See bug 418206 comment 7.
The problem that bug 418206 fixed was that an invalid viewBox on the root <svg> had an affect on the SVGRect returned by document.documentElement.getBBox(). It make the SVGRect huge, and the testcases were doing |for (var i=0; i<bbox.width; ++i)| (and the same for height) which was resulting in a massive number of iterations. Basically what we need here is a test to check that the SVGRect returned by getBBox() isn't affected by a broken viewBox.
I'll push a test in a bit.