Oilpan's heap should be shut down after all threads are detached and Heap::shutdown is called

This CL is a fix for bug 365197. The crash happens if things happen in the following order:

(1) The main thread posts a setupHTMLParserThread task to a parser thread.
(2) The main thread calls detachMainThread(). Because the main thread is the last thread detached, it calls Heap::lastThreadDetached(). It calls ThreadState::shutdown(). It deletes ThreadState::SafePointBarrier.
(3) The parser thread starts processing the setupHTMLParserThread task. It calls ThreadState::attach() and tries to enter an safe point scope. It crashes because ThreadState::SafePointBarrier is already deleted.

The issue here is that we're shutting down the heap before the main thread calls Heap::shutdown(). (The main thread joins with the parser thread before calling Heap::shutdown().) Thus this CL fixes the crash by making Oilpan's heap start the shutdown sequence after all threads are detached *and* Heap::shutdown() is called.

BUG=365197
TEST=None. Cannot reproducible.

Review URL: https://codereview.chromium.org/243333006

git-svn-id: svn://svn.chromium.org/blink/trunk@172125 bbb929c8-8fbe-4397-9dbb-9b2b20218538
SVG does not respect overflow:visible.

For standalone svg documents, always clip to the viewport ('auto' acts as 'hidden').

For 'overflow: hidden | scroll' on any svg element: clip.
For 'overflow: auto | visible' on any svg element: don't clip.

New behaviours for stand-alone svg documents:
* overflow-x and overflow-y for controlling each scrollbar independently is now supported.
* overflow:scroll will display scrollbars regardless of the svg overflowing or not (as required by CSS).
* overflow:hidden will cause overflow to be clipped away and scrollbars to be hidden.

BUG=231577

Review URL: https://codereview.chromium.org/220853002

git-svn-id: svn://svn.chromium.org/blink/trunk@172126 bbb929c8-8fbe-4397-9dbb-9b2b20218538