Fix crash in which elementData() might be null.

Source/core/dom/Element.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 1069 matching lines @@
     if (newClassString.is8Bit())
         return classStringHasClassName(newClassString.characters8(), length);
     return classStringHasClassName(newClassString.characters16(), length);
 }
 
 void Element::classAttributeChanged(const AtomicString& newClassString)
 {
     StyleResolver* styleResolver = document().styleResolver();
     bool testShouldInvalidateStyle = inActiveDocument() && styleResolver && styleChangeType() < SubtreeStyleChange;
 
-    if (classStringHasClassName(newClassString)) {
-        const bool shouldFoldCase = document().inQuirksMode();
-        const SpaceSplitString oldClasses = elementData()->classNames();
-        elementData()->setClass(newClassString, shouldFoldCase);
-        const SpaceSplitString& newClasses = elementData()->classNames();
-        if (testShouldInvalidateStyle)
-            styleResolver->ensureRuleFeatureSet().scheduleStyleInvalidationForClassChange(oldClasses, newClasses, this);
-    } else {
-        const SpaceSplitString& oldClasses = elementData()->classNames();
-        if (testShouldInvalidateStyle)
-            styleResolver->ensureRuleFeatureSet().scheduleStyleInvalidationForClassChange(oldClasses, this);
-        elementData()->clearClass();
+    if (elementData()) {

[adamk, 2014/02/21 03:33:50]

This is crazy. No element should have classAttributeChanged on it if it doesn't
have any attributes (which is happening in this case since <svg> is for some
reason I do not understand having classAttributeChanged called on it).

Sorry, but I think I'm going to punt again to pdr for SVG expertise, since the
SVG stuff just seems wrong. classAttributeChanged should be able to have an
ASSERT(elementData()) at the top.

+        if (classStringHasClassName(newClassString)) {
+            const bool shouldFoldCase = document().inQuirksMode();
+            const SpaceSplitString oldClasses = elementData()->classNames();
+            elementData()->setClass(newClassString, shouldFoldCase);
+            const SpaceSplitString& newClasses = elementData()->classNames();
+            if (testShouldInvalidateStyle)
+                styleResolver->ensureRuleFeatureSet().scheduleStyleInvalidationForClassChange(oldClasses, newClasses, this);
+        } else {
+            const SpaceSplitString& oldClasses = elementData()->classNames();
+            if (testShouldInvalidateStyle)
+                styleResolver->ensureRuleFeatureSet().scheduleStyleInvalidationForClassChange(oldClasses, this);
+            elementData()->clearClass();
+        }
     }
 
     if (hasRareData())
         elementRareData()->clearClassListValueForQuirksMode();
 }
 
 bool Element::shouldInvalidateDistributionWhenAttributeChanged(ElementShadow* elementShadow, const QualifiedName& name, const AtomicString& newValue)
 {
     ASSERT(elementShadow);
     const SelectRuleFeatureSet& featureSet = elementShadow->ensureSelectFeatureSet();
@@ skipping 2392 matching lines @@
     // Before doing so, we need to resolve issues in HTMLSelectElement::recalcListItems
     // and RenderMenuList::setText. See also https://bugs.webkit.org/show_bug.cgi?id=88405
     if (hasTagName(optionTag) || hasTagName(optgroupTag))
         return false;
     if (FullscreenElementStack::isActiveFullScreenElement(this))
         return false;
     return true;
 }
 
 } // namespace WebCore