Merge 96707 - Crash in SVGTRefElement::updateReferencedText.

Source/WebCore/svg/SVGTextPathElement.cpp

 /*
  * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2010 Rob Buis <rwlbuis@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 127 matching lines @@
     return false;
 }
 
 void SVGTextPathElement::insertedIntoDocument()
 {
     SVGTextContentElement::insertedIntoDocument();
 
     String id;
     Element* targetElement = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
     if (!targetElement) {
+        if (hasPendingResources() || id.isEmpty())
+            return;
+
+        ASSERT(!hasPendingResources());
         document()->accessSVGExtensions()->addPendingResource(id, this);
+        ASSERT(hasPendingResources());
         return;
     }
 }
 
 bool SVGTextPathElement::selfHasRelativeLengths() const
 {
     return startOffset().isRelative()
         || SVGTextContentElement::selfHasRelativeLengths();
 }
 
 }
 
 #endif // ENABLE(SVG)