diff --git a/layout/svg/base/src/nsISVGGlyphFragmentLeaf.h b/layout/svg/base/src/nsISVGGlyphFragmentLeaf.h
index cfdbd2a7aa72..a1024841d567 100644
--- a/layout/svg/base/src/nsISVGGlyphFragmentLeaf.h
+++ b/layout/svg/base/src/nsISVGGlyphFragmentLeaf.h
@@ -87,6 +87,7 @@ public:
                                        nsTArray<float> &aRotate)=0;
   NS_IMETHOD_(PRUint16) GetTextAnchor()=0;
   NS_IMETHOD_(PRBool) IsAbsolutelyPositioned()=0;
+  NS_IMETHOD_(PRBool) IsEmpty() const=0;
   NS_IMETHOD_(void) SetTrimLeadingWhitespace(PRBool aTrimLeadingWhitespace)=0;
   NS_IMETHOD_(void) SetTrimTrailingWhitespace(PRBool aTrimTrailingWhitespace)=0;
   NS_IMETHOD_(PRBool) EndsWithWhitespace() const=0;
diff --git a/layout/svg/base/src/nsSVGGlyphFrame.cpp b/layout/svg/base/src/nsSVGGlyphFrame.cpp
index e816d46ed2fd..efa87789d517 100644
--- a/layout/svg/base/src/nsSVGGlyphFrame.cpp
+++ b/layout/svg/base/src/nsSVGGlyphFrame.cpp
@@ -692,7 +692,7 @@ nsSVGGlyphFrame::GetCharacterPositions(nsTArray<CharacterPosition>* aCharacterPo
                                        float aMetricsScale)
 {
   PRUint32 strLength = mTextRun->GetLength();
-  NS_ASSERTION(strLength > 0, "no text");
+  NS_ABORT_IF_FALSE(strLength > 0, "no text");
 
   const gfxFloat radPerDeg = M_PI / 180.0;
 
@@ -1419,7 +1419,11 @@ nsSVGGlyphFrame::GetCharNumAtPosition(nsIDOMSVGPoint *point)
 NS_IMETHODIMP_(nsISVGGlyphFragmentLeaf *)
 nsSVGGlyphFrame::GetFirstGlyphFragment()
 {
-  return this;
+  nsISVGGlyphFragmentLeaf *leaf = this;
+  while (leaf && leaf->IsEmpty()) {
+    leaf = leaf->GetNextGlyphFragment();
+  }
+  return leaf;
 }
 
 NS_IMETHODIMP_(nsISVGGlyphFragmentLeaf *)
@@ -1444,6 +1448,8 @@ NS_IMETHODIMP_(PRBool)
 nsSVGGlyphFrame::EndsWithWhitespace() const
 {
   const nsTextFragment* text = mContent->GetText();
+  NS_ABORT_IF_FALSE(text->GetLength() > 0, "text expected");
+
   return NS_IsAsciiWhitespace(text->CharAt(text->GetLength() - 1));
 }
 
diff --git a/layout/svg/base/src/nsSVGGlyphFrame.h b/layout/svg/base/src/nsSVGGlyphFrame.h
index 075cf9ff5766..7b3fee53c76e 100644
--- a/layout/svg/base/src/nsSVGGlyphFrame.h
+++ b/layout/svg/base/src/nsSVGGlyphFrame.h
@@ -162,6 +162,9 @@ public:
                                        nsTArray<float> &aRotate);
   NS_IMETHOD_(PRUint16) GetTextAnchor();
   NS_IMETHOD_(PRBool) IsAbsolutelyPositioned();
+  NS_IMETHOD_(PRBool) IsEmpty() const {
+    return mContent->GetText()->GetLength() == 0;
+  }
   NS_IMETHOD_(void) SetTrimLeadingWhitespace(PRBool aTrimLeadingWhitespace) {
     mTrimLeadingWhitespace = aTrimLeadingWhitespace;
   }
diff --git a/layout/svg/crashtests/655025-1.svg b/layout/svg/crashtests/655025-1.svg
new file mode 100644
index 000000000000..4501bb57fa36
--- /dev/null
+++ b/layout/svg/crashtests/655025-1.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text id="a">a</text>
+  <script>
+    document.getElementById("a").firstChild.nodeValue = "";
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/655025-2.svg b/layout/svg/crashtests/655025-2.svg
new file mode 100644
index 000000000000..601006e83156
--- /dev/null
+++ b/layout/svg/crashtests/655025-2.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text id="a">a</text>
+  <script>
+    document.getElementById("a").appendChild(document.createTextNode(""));
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/655025-3.svg b/layout/svg/crashtests/655025-3.svg
new file mode 100644
index 000000000000..43e06b6fc396
--- /dev/null
+++ b/layout/svg/crashtests/655025-3.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <script>
+    var a = document.createElementNS("http://www.w3.org/2000/svg", "text");
+    a.appendChild(document.createTextNode(""));
+    document.documentElement.appendChild(a);
+    a.getNumberOfChars();
+    document.documentElement.removeChild(a);
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
index 91b71096d098..5be88d486739 100644
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -106,3 +106,6 @@ load 614367-1.svg
 load 620034-1.html
 load 621598-1.svg
 load 648819-1.html
+load 655025-1.svg
+load 655025-2.svg
+load 655025-3.svg