Enforce that invalidations happen on a rooted tree

Now that most invalidations have moved to after layout,
these ASSERTs should not trigger. If they do, we should
catch them and fix the callers.

This change doesn't touch RenderObject's
invalidatePaintForWholeRenderer as it is called when
removing a renderer, which can be on an unrooted tree.

BUG=368140

Review URL: https://codereview.chromium.org/571643002

git-svn-id: svn://svn.chromium.org/blink/trunk@181948 bbb929c8-8fbe-4397-9dbb-9b2b20218538