diff --git a/layout/svg/crashtests/841812-1.svg b/layout/svg/crashtests/841812-1.svg
new file mode 100644
index 00000000000..e5bcaa66ee7
--- /dev/null
+++ b/layout/svg/crashtests/841812-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <text>
+        <circle>
+            <textPath id="t" xlink:href="data:text/html,1" />
+        </circle>
+    </text>
+
+    <script>
+        window.addEventListener("load", function() { document.getElementById("t").removeAttribute('xlink:href'); }, false);
+    </script>
+</svg>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
index 2ba9f4a051b..33337863ed1 100644
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -152,3 +152,4 @@ load 789390-1.html
 load 808318-1.svg
 load 813420-1.svg
 load 841163-1.svg
+load 841812-1.svg
diff --git a/layout/svg/nsSVGTextFrame2.cpp b/layout/svg/nsSVGTextFrame2.cpp
index 798fba24309..8f6a40168dd 100644
--- a/layout/svg/nsSVGTextFrame2.cpp
+++ b/layout/svg/nsSVGTextFrame2.cpp
@@ -2956,8 +2956,10 @@ nsSVGTextFrame2::MutationObserver::AttributeChanged(
                aAttribute == nsGkAtoms::href) {
       // Blow away our reference, if any
       nsIFrame* childElementFrame = aElement->GetPrimaryFrame();
-      childElementFrame->Properties().Delete(nsSVGEffects::HrefProperty());
-      mFrame->NotifyGlyphMetricsChange();
+      if (childElementFrame) {
+        childElementFrame->Properties().Delete(nsSVGEffects::HrefProperty());
+        mFrame->NotifyGlyphMetricsChange();
+      }
     }
   } else {
     if (aNameSpaceID == kNameSpaceID_None &&