Merge 112119

LayoutTests/svg/custom/delete-modified-text-in-defs-crash.svg

 <svg id="svgRoot" xmlns="http://www.w3.org/2000/svg" onload="go()">
   <defs>
     <text>
       <tspan id="tspan1" x="375"></tspan>
       <tspan>PASS</tspan>
     </text>
   </defs>
   <g><rect id="legendbox"/></g>
   <script><![CDATA[
     document.execCommand("SelectAll");
     elem = document.getElementById("tspan1");
     elem.removeAttribute("x");
     range = document.createRange();
     range.setStartBefore(document.getElementById("tspan1"));
     range.setEndAfter(document.getElementById("legendbox"));
     range.deleteContents();
 
     if (window.layoutTestController)
         layoutTestController.dumpAsText();
 
     function go() {
       var svgRoot = document.getElementById("svgRoot");
       var passText = document.createElementNS("http://www.w3.org/2000/svg", "text");
       var textContent = document.createTextNode("PASS");
       passText.appendChild(textContent);
       svgRoot.appendChild(passText);
     }
   ]]></script>
 </svg>