[CSS Shapes] clamp RasterShape shapeMargin to reference box size

Verify that a very large shape-margin value combined with a very small
shape-outside image defines a shape that matches the shape-outside
element's margin-box.

This is a merge of http://trac.webkit.org/changeset/166019 by
Hans Muller <hmuller@adobe.com>.

BUG=354917

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=169768

Review URL: https://codereview.chromium.org/208423003

git-svn-id: svn://svn.chromium.org/blink/trunk@169877 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Remove DisableCompositingQueryAsserts in FV::scrollbarExistenceDidChange

This patch removes a compositing query assert in
FrameView::scrollbarExistenceDidChange because no compositing state is
queried through scrollbarExistenceDidChange.

No new tests.

Review URL: https://codereview.chromium.org/208313016

git-svn-id: svn://svn.chromium.org/blink/trunk@169878 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert r169876 "Remove use of a V8 handle outside of bindings code in TimingInput.cpp."



git-svn-id: svn://svn.chromium.org/blink/trunk@169880 bbb929c8-8fbe-4397-9dbb-9b2b20218538