The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/739eacccde272d844e8e2cfd19952b3daf3b52b3

commit 739eacccde272d844e8e2cfd19952b3daf3b52b3
Author: grt <grt@chromium.org>
Date: Fri Aug 05 10:57:59 2016

Disable crashy KioskTest.PRE_LaunchAppNetworkDown.

BUG= 634807 
TBR=xiyuan@chromium.org

Review-Url: https://codereview.chromium.org/2217983002
Cr-Commit-Position: refs/heads/master@{#410026}

[modify] https://crrev.com/739eacccde272d844e8e2cfd19952b3daf3b52b3/chrome/browser/chromeos/login/kiosk_browsertest.cc

Note the crashed renderer is of the login screen, not the testing app:

[22872:22872:0805/022245:FATAL:login_display_host_impl.cc(903)] Renderer crash on login window

Renderer stack:
Received signal 11 SEGV_MAPERR 0000fbadbeef
#0 0x000002f2d3b7 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#1 0x7f45b08afcb0 <unknown>
#2 0x00000646a859 blink::LayoutObject::incrementallyInvalidatePaint()
#3 0x00000640eb18 blink::LayoutBox::incrementallyInvalidatePaint()
#4 0x000006469ee5 blink::LayoutObject::invalidatePaintIfNeeded()
#5 0x00000640210c blink::LayoutBox::invalidatePaintIfNeeded()
#6 0x0000063f810b blink::LayoutBlockFlow::invalidatePaintIfNeeded()
#7 0x0000064155f7 blink::LayoutBoxModelObject::invalidateTreeIfNeeded()
#8 0x0000064694eb blink::LayoutObject::invalidatePaintOfSubtreesIfNeeded()
#9 0x00000640224f blink::LayoutBox::invalidatePaintOfSubtreesIfNeeded()
#10 0x00000641582e blink::LayoutBoxModelObject::invalidateTreeIfNeeded()
#11 0x0000064694eb blink::LayoutObject::invalidatePaintOfSubtreesIfNeeded()
#12 0x00000640224f blink::LayoutBox::invalidatePaintOfSubtreesIfNeeded()
#13 0x00000641582e blink::LayoutBoxModelObject::invalidateTreeIfNeeded()
#14 0x0000064694eb blink::LayoutObject::invalidatePaintOfSubtreesIfNeeded()
#15 0x00000640224f blink::LayoutBox::invalidatePaintOfSubtreesIfNeeded()
#16 0x00000641582e blink::LayoutBoxModelObject::invalidateTreeIfNeeded()
#17 0x0000064694eb blink::LayoutObject::invalidatePaintOfSubtreesIfNeeded()
#18 0x00000640224f blink::LayoutBox::invalidatePaintOfSubtreesIfNeeded()
#19 0x00000641582e blink::LayoutBoxModelObject::invalidateTreeIfNeeded()
#20 0x0000064694eb blink::LayoutObject::invalidatePaintOfSubtreesIfNeeded()
#21 0x00000640224f blink::LayoutBox::invalidatePaintOfSubtreesIfNeeded()
#22 0x00000641582e blink::LayoutBoxModelObject::invalidateTreeIfNeeded()
#23 0x0000064694eb blink::LayoutObject::invalidatePaintOfSubtreesIfNeeded()
#24 0x00000640224f blink::LayoutBox::invalidatePaintOfSubtreesIfNeeded()
#25 0x00000641582e blink::LayoutBoxModelObject::invalidateTreeIfNeeded()
#26 0x0000061f2c8c blink::FrameView::invalidateTreeIfNeeded()
#27 0x0000061fabc7 blink::FrameView::invalidateTreeIfNeededRecursiveInternal()
#28 0x0000061f9451 blink::FrameView::invalidateTreeIfNeededRecursive()
#29 0x0000061f8b5b blink::FrameView::updateLifecyclePhasesInternal()
#30 0x000006338d8a blink::PageAnimator::updateAllLifecyclePhases()
#31 0x000005a569af blink::WebViewImpl::updateAllLifecyclePhases()
#32 0x000004472516 cc::ProxyMain::BeginMainFrame()
#33 0x00000447f635 _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvSt10unique_ptrINS3_28BeginMainFrameAndCommitStateESt14default_deleteIS6_EEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperIS9_EEEEEFvvEE7RunImplIRKSB_RKSt5tupleIJSD_SF_EEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#34 0x000002fb5189 base::debug::TaskAnnotator::RunTask()
#35 0x0000058cad77 scheduler::TaskQueueManager::ProcessTaskFromWorkQueue()
#36 0x0000058c9adb scheduler::TaskQueueManager::DoWork()
#37 0x000002fb5189 base::debug::TaskAnnotator::RunTask()
#38 0x000002f4a0e5 base::MessageLoop::RunTask()

Xianzhu, could you take a quick look?

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b9ec37cfc550102e95696f26173b95b729d00a60

commit b9ec37cfc550102e95696f26173b95b729d00a60
Author: wangxianzhu <wangxianzhu@chromium.org>
Date: Sat Aug 06 00:43:32 2016

Fix wrong PaintInvalidationIncremental on empty object

The bug was because LayoutBox::getPaintInvalidatinReason()
returned PaintInvalidationIncremental after
LayoutObject::getPaintInvalidationReason() returned
PaintInvalidationNone for an empty object. In the case we
should not do any paint invalidation but executed
incrementallyInvalidatePaint() and triggered the assertion
failure.

BUG= 634807 

Review-Url: https://codereview.chromium.org/2212223004
Cr-Commit-Position: refs/heads/master@{#410231}

[add] https://crrev.com/b9ec37cfc550102e95696f26173b95b729d00a60/third_party/WebKit/LayoutTests/paint/invalidation/empty-object-move-and-resize-expected.txt
[add] https://crrev.com/b9ec37cfc550102e95696f26173b95b729d00a60/third_party/WebKit/LayoutTests/paint/invalidation/empty-object-move-and-resize.html
[modify] https://crrev.com/b9ec37cfc550102e95696f26173b95b729d00a60/third_party/WebKit/Source/core/layout/LayoutBox.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d90908aa349ab85861643550dcbe3863d1b219b5

commit d90908aa349ab85861643550dcbe3863d1b219b5
Author: wangxianzhu <wangxianzhu@chromium.org>
Date: Sat Aug 06 02:01:05 2016

Revert of Disable crashy KioskTest.PRE_LaunchAppNetworkDown. (patchset #1 id:1 of https://codereview.chromium.org/2217983002/ )

Reason for revert:
https://codereview.chromium.org/2212223004/ fixed the issue.

Original issue's description:
> Disable crashy KioskTest.PRE_LaunchAppNetworkDown.
>
> BUG= 634807 
> TBR=xiyuan@chromium.org
>
> Committed: https://crrev.com/739eacccde272d844e8e2cfd19952b3daf3b52b3
> Cr-Commit-Position: refs/heads/master@{#410026}

TBR=xiyuan@chromium.org,grt@chromium.org
BUG= 634807 

Review-Url: https://codereview.chromium.org/2218903003
Cr-Commit-Position: refs/heads/master@{#410251}

[modify] https://crrev.com/d90908aa349ab85861643550dcbe3863d1b219b5/chrome/browser/chromeos/login/kiosk_browsertest.cc

Fix checked in M54 build 8682.0.0. 54.0.2822.0.

Verified in build 8743.4.0, chromeos 54.0.2840.6