Merge 130855 - Recursively detach SVGElementInstances

Source/WebCore/svg/SVGElementInstance.cpp

 /*
  * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  * Copyright (C) 2011 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 69 matching lines @@
     m_deletionHasBegun = true;
 #endif
     delete this;
 }
 
 void SVGElementInstance::detach()
 {
     // Clear all pointers. When the node is detached from the shadow DOM it should be removed but,
     // due to ref counting, it may not be. So clear everything to avoid dangling pointers.
 
+    for (SVGElementInstance* node = firstChild(); node; node = node->nextSibling())
+        node->detach();
+
     // Deregister as instance for passed element, if we haven't already.
     if (m_element->instancesForElement().contains(this))
         m_element->removeInstanceMapping(this);
     // DO NOT clear ref to m_element because JavaScriptCore uses it for garbage collection
 
     m_shadowTreeElement = 0;
 
     m_directUseElement = 0;
     m_correspondingUseElement = 0;
 
@@ skipping 113 matching lines @@
 
 SVGElementInstance::InstanceUpdateBlocker::~InstanceUpdateBlocker()
 {
     if (m_targetElement)
         m_targetElement->setInstanceUpdatesBlocked(false);
 }
    
 }
 
 #endif