Fix crash when popstate handler detaches frame during history navigation

Protect FrameLoader::m_frame in FrameLoader::loadHistoryItem() to
keep it from being destroyed if a popstate event handler, dispatched
via FrameLoader::loadInSameDocument(), removes the frame from the
parent document.

BUG=334239

Review URL: https://codereview.chromium.org/138213002

git-svn-id: svn://svn.chromium.org/blink/trunk@165081 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Take into account fill-rule for polygon interpolation

Implement the polygon fill-rule part of http://dev.w3.org/csswg/css-shapes/#basic-shape-interpolation.

Review URL: https://codereview.chromium.org/132643006

git-svn-id: svn://svn.chromium.org/blink/trunk@165082 bbb929c8-8fbe-4397-9dbb-9b2b20218538