Fix SVGDocument return title that is not a child of the root element

third_party/WebKit/Source/core/svg/SVGTitleElement.cpp

Index: third_party/WebKit/Source/core/svg/SVGTitleElement.cpp
diff --git a/third_party/WebKit/Source/core/svg/SVGTitleElement.cpp b/third_party/WebKit/Source/core/svg/SVGTitleElement.cpp
index 062cdb539a6fd0a4641394a655071217b97a5259..ebe19d2f210901b33c7ce558b534d37f1fc82bf7 100644
--- a/third_party/WebKit/Source/core/svg/SVGTitleElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGTitleElement.cpp
@@ -21,12 +21,15 @@
 #include "core/svg/SVGTitleElement.h"
 
 #include "core/SVGNames.h"
+#include "core/dom/ChildListMutationScope.h"
 #include "core/dom/Document.h"
+#include "core/dom/Text.h"
 
 namespace blink {
 
 inline SVGTitleElement::SVGTitleElement(Document& document)
     : SVGElement(SVGNames::titleTag, document)
+    , m_ignoreTitleUpdatesWhenChildrenChange(false)
 {
 }
 
@@ -52,8 +55,23 @@ void SVGTitleElement::removedFrom(ContainerNode* rootParent)
 void SVGTitleElement::childrenChanged(const ChildrenChange& change)
 {
     SVGElement::childrenChanged(change);
-    if (inDocument() && document().isSVGDocument())
+    if (inDocument() && document().isSVGDocument() && !m_ignoreTitleUpdatesWhenChildrenChange)
         document().setTitleElement(this);
 }
 
+void SVGTitleElement::setText(const String& value)
+{
+    RefPtrWillBeRawPtr<Node> protectFromMutationEvents(this);
+    ChildListMutationScope mutation(*this);
+
+    {
+        // Avoid calling Document::setTitleElement() during intermediate steps.
+        TemporaryChange<bool> inhibitTitleUpdateScope(m_ignoreTitleUpdatesWhenChildrenChange, !value.isEmpty());
+        removeChildren(OmitSubtreeModifiedEvent);
+    }
+
+    if (!value.isEmpty())
+        appendChild(document().createTextNode(value.impl()), IGNORE_EXCEPTION);
+}
+
 } // namespace blink