The patch for bug 668163 mapped <svg> 'width' and 'height' into style. This uncovered an existing bug which causes the pre-existing test layout/svg/crashtests/386566-1.svg to fail an assertion. To enable the patch for bug 668163 to land the test was marked as asserting, but we should really resolve the underlying problem.
Boris uncovered the root cause and had the following to say in bug 668163 comment 69: So what seems to happen is the following: 1) Any style computation on any SVG element always triggers an animation restyle on that element (see nsSVGElement::WalkContentStyleRules). 2) Having a pending XBL binding causes us to not create child frames for an element. So we end up with pending animation restyles for the rect and the <svg> that we post while restyling it. Then we process animation restyles starting at the animation restyle root (the <svg>). This has no child frames because of the XBL thing, so we don't process the animation restyle for the rect. It's not clear to me why we have that animation restyle request to start with... but we could probably handle the XBL case a bit better.
Note that we may want two separate bugs here: #2 above is what causes the assert, but #1 is a performance problem imo.