Bug 601406 - GetBBox crashes when called on an SVG a element r=jwatt a=blocking-final

content/svg/content/src/crashtests/601406-1.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+<![CDATA[
+function boom() { document.getElementById("a").getBBox(); }
+window.addEventListener("load", boom, false);
+]]>
+</script>
+
+<a id="a"/>
+
+</svg>
+

content/svg/content/src/crashtests/crashtests.list

@@ -51,3 +51,4 @@ load 573316-1.svg
 load 579356-1.svg
 load 579356-2.svg
 load 595608-1.svg
+load 601406-1.svg

layout/svg/base/src/nsSVGUtils.cpp

@@ -1324,7 +1324,8 @@ nsSVGUtils::GetBBox(nsIFrame *aFrame)
     // filter to text. When one of these facilities is applied to text
     // the bounding box is the entire ‘text’ element in all
     // cases.
-    nsSVGTextContainerFrame* metrics = do_QueryFrame(aFrame);
+    nsSVGTextContainerFrame* metrics = do_QueryFrame(
+      GetFirstNonAAncestorFrame(aFrame));
     if (metrics) {
       while (aFrame->GetType() != nsGkAtoms::svgTextFrame) {
         aFrame = aFrame->GetParent();