Avoid inconsistency in Node::inDocument due to DOMSubtreeModified dispatch

Avoid inconsistency in Node::inDocument due to DOMSubtreeModified dispatch
https://bugs.webkit.org/show_bug.cgi?id=76087

Reviewed by Ryosuke Niwa.

Source/WebCore:

Move post-removal notifications after call to Node::removeFromDocument
to avoid inconsistent state of Node::inDocument() and thus avoid
inconsistent state in DocumentOrderedMap.

Tests: fast/dom/getElementById-consistency.html
       fast/dom/getElementById-consistency2.html

* dom/ContainerNode.cpp:
(WebCore::ContainerNode::removeChild):
* svg/SVGTRefElement.cpp:
(WebCore::SVGTRefElement::updateReferencedText): Fixed to work with new timing of DOMSubtreeModified dispatch.

LayoutTests:

* fast/dom/getElementById-consistency-expected.txt: Added.
* fast/dom/getElementById-consistency.html: Added.
* fast/dom/getElementById-consistency2-expected.txt: Added.
* fast/dom/getElementById-consistency2.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@108152 268f45cc-cd09-0410-ab3c-d52691b4dbfc