Merge 120559

Source/WebCore/svg/SVGDocumentExtensions.cpp

Index: Source/WebCore/svg/SVGDocumentExtensions.cpp
===================================================================
--- Source/WebCore/svg/SVGDocumentExtensions.cpp	(revision 120761)
+++ Source/WebCore/svg/SVGDocumentExtensions.cpp	(working copy)
@@ -410,12 +410,17 @@
     for (HashSet<SVGElement*>::iterator setIt = referencingElements->begin(); setIt != setEnd; ++setIt)
         toBeNotified.append(*setIt);
 
-    m_elementDependencies.remove(it);
-
     // Force rebuilding the referencingElement so it knows about this change.
     Vector<SVGElement*>::iterator vectorEnd = toBeNotified.end();
-    for (Vector<SVGElement*>::iterator vectorIt = toBeNotified.begin(); vectorIt != vectorEnd; ++vectorIt)
-        (*vectorIt)->svgAttributeChanged(XLinkNames::hrefAttr);
+    for (Vector<SVGElement*>::iterator vectorIt = toBeNotified.begin(); vectorIt != vectorEnd; ++vectorIt) {
+        // Before rebuilding referencingElement ensure it was not removed from under us.
+        if (HashSet<SVGElement*>* referencingElements = setOfElementsReferencingTarget(referencedElement)) {
+            if (referencingElements->contains(*vectorIt))
+                (*vectorIt)->svgAttributeChanged(XLinkNames::hrefAttr);
+        }
+    }
+
+    m_elementDependencies.remove(referencedElement);
 }
 
 #if ENABLE(SVG_FONTS)