Devirtualize type checks in RenderObject.

This adds two flags into RenderObject, one for the base objects and one for the
objects marked FINAL. For any of the FINAL types they are mutually exclusive,
for the base types, you can have a bunch of them set at the same time

BUG=271114,302830

Review URL: https://codereview.chromium.org/26302005

git-svn-id: svn://svn.chromium.org/blink/trunk@159884 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert 159836 "DEFINE_CSS_VALUE_TYPE_CASTS starts to use DEFINE_..."

BUG=308594

> DEFINE_CSS_VALUE_TYPE_CASTS starts to use DEFINE_TYPE_CASTS
>
> DEFINE_CSS_VALUE_TYPE_CASTS starts to use DEFINE_TYPE_CASTS so that it is more flexible. Under this change, unusual CSS child values will be able to use the DEFINE_CSS_VALUE_TYPE_CASTS as well.
>
> BUG=N/A
>
> Review URL: https://codereview.chromium.org/26145005

TBR=gyuyoung.kim@samsung.com

Review URL: https://codereview.chromium.org/27498003

git-svn-id: svn://svn.chromium.org/blink/trunk@159885 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add filter primitive subregion (crop rect) support for FEDisplacementMap,
FETurbulence. Covered by css3/filters/effect-reference-subregion-hw.html.

BUG=229910
R=fmalita

Review URL: https://codereview.chromium.org/27560002

git-svn-id: svn://svn.chromium.org/blink/trunk@159886 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add another call to gc() in leak-window-scriptable-object.html to make it less flaky

This is just papering over some GC bug, but it makes the test less flaky. Any test
that uses numberOfLiveNodes is going to be flaky without two gcs, it seems.

R=haraken
BUG=307318,307614

Review URL: https://codereview.chromium.org/27619003

git-svn-id: svn://svn.chromium.org/blink/trunk@159887 bbb929c8-8fbe-4397-9dbb-9b2b20218538