Merge 117977

Source/WebCore/rendering/svg/RenderSVGText.cpp

Index: Source/WebCore/rendering/svg/RenderSVGText.cpp
===================================================================
--- Source/WebCore/rendering/svg/RenderSVGText.cpp	(revision 118876)
+++ Source/WebCore/rendering/svg/RenderSVGText.cpp	(working copy)
@@ -168,7 +168,6 @@
 void RenderSVGText::subtreeChildWasAdded(RenderObject* child)
 {
     ASSERT(child);
-    ASSERT(child->isSVGInlineText() || child->isSVGInline());
     if (!shouldHandleSubtreeMutations() || documentBeingDestroyed())
         return;
 
@@ -176,6 +175,9 @@
     // cache, as the next buildLayoutAttributesForTextRenderer() call rebuilds it.
     m_layoutAttributesBuilder.clearTextPositioningElements();
 
+    if (!child->isSVGInlineText() && !child->isSVGInline())
+        return;
+
     // Detect changes in layout attributes and only measure those text parts that have changed!
     Vector<SVGTextLayoutAttributes*> newLayoutAttributes;
     collectLayoutAttributes(this, newLayoutAttributes);
@@ -238,7 +240,6 @@
 void RenderSVGText::subtreeChildWillBeRemoved(RenderObject* child, Vector<SVGTextLayoutAttributes*, 2>& affectedAttributes)
 {
     ASSERT(child);
-    ASSERT(child->isSVGInlineText() || child->isSVGInline());
     if (!shouldHandleSubtreeMutations())
         return;
 
@@ -247,7 +248,7 @@
     // The positioning elements cache depends on the size of each text renderer in the
     // subtree. If this changes, clear the cache. It's going to be rebuilt below.
     m_layoutAttributesBuilder.clearTextPositioningElements();
-    if (m_layoutAttributes.isEmpty() || child->isSVGInline())
+    if (m_layoutAttributes.isEmpty() || !child->isSVGInlineText())
         return;
 
     // This logic requires that the 'text' child is still inserted in the tree.