diff --git a/layout/svg/crashtests/885608-1.svg b/layout/svg/crashtests/885608-1.svg
new file mode 100644
index 000000000000..0c967775081c
--- /dev/null
+++ b/layout/svg/crashtests/885608-1.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<mask id="m"><text id="t">z</text></mask>
+
+<rect width="600" height="400" mask="url(#m)"/>
+
+<script>
+window.addEventListener("load", function() {
+  document.getElementById("t").firstChild.data = "ab";
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
index d59c11052f20..e393d199c289 100644
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -168,3 +168,4 @@ load 876831-1.svg
 load 877029-1.svg
 load 880925-1.svg
 load 881031-1.svg
+load 885608-1.svg
diff --git a/layout/svg/nsSVGTextFrame2.cpp b/layout/svg/nsSVGTextFrame2.cpp
index f6597912594f..9a27ee2fb626 100644
--- a/layout/svg/nsSVGTextFrame2.cpp
+++ b/layout/svg/nsSVGTextFrame2.cpp
@@ -3135,6 +3135,15 @@ nsSVGTextFrame2::MutationObserver::ContentRemoved(
   mFrame->NotifyGlyphMetricsChange();
 }
 
+void
+nsSVGTextFrame2::MutationObserver::CharacterDataChanged(
+                                                 nsIDocument* aDocument,
+                                                 nsIContent* aContent,
+                                                 CharacterDataChangeInfo* aInfo)
+{
+  mFrame->NotifyGlyphMetricsChange();
+}
+
 void
 nsSVGTextFrame2::MutationObserver::AttributeChanged(
                                                 nsIDocument* aDocument,
@@ -3246,7 +3255,7 @@ nsSVGTextFrame2::NotifySVGChanged(uint32_t aFlags)
     // invalidate them. We also don't need to invalidate ourself, since our
     // changed ancestor will have invalidated its entire area, which includes
     // our area.
-    nsSVGUtils::ScheduleReflowSVG(this);
+    ScheduleReflowSVG();
   }
 
   if (needGlyphMetricsUpdate) {
@@ -4767,12 +4776,22 @@ nsSVGTextFrame2::ShouldRenderAsPath(nsRenderingContext* aContext,
   return false;
 }
 
+void
+nsSVGTextFrame2::ScheduleReflowSVG()
+{
+  if (mState & NS_STATE_SVG_NONDISPLAY_CHILD) {
+    ScheduleReflowSVGNonDisplayText();
+  } else {
+    nsSVGUtils::ScheduleReflowSVG(this);
+  }
+}
+
 void
 nsSVGTextFrame2::NotifyGlyphMetricsChange()
 {
   mPositioningDirty = true;
   nsSVGEffects::InvalidateRenderingObservers(this);
-  nsSVGUtils::ScheduleReflowSVG(this);
+  ScheduleReflowSVG();
 }
 
 void
diff --git a/layout/svg/nsSVGTextFrame2.h b/layout/svg/nsSVGTextFrame2.h
index dcb6417be83f..c8fd35661d30 100644
--- a/layout/svg/nsSVGTextFrame2.h
+++ b/layout/svg/nsSVGTextFrame2.h
@@ -279,6 +279,12 @@ public:
    */
   void NotifyGlyphMetricsChange();
 
+  /**
+   * Calls ScheduleReflowSVGNonDisplayText if this is a non-display frame,
+   * and nsSVGUtils::ScheduleReflowSVG otherwise.
+   */
+  void ScheduleReflowSVG();
+
   /**
    * Reflows the anonymous block frame of this non-display nsSVGTextFrame2.
    *
@@ -396,6 +402,7 @@ private:
     NS_DECL_NSIMUTATIONOBSERVER_CONTENTAPPENDED
     NS_DECL_NSIMUTATIONOBSERVER_CONTENTINSERTED
     NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
+    NS_DECL_NSIMUTATIONOBSERVER_CHARACTERDATACHANGED
     NS_DECL_NSIMUTATIONOBSERVER_ATTRIBUTECHANGED
 
   private: