Oilpan: fix strongification in rare corner case in weak collection handling.

Weak collection backings were marked in a weak object callback. However,
that callback is not called if the thread owning the object does not
wake up. Therefore, the backing is marked dead in clearMarksAndMarkDead.
When an object is marked dead it is disregarded when seen from the
stack. That breaks strongification as the added regression test shows.

The fix is to introduce a separate callback stack for post-marking
callbacks. We use this to mark the collection backings that have
not been marked from elsewhere and to perform ephemeron cleanup
after ephemeron iteration.

R=erik.corry@gmail.com, oilpan-reviews@chromium.org, wibling@chromium.org

Review URL: https://codereview.chromium.org/512693002

git-svn-id: svn://svn.chromium.org/blink/trunk@180981 bbb929c8-8fbe-4397-9dbb-9b2b20218538