SVGPropertyTearOffs should detachChildren before deleting its value

Source/core/svg/properties/SVGPropertyTearOff.h

 /*
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 38 matching lines @@
     static PassRefPtr<Self> create(const PropertyType& initialValue)
     {
         return adoptRef(new Self(initialValue));
     }
 
     PropertyType& propertyReference() { return *m_value; }
     SVGAnimatedProperty* animatedProperty() const { return m_animatedProperty; }
 
     void setValue(PropertyType& value)
     {
-        if (m_valueIsCopy)
+        if (m_valueIsCopy) {
+            detachChildren();
             delete m_value;
+        }
         m_valueIsCopy = false;
         m_value = &value;
     }
 
     void setAnimatedProperty(SVGAnimatedProperty* animatedProperty)
     {
         m_animatedProperty = animatedProperty;
 
         if (m_animatedProperty)
             m_contextElement = m_animatedProperty->contextElement();
@@ skipping 87 matching lines @@
     SVGAnimatedProperty* m_animatedProperty;
     SVGPropertyRole m_role;
     PropertyType* m_value;
     Vector<WeakPtr<SVGPropertyTearOffBase> > m_childTearOffs;
     bool m_valueIsCopy : 1;
 };
 
 }
 
 #endif // SVGPropertyTearOff_h