Don't allow <stop> as layout tree child of <svg> or <g>

Source/core/layout/svg/LayoutSVGModelObject.cpp

 /*
  * Copyright (c) 2009, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 30 matching lines @@
 
 namespace blink {
 
 LayoutSVGModelObject::LayoutSVGModelObject(SVGElement* node)
     : LayoutObject(node)
 {
 }
 
 bool LayoutSVGModelObject::isChildAllowed(LayoutObject* child, const LayoutStyle&) const
 {
-    return child->isSVG() && !(child->isSVGInline() || child->isSVGInlineText());
+    return child->isSVG() && !(child->isSVGInline() || child->isSVGInlineText() || child->isSVGGradientStop());
 }
 
 LayoutRect LayoutSVGModelObject::clippedOverflowRectForPaintInvalidation(const LayoutBoxModelObject* paintInvalidationContainer, const PaintInvalidationState* paintInvalidationState) const
 {
     return SVGLayoutSupport::clippedOverflowRectForPaintInvalidation(this, paintInvalidationContainer, paintInvalidationState);
 }
 
 void LayoutSVGModelObject::mapLocalToContainer(const LayoutBoxModelObject* paintInvalidationContainer, TransformState& transformState, MapCoordinatesFlags, bool* wasFixed, const PaintInvalidationState* paintInvalidationState) const
 {
     SVGLayoutSupport::mapLocalToContainer(this, paintInvalidationContainer, transformState, wasFixed, paintInvalidationState);
@@ skipping 74 matching lines @@
         return;
 
     invalidatePaintIfNeeded(paintInvalidationState, paintInvalidationState.paintInvalidationContainer());
     clearPaintInvalidationState(paintInvalidationState);
 
     PaintInvalidationState childPaintInvalidationState(paintInvalidationState, *this);
     invalidatePaintOfSubtreesIfNeeded(childPaintInvalidationState);
 }
 
 } // namespace blink