Fix crash in which elementData() might be null.

Source/core/dom/Element.cpp

Index: Source/core/dom/Element.cpp
diff --git a/Source/core/dom/Element.cpp b/Source/core/dom/Element.cpp
index 18d1114960311ee8d36d1d9f9980865c25693a32..dc0f28ff831fc3b992b1f6571bc71af4b2fc6b0b 100644
--- a/Source/core/dom/Element.cpp
+++ b/Source/core/dom/Element.cpp
@@ -1087,18 +1087,20 @@ void Element::classAttributeChanged(const AtomicString& newClassString)
     StyleResolver* styleResolver = document().styleResolver();
     bool testShouldInvalidateStyle = inActiveDocument() && styleResolver && styleChangeType() < SubtreeStyleChange;
 
-    if (classStringHasClassName(newClassString)) {
-        const bool shouldFoldCase = document().inQuirksMode();
-        const SpaceSplitString oldClasses = elementData()->classNames();
-        elementData()->setClass(newClassString, shouldFoldCase);
-        const SpaceSplitString& newClasses = elementData()->classNames();
-        if (testShouldInvalidateStyle)
-            styleResolver->ensureRuleFeatureSet().scheduleStyleInvalidationForClassChange(oldClasses, newClasses, this);
-    } else {
-        const SpaceSplitString& oldClasses = elementData()->classNames();
-        if (testShouldInvalidateStyle)
-            styleResolver->ensureRuleFeatureSet().scheduleStyleInvalidationForClassChange(oldClasses, this);
-        elementData()->clearClass();
+    if (elementData()) {

[adamk, 2014/02/21 03:33:50]

This is crazy. No element should have classAttributeChanged on it if it doesn't
have any attributes (which is happening in this case since <svg> is for some
reason I do not understand having classAttributeChanged called on it).

Sorry, but I think I'm going to punt again to pdr for SVG expertise, since the
SVG stuff just seems wrong. classAttributeChanged should be able to have an
ASSERT(elementData()) at the top.

+        if (classStringHasClassName(newClassString)) {
+            const bool shouldFoldCase = document().inQuirksMode();
+            const SpaceSplitString oldClasses = elementData()->classNames();
+            elementData()->setClass(newClassString, shouldFoldCase);
+            const SpaceSplitString& newClasses = elementData()->classNames();
+            if (testShouldInvalidateStyle)
+                styleResolver->ensureRuleFeatureSet().scheduleStyleInvalidationForClassChange(oldClasses, newClasses, this);
+        } else {
+            const SpaceSplitString& oldClasses = elementData()->classNames();
+            if (testShouldInvalidateStyle)
+                styleResolver->ensureRuleFeatureSet().scheduleStyleInvalidationForClassChange(oldClasses, this);
+            elementData()->clearClass();
+        }
     }
 
     if (hasRareData())