From a3ae42ea566327b4a7b0972968ce32902fb62339 Mon Sep 17 00:00:00 2001
From: Cameron McCormack <cam@mcc.id.au>
Date: Sat, 16 Feb 2013 20:16:11 +1100
Subject: [PATCH] Bug 841812 - Avoid crashing when changing attributes on an
 invalidly parented <textPath>. r=roc

---
 layout/svg/crashtests/841812-1.svg    | 11 +++++++++++
 layout/svg/crashtests/crashtests.list |  1 +
 layout/svg/nsSVGTextFrame2.cpp        |  6 ++++--
 3 files changed, 16 insertions(+), 2 deletions(-)
 create mode 100644 layout/svg/crashtests/841812-1.svg

diff --git a/layout/svg/crashtests/841812-1.svg b/layout/svg/crashtests/841812-1.svg
new file mode 100644
index 000000000000..e5bcaa66ee79
--- /dev/null
+++ b/layout/svg/crashtests/841812-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <text>
+        <circle>
+            <textPath id="t" xlink:href="data:text/html,1" />
+        </circle>
+    </text>
+
+    <script>
+        window.addEventListener("load", function() { document.getElementById("t").removeAttribute('xlink:href'); }, false);
+    </script>
+</svg>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
index 2ba9f4a051b9..33337863ed1a 100644
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -152,3 +152,4 @@ load 789390-1.html
 load 808318-1.svg
 load 813420-1.svg
 load 841163-1.svg
+load 841812-1.svg
diff --git a/layout/svg/nsSVGTextFrame2.cpp b/layout/svg/nsSVGTextFrame2.cpp
index 798fba243090..8f6a40168ddf 100644
--- a/layout/svg/nsSVGTextFrame2.cpp
+++ b/layout/svg/nsSVGTextFrame2.cpp
@@ -2956,8 +2956,10 @@ nsSVGTextFrame2::MutationObserver::AttributeChanged(
                aAttribute == nsGkAtoms::href) {
       // Blow away our reference, if any
       nsIFrame* childElementFrame = aElement->GetPrimaryFrame();
-      childElementFrame->Properties().Delete(nsSVGEffects::HrefProperty());
-      mFrame->NotifyGlyphMetricsChange();
+      if (childElementFrame) {
+        childElementFrame->Properties().Delete(nsSVGEffects::HrefProperty());
+        mFrame->NotifyGlyphMetricsChange();
+      }
     }
   } else {
     if (aNameSpaceID == kNameSpaceID_None &&