Fix crash in SVGFontFaceElement::associatedFontElement crash when removing SVGFontFaceElement.

Source/core/rendering/svg/RenderSVGText.cpp

 /*
  * Copyright (C) 2006 Apple Computer, Inc.
  * Copyright (C) 2006 Alexander Kellett <lypanov@kde.org>
  * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
  * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2008 Rob Buis <buis@kde.org>
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
  * Copyright (C) Research In Motion Limited 2010-2012. All rights reserved.
  * Copyright (C) 2012 Google Inc.
  *
@@ skipping 248 matching lines @@
         return;
     }
 
     // This is called immediately after subtreeChildWillBeDestroyed, once the RenderSVGInlineText::willBeDestroyed() method
     // passes on to the base class, which removes us from the render tree. At this point we can update the layout attributes.
     unsigned size = affectedAttributes.size();
     for (unsigned i = 0; i < size; ++i)
         m_layoutAttributesBuilder.buildLayoutAttributesForTextRenderer(affectedAttributes[i]->context());
 }
 
-void RenderSVGText::subtreeStyleDidChange(RenderSVGInlineText* text)
+void RenderSVGText::subtreeStyleDidChange()
 {
-    ASSERT(text);
     if (!shouldHandleSubtreeMutations() || documentBeingDestroyed())
         return;
 
     checkLayoutAttributesConsistency(this, m_layoutAttributes);
 
     // Only update the metrics cache, but not the text positioning element cache
     // nor the layout attributes cached in the leaf #text renderers.
     FontCachePurgePreventer fontCachePurgePreventer;
-    for (RenderObject* descendant = text; descendant; descendant = descendant->nextInPreOrder(text)) {
+    for (RenderObject* descendant = firstChild(); descendant; descendant = descendant->nextInPreOrder(this)) {
         if (descendant->isSVGInlineText())
             m_layoutAttributesBuilder.rebuildMetricsForTextRenderer(toRenderSVGInlineText(descendant));
     }
 }
 
 void RenderSVGText::subtreeTextDidChange(RenderSVGInlineText* text)
 {
     ASSERT(text);
     ASSERT(!beingDestroyed());
     if (!everHadLayout()) {
@@ skipping 24 matching lines @@
         RenderSVGInlineText* text = toRenderSVGInlineText(descendant);
         text->updateScaledFont();
         if (builder)
             builder->rebuildMetricsForTextRenderer(text);
     }
 }
 
 void RenderSVGText::layout()
 {
     ASSERT(needsLayout());
+
+    subtreeStyleDidChange();
+
     LayoutRectRecorder recorder(*this);
     LayoutRepainter repainter(*this, SVGRenderSupport::checkForSVGRepaintDuringLayout(this));
 
     bool updateCachedBoundariesInParents = false;
     if (m_needsTransformUpdate) {
         m_localTransform = toSVGTextElement(node())->animatedLocalTransform();
         m_needsTransformUpdate = false;
         updateCachedBoundariesInParents = true;
     }
 
@@ skipping 202 matching lines @@
     return 0;
 }
 
 // Fix for <rdar://problem/8048875>. We should not render :first-letter CSS Style
 // in a SVG text element context.
 void RenderSVGText::updateFirstLetter()
 {
 }
 
 }