diff --git a/mozilla/layout/svg/base/src/nsSVGGlyphFrame.cpp b/mozilla/layout/svg/base/src/nsSVGGlyphFrame.cpp
index 136460c2e9c..309077cb0b1 100644
--- a/mozilla/layout/svg/base/src/nsSVGGlyphFrame.cpp
+++ b/mozilla/layout/svg/base/src/nsSVGGlyphFrame.cpp
@@ -659,18 +659,34 @@ nsSVGGlyphFrame::GetStrokeDashArray(float **arr, PRUint32 *count)
 {
   const nsStyleCoord *dasharray = GetStyleSVG()->mStrokeDasharray;
   nsPresContext *presContext = nsSVGGlyphFrameBase::GetPresContext();
+  float totalLength = 0.0f;
 
   *count = GetStyleSVG()->mStrokeDasharrayLength;
+  *arr = nsnull;
 
   if (*count) {
     *arr = (float *) nsMemory::Alloc(*count * sizeof(float));
     if (*arr) {
-      for (PRUint32 i = 0; i < *count; i++)
+      for (PRUint32 i = 0; i < *count; i++) {
         (*arr)[i] = nsSVGUtils::CoordToFloat(presContext, mContent, dasharray[i]);
+        if ((*arr)[i] < 0.0f) {
+          nsMemory::Free(*arr);
+          *count = 0;
+          *arr = nsnull;
+          return NS_OK;
+        }
+        totalLength += (*arr)[i];
+      }
     } else {
       *count = 0;
+      *arr = nsnull;
       return NS_ERROR_OUT_OF_MEMORY;
     }
+
+    if (totalLength == 0.0f) {
+      nsMemory::Free(*arr);
+      *count = 0;
+    }
   }
 
   return NS_OK;
diff --git a/mozilla/layout/svg/base/src/nsSVGPathGeometryFrame.cpp b/mozilla/layout/svg/base/src/nsSVGPathGeometryFrame.cpp
index 4e2d71e59b8..6d988b9f6c9 100644
--- a/mozilla/layout/svg/base/src/nsSVGPathGeometryFrame.cpp
+++ b/mozilla/layout/svg/base/src/nsSVGPathGeometryFrame.cpp
@@ -547,18 +547,34 @@ nsSVGPathGeometryFrame::GetStrokeDashArray(float **arr, PRUint32 *count)
 {
   const nsStyleCoord *dasharray = GetStyleSVG()->mStrokeDasharray;
   nsPresContext *presContext = nsSVGPathGeometryFrameBase::GetPresContext();
+  float totalLength = 0.0f;
 
   *count = GetStyleSVG()->mStrokeDasharrayLength;
+  *arr = nsnull;
 
   if (*count) {
     *arr = (float *) nsMemory::Alloc(*count * sizeof(float));
     if (*arr) {
-      for (PRUint32 i = 0; i < *count; i++)
+      for (PRUint32 i = 0; i < *count; i++) {
         (*arr)[i] = nsSVGUtils::CoordToFloat(presContext, mContent, dasharray[i]);
+        if ((*arr)[i] < 0.0f) {
+          nsMemory::Free(*arr);
+          *count = 0;
+          *arr = nsnull;
+          return NS_OK;
+        }
+        totalLength += (*arr)[i];
+      }
     } else {
       *count = 0;
+      *arr = nsnull;
       return NS_ERROR_OUT_OF_MEMORY;
     }
+
+    if (totalLength == 0.0f) {
+      nsMemory::Free(*arr);
+      *count = 0;
+    }
   }
 
   return NS_OK;