Bug 713413 - Fix crash when dynamically adding foreignObject as a child of non-displayed element. r=dholbert

layout/svg/base/src/nsSVGForeignObjectFrame.cpp

@@ -140,7 +140,12 @@ nsSVGForeignObjectFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 {
   nsSVGForeignObjectFrameBase::DidSetStyleContext(aOldStyleContext);
 
-  UpdateGraphic();
+  // No need to invalidate before first reflow - that will happen elsewhere.
+  // Moreover we haven't been initialised properly yet so we may not have the
+  // right state bits.
+  if (!(GetStateBits() & NS_FRAME_FIRST_REFLOW)) {
+    UpdateGraphic();
+  }
 }
 
 NS_IMETHODIMP

layout/svg/crashtests/713413-1.svg

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<marker id="m"></marker>
+
+<script>
+window.addEventListener("load", function() {
+  document.getElementById("m").appendChild(document.createElementNS("http://www.w3.org/2000/svg", "foreignObject"));
+}, false);
+</script>
+
+</svg>

layout/svg/crashtests/crashtests.list

@@ -121,3 +121,4 @@ load 692203-2.svg
 load 693424-1.svg
 load 709920-1.svg
 load 709920-2.svg
+load 713413-1.svg