[CSSGridLayout] <embed> elements leaving stale pointers into grid

In r177653 (https://codereview.chromium.org/358673003) we added a call to
splitAnonymousBoxesAroundChild() in RenderGrid::addChild() in order to properly
deal with anonymous grid items being added to the grid. The thing is that we
should invalidate the grid after that because that call changes the render tree
(normally creating a new anonymous block which will be the parent of the child).

The changes in the addChild() function in r177258 hid this bug.

    if (!style()->isGridAutoFlowAlgorithmStack()) {
        dirtyGrid();
        return;
    }

Since the default initial value of 'grid-auto-flow' is now 'row', every grid
that does not specify a value for the property enters this block by default. So
the grid was invalidated there hidding the underlying problem. But if we specify
'grid-auto-flow: stack' then we easily reach an inconsistent state in our
internal representation (and hit ASSERTs).

BUG=401479

Review URL: https://codereview.chromium.org/488163002

git-svn-id: svn://svn.chromium.org/blink/trunk@181339 bbb929c8-8fbe-4397-9dbb-9b2b20218538