Fix repaintTreeAfterLayout tree walk

The current code uses a depth-first search over the render
tree. This walk however is wrong as we are using LayoutState
which assumes that we jump into our positioned elements
(LayoutState assumes that the previous LayoutState comes from
the containing block, not the parent).

This change fixes fast/repaint/subtree-root-fixed.html
and all the positioned elements' offset (they were wrongly
picking up the body's 8px margins).

To prevent bugs where we forget to repaint elements, added
some ASSERTs that we call repaintTreeAfterLayout.

Review URL: https://codereview.chromium.org/258693002

git-svn-id: svn://svn.chromium.org/blink/trunk@172558 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Use GenericEventQueue class in HTMLFormElement

Use GenericEventQueue class in HTMLFormElement to make the autocomplete event
dispatching code simpler.

R=tkent@chromium.org, esprehn@chromium.org

Review URL: https://codereview.chromium.org/255673003

git-svn-id: svn://svn.chromium.org/blink/trunk@172559 bbb929c8-8fbe-4397-9dbb-9b2b20218538