diff --git a/mozilla/content/base/crashtests/410860-1.xml b/mozilla/content/base/crashtests/410860-1.xml
new file mode 100644
index 00000000000..4a7414fc9b6
--- /dev/null
+++ b/mozilla/content/base/crashtests/410860-1.xml
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:xlink="http://www.w3.org/1999/xlink" 
+     onload="document.getElementById('x').getBoundingClientRect();">
+
+<rect id="x"/>
+
+</svg>
+
diff --git a/mozilla/content/base/crashtests/crashtests.list b/mozilla/content/base/crashtests/crashtests.list
index 6b4b463e9d4..9d77abc4196 100644
--- a/mozilla/content/base/crashtests/crashtests.list
+++ b/mozilla/content/base/crashtests/crashtests.list
@@ -21,3 +21,4 @@ load 386000-1.html
 load 386794-1.html
 load 399712-1.html
 load 407818.html
+load 410860-1.xml
diff --git a/mozilla/content/base/src/nsGenericElement.cpp b/mozilla/content/base/src/nsGenericElement.cpp
index 9822268cbac..8b5e2ae8d50 100644
--- a/mozilla/content/base/src/nsGenericElement.cpp
+++ b/mozilla/content/base/src/nsGenericElement.cpp
@@ -782,11 +782,12 @@ nsNSElementTearoff::GetBoundingClientRect(nsIDOMTextRectangle** aResult)
 
   NS_ADDREF(*aResult = rect);
   
-  nsIFrame* frame = mContent->GetPrimaryFrame(Flush_Layout);  
+  nsIFrame* frame = mContent->GetPrimaryFrame(Flush_Layout);
   if (!frame) {
     // display:none, perhaps? Return the empty rect
     return NS_OK;
   }
+  nsPresContext* presContext = frame->PresContext();
   
   nsRect r;
   if (TryGetSVGBoundingRect(frame, &r)) {
@@ -805,7 +806,7 @@ nsNSElementTearoff::GetBoundingClientRect(nsIDOMTextRectangle** aResult)
     r = nsLayoutUtils::GetAllInFlowBoundingRect(frame) +
         GetOffsetFromInitialContainingBlock(frame);
   }
-  SetTextRectangle(r, frame->PresContext(), rect);
+  SetTextRectangle(r, presContext, rect);
   return NS_OK;
 }