Cherry-pick security fix in WebKit change 63772

Cherry-pick security fix in WebKit change 63772

See http://trac.webkit.org/changeset/63772

Note that this is only a partial cherry-pick. I don't think that the
fix to RenderBlock::canMergeContiguousAnonymousBlocks() is required as
we don't have this method in our version of WebKit. The method was
added in http://trac.webkit.org/changeset/60201). Attempting to make
the fix without this change, or cherry-picking this change too, would
be too high risk.

Bug: 2986936
Change-Id: I8d9f1924611e693e340dcb2f05a43d5673ef23b1