https://bugs.webkit.org/show_bug.cgi?id=73735

Reviewed by David Hyatt.

Source/WebCore:

Tests: fast/regions/svg-doc-fragment-not-collected-expected.html
       fast/regions/svg-doc-fragment-not-collected.html
       fast/regions/svg-element-not-collected-expected.html
       fast/regions/svg-element-not-collected.html
       fast/regions/svg-root-element-collected.html

By allowing only svg root elements to be collected in a render flow thread,
the svg render tree is properly constructed, thus prevented a possible further crash.

* dom/NodeRenderingContext.cpp:
(WebCore::NodeRenderingContext::moveToFlowThreadIfNeeded):

LayoutTests:

* fast/regions/resources/region-style.css:
* fast/regions/svg-doc-fragment-not-collected-expected.html: Added.
* fast/regions/svg-doc-fragment-not-collected.html: Added.
* fast/regions/svg-element-not-collected-expected.html: Added.
* fast/regions/svg-element-not-collected.html: Added.
* fast/regions/svg-root-element-collected-expected.txt: Added.
* fast/regions/svg-root-element-collected.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@104328 268f45cc-cd09-0410-ab3c-d52691b4dbfc