Oilpan: GC Object Graph Dump Tool

This patch adds GC dump functionality enabled when built with GYP_DEFINES="gc_tracing=1".
- After each GC, heap objects survived GC are dumped.
- |Heap::findPathToObject| dumps the object graph keeping the target object alive at next GC.

This is a port of vegorov@'s GC graph dump tool to trunk with a few modifications:
- Allow unaligned pointer to be used for specifying target. This is done by using conservative scanning.
- |typeMarker| is not introduced. struct GCInfo now contains |m_className| to print the typename of the object allocated in the heap.

BUG=364364

Review URL: https://codereview.chromium.org/225023005

git-svn-id: svn://svn.chromium.org/blink/trunk@172456 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Avoid use of CSSValue in MediaQueryExp and MediaQueryEvaluator

Since the new MediaQueryParser should be thread-safe and CSSPrimitiveValue may not be, MediaQueryExp should not generate a CSSValue when created by MediaQueryParser and SizesAttributeParser. 
This CL fixes that.

BUG=365605

Review URL: https://codereview.chromium.org/240453010

git-svn-id: svn://svn.chromium.org/blink/trunk@172457 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Fix srcset selection bug when 'w' and src are present

When srcset had 'w' based resources that are all smaller than their display size imposed by 'sizes',
src got picked, contrary to expected behavior.
This CL fixes that and adds regression tests for that case.

BUG=365787

Review URL: https://codereview.chromium.org/249353002

git-svn-id: svn://svn.chromium.org/blink/trunk@172458 bbb929c8-8fbe-4397-9dbb-9b2b20218538
ServiceWorker: Wait for registration promise to resolve before changing states.

V8 Promise resolving is done as an async task. So resolving the
ServiceWorker registration promise followed by installing and activating
the worker on the browser side could result in an activated service
worker visible in the JavaScript "then" method, although the worker is
expected to have not yet begun installation at that point.

This patch teaches ServiceWorker to wait for the registration promise to
resolve before processing state changes from the browser.

This patch won't have an effect until the Chromium side change also lands.

BUG=365252

Review URL: https://codereview.chromium.org/247263010

git-svn-id: svn://svn.chromium.org/blink/trunk@172459 bbb929c8-8fbe-4397-9dbb-9b2b20218538