Crash in WebCore::SVGElement::removedFromDocument

Crash in WebCore::SVGElement::removedFromDocument
https://bugs.webkit.org/show_bug.cgi?id=77270

Reviewed by Adam Barth.

Source/WebCore:

Add a protector before calling NodeRemovalDispatcher::dispatch since
NodeRemovalDispatcher::dispatch may remove the last RefPtr to this node.

Test: fast/dom/Range/surround-contents-font-face-crash.svg

* dom/ContainerNodeAlgorithms.h:
(WebCore::Private::addChildNodesToDeletionQueue):

LayoutTests:

Add a regression test for the crash.

* fast/dom/Range/surround-contents-font-face-crash-expected.txt: Added.
* fast/dom/Range/surround-contents-font-face-crash.svg: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@107749 268f45cc-cd09-0410-ab3c-d52691b4dbfc