Tighten up the allowable-child criteria in RenderSVGInline

Source/core/rendering/svg/RenderSVGInline.cpp

 /*
  * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
  * Copyright (C) 2006 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 23 matching lines @@
 bool RenderSVGInline::isChildAllowed(RenderObject* child, RenderStyle* style) const
 {
     if (SVGRenderSupport::isEmptySVGInlineText(child))
         return false;
 
     if (node()->hasTagName(SVGNames::aTag)) {
         // Disallow direct descendant 'a'.
         if (child->node()->hasTagName(SVGNames::aTag))
             return false;
     }
+
+    if (!child->isSVGInline() && !child->isSVGInlineText())
+        return false;
+
     return RenderInline::isChildAllowed(child, style);
 }
 
 RenderSVGInline::RenderSVGInline(Element* element)
     : RenderInline(element)
 {
     setAlwaysCreateLineBoxes();
 }
 
 InlineFlowBox* RenderSVGInline::createInlineFlowBox()
@@ skipping 91 matching lines @@
         RenderInline::removeChild(child);
         return;
     }
     Vector<SVGTextLayoutAttributes*, 2> affectedAttributes;
     textRenderer->subtreeChildWillBeRemoved(child, affectedAttributes);
     RenderInline::removeChild(child);
     textRenderer->subtreeChildWasRemoved(affectedAttributes);
 }
 
 }