Stop a SVG <use> element from modifying its UA shadow tree when it is removed

third_party/WebKit/Source/core/svg/SVGUseElement.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann
  * <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
  * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  * Copyright (C) 2011 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  * Copyright (C) 2012 University of Szeged
  * Copyright (C) 2012 Renata Hodovan <reni@webkit.org>
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 110 matching lines @@
     return InsertionDone;
   ASSERT(!m_targetElementInstance || !isWellFormedDocument(&document()));
   ASSERT(!hasPendingResources() || !isWellFormedDocument(&document()));
   invalidateShadowTree();
   return InsertionDone;
 }
 
 void SVGUseElement::removedFrom(ContainerNode* rootParent) {
   SVGGraphicsElement::removedFrom(rootParent);
   if (rootParent->isConnected()) {
-    clearShadowTree();
+    clearInstanceRoot();
+    removeAllOutgoingReferences();
     cancelShadowTreeRecreation();
   }
 }
 
 static void transferUseWidthAndHeightIfNeeded(
     const SVGUseElement& use,
     SVGElement& shadowElement,
     const SVGElement& originalElement) {
   DEFINE_STATIC_LOCAL(const AtomicString, hundredPercentString, ("100%"));
   // Use |originalElement| for checking the element type, because we will
@@ skipping 587 matching lines @@
 
   if (m_resource)
     m_resource->removeClient(this);
 
   m_resource = resource;
   if (m_resource)
     m_resource->addClient(this);
 }
 
 }  // namespace blink