SVG layout leaves objects still needing layout

SVG layout leaves objects still needing layout
https://bugs.webkit.org/show_bug.cgi?id=81006

Reviewed by Nikolas Zimmermann.

Source/WebCore:

Change the layout of SVG objects such that resources that trigger
layout of other objects are handled in a distinct pass, and then
objects still requiring layout are laid out again.

Test: svg/custom/delete-text-innerText-crash.html

* rendering/svg/RenderSVGResourceContainer.cpp:
(WebCore::RenderSVGResourceContainer::layout):
* rendering/svg/RenderSVGResourceMarker.cpp:
(WebCore::RenderSVGResourceMarker::layout):
* rendering/svg/RenderSVGRoot.cpp:
(WebCore::RenderSVGRoot::layout):
(WebCore::RenderSVGRoot::addResourceForClientInvalidation):
(WebCore):
* rendering/svg/RenderSVGRoot.h:
(RenderSVGRoot):

LayoutTests:

* svg/custom/delete-text-crash-expected.png: Removed.
* svg/custom/delete-text-crash-expected.txt:
* svg/custom/delete-text-crash.html:
* svg/custom/delete-text-innerText-crash-expected.txt: Added.
* svg/custom/delete-text-innerText-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@111601 268f45cc-cd09-0410-ab3c-d52691b4dbfc