new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/842630-1.svg
@@ -0,0 +1,1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><text dy="20 20">A<tspan style="display: none;">B</tspan></text></svg>

--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -149,13 +149,14 @@ load 788831-1.svg
 load 790072.svg
 load 791826-1.svg
 load 789390-1.html
 load 808318-1.svg
 load 813420-1.svg
 load 841163-1.svg
 load 841812-1.svg
 load 842009-1.svg
+load 842630-1.svg
 load 842909-1.svg
 load 843072-1.svg
 load 847139-1.svg
 load 849688-1.svg
 load 849688-2.svg

--- a/layout/svg/nsSVGTextFrame2.cpp
+++ b/layout/svg/nsSVGTextFrame2.cpp
@@ -4074,27 +4074,27 @@ nsSVGTextFrame2::ResolvePositions(nsTArr
 
   // We assume the first character position is (0,0) unless we later see
   // otherwise, and note it as unaddressable if it is.
   bool firstCharUnaddressable = it.IsOriginalCharUnaddressable();
   mPositions.AppendElement(CharPosition::Unspecified(firstCharUnaddressable));
 
   // Fill in unspecified positions for all remaining characters, noting
   // them as unaddressable if they are.
-  uint32_t index = it.TextElementCharIndex();
-  for (uint32_t i = 0; i < index; i++) {
-    mPositions.AppendElement(CharPosition::Unspecified(false));
-  }
+  uint32_t index = 0;
   while (it.Next()) {
     while (++index < it.TextElementCharIndex()) {
       mPositions.AppendElement(CharPosition::Unspecified(false));
     }
     mPositions.AppendElement(CharPosition::Unspecified(
                                              it.IsOriginalCharUnaddressable()));
   }
+  while (++index < it.TextElementCharIndex()) {
+    mPositions.AppendElement(CharPosition::Unspecified(false));
+  }
 
   // Recurse over the content and fill in character positions as we go.
   bool forceStartOfChunk = false;
   return ResolvePositions(mContent, 0, false, forceStartOfChunk, aDeltas) != 0;
 }
 
 void
 nsSVGTextFrame2::DetermineCharPositions(nsTArray<nsPoint>& aPositions)