks that we don't add non-children of the grid into the grid
representation<br>This test has passed if it didn't crash under ASAN
Nit: Missing final dot.

https://codereview.chromium.org/302083005/diff/1/LayoutTests/fast/css-grid-la...
LayoutTests/fast/css-grid-layout/stale-grid-layout.html:8: .foo ~ .c1 {
animation-delay: 45762s; }
45762s is a lot of seconds but also not something that is going to be run. Also
there is no .foo or .c1.

[svillar, 2014-06-10 16:25:26]

The CQ bit was checked by svillar@igalia.com

[commit-bot: I haz the power, 2014-06-10 16:26:12]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/svillar@igalia.com/302083005/20001

[commit-bot: I haz the power, 2014-06-10 17:31:12]

FYI, CQ is re-trying this CL (attempt #1).
The failing builders are:
  win_blink_rel on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/win_blink_rel/builds/11453)

[commit-bot: I haz the power, 2014-06-10 18:12:18]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-06-10 18:12:19]

Try jobs failed on following builders:
  win_blink_rel on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/win_blink_rel/builds/11460)

[svillar, 2014-06-10 18:38:38]

The CQ bit was checked by svillar@igalia.com

[commit-bot: I haz the power, 2014-06-10 18:39:30]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/svillar@igalia.com/302083005/20001

[commit-bot: I haz the power, 2014-06-10 19:20:18]

Change committed as 175912