Revert of Divorce PaintInvalidationState from LayoutState (https://codereview.chromium.org/36083300…

Source/core/rendering/RenderListItem.cpp

 /**
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 256 matching lines @@
     return result;
 }
 
 void RenderListItem::updateMarkerLocationAndInvalidateWidth()
 {
     ASSERT(m_marker);
 
     // FIXME: We should not modify the structure of the render tree
     // during layout. crbug.com/370461
     DeprecatedDisableModifyRenderTreeStructureAsserts disabler;
+    // Removing and adding the marker can trigger repainting in
+    // containers other than ourselves, so we need to disable LayoutState.
+    ForceHorriblySlowRectMapping slowRectMapping(*this);
     if (updateMarkerLocation()) {
         // If the marker is inside we need to redo the preferred width calculations
         // as the size of the item now includes the size of the list marker.
         if (m_marker->isInside())
             containingBlock()->updateLogicalWidth();
     }
 }
 
 bool RenderListItem::updateMarkerLocation()
 {
@@ skipping 230 matching lines @@
             // assume that all the following ones have too.
             // This gives us the opportunity to stop here and avoid
             // marking the same nodes again.
             break;
         }
         item->updateValue();
     }
 }
 
 } // namespace WebCore