Created attachment 430182 [details]
Created attachment 430184 [details]
Same as bug 550047
nsSVGElementBase::UnsetAttr now runs before the data is reparsed and when we get to the nsSVGForeignObject::AttributeChanged we read the old values from the nsSVGForeignObjectElement rather than the new values.
Fixed by check-in for bug 550047