[CSS Shapes] Winding rule polygon issues

This patch corrects some of the problems with shape-inside and self-intersecting polygons and eliminates the layout flashing behavior that prompted the original bug report. The FloatPolygon::contains() method now respects the polygon's fillRule and the PolygonShape code used to find shape-inside intervals for the top and bottom of a line now also handles fillRule correctly.

The new tests verify that self-intersecting rectilinear shape-inside polygons work correctly for the evenodd and nonzero fill rules. The shape for tests 001 and 002 contains a loop (the vertices are numbered in the figure):

        0----4----1----5
        |         |        |        |
        |        3----2        |
        7--------------6

When the fillRule is nonzero the entire rectangle is filled because edges 7-0 and 3-4 wind in same direction. When fillRule is evenodd the 1-2-3-4 rectangle is not filled, leaving a U shape. The shape for tests 003 and 004 is similar, but the adjacent vertical edges wind in opposite directions. As a result both nonzero and evenodd fills produce the same U shaped result.

        0----2---1,5---6
        |         |        |       |
        |        3----4       |
        8--------------7

BUG=290950

Review URL: https://chromiumcodereview.appspot.com/24143002

git-svn-id: svn://svn.chromium.org/blink/trunk@157992 bbb929c8-8fbe-4397-9dbb-9b2b20218538
[CSS Grid Layout] Speed up painting on large grids

The painting code wasn't using the grid's struture during painting.
This lead to an algorithm that would try all grid items, regardless
of whether they were outside the area to be painted.

This change makes the painting code do a binary search over the
computed grid coordinates and paint only the children that are in
these grid areas. OrderIterator was changed to be able to store the
children during collection and iterate over them, instead of always
going over all the children.

On a 200x200 grid with one grid item in each grid area, this brings
the paint time from 20ms to 2ms. Unfortunately, such a test case
cannot be added as it would require significant changes to work with
our infrastructure that would make the test not very representative
of the original use case.

The test case can be found on the associated bug (comment 5)

BUG=248151

Review URL: https://chromiumcodereview.appspot.com/22642010

git-svn-id: svn://svn.chromium.org/blink/trunk@157993 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix handling of block with left margin next to a float

When refactoring the code, I ended up adding the margin in instead of
subtracting it in the case of an intruding float. This patch fixes that
so that the margin is properly handled.

BUG=294486

Review URL: https://chromiumcodereview.appspot.com/24119003

git-svn-id: svn://svn.chromium.org/blink/trunk@157994 bbb929c8-8fbe-4397-9dbb-9b2b20218538