Merge 125162

LayoutTests/svg/custom/tref-nested-events-crash.svg

 <?xml version="1.0" encoding="UTF-8"?>
 <svg onload="CFcrash()" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
   <!-- Test for https://bugs.webkit.org/show_bug.cgi?id=93004 -->
   <g id="test-body-content">
     <defs>
         <text id="hello">
             <tspan id="tspan">##</tspan>
         </text>
     </defs>
 
@@ skipping 13 matching lines @@
     var tspan = document.getElementById("tspan");
 
     function CFcrash() {
         test_body_content.addEventListener("DOMCharacterDataModified", function () { 
             try { test_body_content.parentNode.removeChild(test_body_content); } catch (e) {}
 
             if (window.testRunner)
                 setTimeout('testRunner.notifyDone()', 0);
         }, false); 
         document.adoptNode(tspan); 
+        if (window.testRunner)
+            setTimeout('testRunner.notifyDone()', 10);
     }
   </script>
 </svg>