Enforce clearing renderers' paint invalidation state

The ASSERT checks that no flags cleared by clearPaintInvalidationState()
is still set up after calling repaint-after-compositing-update.

The ASSERT is skipped for SVG subtree as we have an optimization that
skips them. We could reproduce the exact condition but it seems not
very useful to do so.

The change caught several bugs (yay!):
- one in shouldCheckForPaintInvalidationAfterLayout()
that made the ASSERT trip on fast/repaint/table-row.html.
- one where setShouldDoFullPaintInvalidationAfterLayout didn't
mark the containing block chain for invalidation.

BUG=385169
R=dsinclair@chromium.org, leviw@chromium.org

Review URL: https://codereview.chromium.org/389573008

git-svn-id: svn://svn.chromium.org/blink/trunk@178719 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Auto-rebaseline for r178694

http://src.chromium.org/viewvc/blink?view=revision&revision=178694

BUG=394619
TBR=wangxianzhu@chromium.org

Review URL: https://codereview.chromium.org/409313002

git-svn-id: svn://svn.chromium.org/blink/trunk@178720 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add missing id/name check over img-based RadioNodeLists.

For named lookups on forms, the spec tells us (step 2)

 http://www.whatwg.org/specs/web-apps/current-work/#dom-form-nameditem

that the RadioNodeList returned for the <img> only case should be
constrained to only those matching the given name/id.

R=
BUG=387312

Review URL: https://codereview.chromium.org/405383003

git-svn-id: svn://svn.chromium.org/blink/trunk@178721 bbb929c8-8fbe-4397-9dbb-9b2b20218538