Merge 120559

Source/WebCore/svg/SVGDocumentExtensions.cpp

 /*
  * Copyright (C) 2006 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2007 Rob Buis <buis@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 392 matching lines @@
     if (it == m_elementDependencies.end())
         return;
     ASSERT(it->first == referencedElement);
     Vector<SVGElement*> toBeNotified;
 
     HashSet<SVGElement*>* referencingElements = it->second.get();
     HashSet<SVGElement*>::iterator setEnd = referencingElements->end();
     for (HashSet<SVGElement*>::iterator setIt = referencingElements->begin(); setIt != setEnd; ++setIt)
         toBeNotified.append(*setIt);
 
-    m_elementDependencies.remove(it);
-
     // Force rebuilding the referencingElement so it knows about this change.
     Vector<SVGElement*>::iterator vectorEnd = toBeNotified.end();
-    for (Vector<SVGElement*>::iterator vectorIt = toBeNotified.begin(); vectorIt != vectorEnd; ++vectorIt)
-        (*vectorIt)->svgAttributeChanged(XLinkNames::hrefAttr);
+    for (Vector<SVGElement*>::iterator vectorIt = toBeNotified.begin(); vectorIt != vectorEnd; ++vectorIt) {
+        // Before rebuilding referencingElement ensure it was not removed from under us.
+        if (HashSet<SVGElement*>* referencingElements = setOfElementsReferencingTarget(referencedElement)) {
+            if (referencingElements->contains(*vectorIt))
+                (*vectorIt)->svgAttributeChanged(XLinkNames::hrefAttr);
+        }
+    }
+
+    m_elementDependencies.remove(referencedElement);
 }
 
 #if ENABLE(SVG_FONTS)
 void SVGDocumentExtensions::registerSVGFontFaceElement(SVGFontFaceElement* element)
 {
     m_svgFontFaceElements.add(element);
 }
 
 void SVGDocumentExtensions::unregisterSVGFontFaceElement(SVGFontFaceElement* element)
 {
     ASSERT(m_svgFontFaceElements.contains(element));
     m_svgFontFaceElements.remove(element);
 }
 #endif
 
 }
 
 #endif