Clear SVGPathSeg role on removal.
https://bugs.webkit.org/show_bug.cgi?id=110058

Reviewed by Dirk Schulze.

Source/WebCore:

SVGPathSegListPropertyTearOff::initialize() and SVGPathSegListPropertyTearOff::replaceItem()
need to clear the context and role for segments being expunged from the list, similarly to
removeItem(). Otherwise, processIncomingListItemValue() can get confused and attempt to
remove stale segments.

Test: svg/dom/SVGPathSegList-crash.html

* svg/properties/SVGPathSegListPropertyTearOff.cpp:
(WebCore::SVGPathSegListPropertyTearOff::clearContextAndRoles):
(WebCore::SVGPathSegListPropertyTearOff::clear):
(WebCore::SVGPathSegListPropertyTearOff::replaceItem):
(WebCore):
* svg/properties/SVGPathSegListPropertyTearOff.h:
(WebCore::SVGPathSegListPropertyTearOff::initialize):
(SVGPathSegListPropertyTearOff):

LayoutTests:

* svg/dom/SVGPathSegList-crash-expected.txt: Added.
* svg/dom/SVGPathSegList-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143454 268f45cc-cd09-0410-ab3c-d52691b4dbfc