[Blink] Content mutation should be allowed during kPrePaintClean

The DCHECK in SVGElementProxy::IdObserver::ContentChanged() is too
restrictive. The document is only vulnerable to mutation during paint or
pre-paint, but should be safe to mutate once the update is done.

BUG=807159

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: If9f795e0ac55d204d5f165221af2453b54eda6a5
Reviewed-on: https://chromium-review.googlesource.com/894189Reviewed-by: Stephen Chenney <schenney@chromium.org>
Commit-Queue: Tien-Ren Chen <trchen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#533060}

third_party/WebKit/LayoutTests/TestExpectations

@@ -3332,8 +3332,6 @@ crbug.com/783154 [ Mac ] virtual/modern-media-controls/media/controls/modern/dou
 
 crbug.com/802915 css3/blending/isolation-should-include-non-local-background.html [ Failure ]
 
-crbug.com/807159 hittesting/inline-with-clip-path.html [ Pass Crash ]
-
 # Sheriff faulures 2017-12-12
 crbug.com/794180 http/tests/devtools/layers/layer-compositing-reasons.js [ Failure Pass ]
 

third_party/WebKit/Source/core/svg/SVGElementProxy.cpp

@@ -41,8 +41,8 @@ class SVGElementProxy::IdObserver : public IdTargetObserver {
   }
 
   void ContentChanged() {
-    DCHECK(Lifecycle().GetState() <= DocumentLifecycle::kCompositingClean ||
-           Lifecycle().GetState() >= DocumentLifecycle::kPaintClean);
+    DCHECK(Lifecycle().GetState() != DocumentLifecycle::kInPrePaint &&
+           Lifecycle().GetState() != DocumentLifecycle::kInPaint);
     HeapVector<Member<SVGResourceClient>> clients;
     CopyToVector(clients_, clients);
     for (SVGResourceClient* client : clients)