--- a/dom/svg/nsSVGViewBox.h
+++ b/dom/svg/nsSVGViewBox.h
@@ -42,34 +42,39 @@ struct nsSVGViewBoxRect
 class nsSVGViewBox
 {
 public:
 
   void Init();
 
   /**
    * Returns true if the corresponding "viewBox" attribute defined a rectangle
-   * with finite values. Returns false if the viewBox was set to an invalid
+   * with finite values and nonnegative width/height.
+   * Returns false if the viewBox was set to an invalid
    * string, or if any of the four rect values were too big to store in a
-   * float.
-   *
-   * This method does not check whether the width or height values are
-   * positive, so callers must check whether the viewBox rect is valid where
-   * necessary!
+   * float, or the width/height are negative.
    */
   bool HasRect() const
-    { return (mAnimVal && !mAnimVal->none) ||
-             (!mAnimVal && mHasBaseVal && !mBaseVal.none); }
+    {
+      const nsSVGViewBoxRect& rect = GetAnimValue();
+      return !rect.none && rect.width >= 0 && rect.height >= 0;
+    }
 
   /**
    * Returns true if the corresponding "viewBox" attribute either defined a
    * rectangle with finite values or the special "none" value.
    */
   bool IsExplicitlySet() const
-    { return mAnimVal || mHasBaseVal; }
+    {
+      if (mAnimVal || mHasBaseVal) {
+        const nsSVGViewBoxRect& rect = GetAnimValue();
+        return rect.none || (rect.width >= 0 && rect.height >= 0);
+      }
+      return false;
+    }
 
   const nsSVGViewBoxRect& GetBaseValue() const
     { return mBaseVal; }
   void SetBaseValue(const nsSVGViewBoxRect& aRect,
                     nsSVGElement *aSVGElement);
   const nsSVGViewBoxRect& GetAnimValue() const
     { return mAnimVal ? *mAnimVal : mBaseVal; }
   void SetAnimValue(const nsSVGViewBoxRect& aRect,

--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -388,16 +388,17 @@ random-if(/^Windows\x20NT\x205\.1/.test(
 == tspan-xy-anchor-middle-01.svg tspan-xy-anchor-middle-ref.svg # bug 773482
 == tspan-xy-anchor-end-01.svg tspan-xy-anchor-end-ref.svg # bug 773482
 == userSpaceOnUse-and-pattern-01.svg userSpaceOnUse-and-pattern-01-ref.svg
 == viewBox-and-pattern-01.svg pass.svg
 == viewBox-and-pattern-02.svg pass.svg
 == viewBox-and-pattern-03.svg pass.svg
 == viewBox-and-pattern-04.svg pass.svg
 == viewBox-invalid-01.svg pass.svg
+== viewBox-invalid-02.svg pass.svg
 == viewBox-valid-01.svg pass.svg
 == viewBox-valid-02.xhtml pass.svg
 == viewport-percent-graphic-user-01.svg pass.svg
 == winding-01.svg pass.svg
 
 == svg-effects-area-unzoomed.xhtml svg-effects-area-unzoomed-ref.xhtml
 == svg-effects-area-zoomed-in.xhtml svg-effects-area-zoomed-in-ref.xhtml
 == svg-effects-area-zoomed-out.xhtml svg-effects-area-zoomed-out-ref.xhtml

new file mode 100644
--- /dev/null
+++ b/layout/reftests/svg/viewBox-invalid-02.svg
@@ -0,0 +1,38 @@
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+  <title>Testing invalid values for |viewBox| attributes</title>
+  <defs>
+    <rect id="redRect"  fill="red"  height="10" width="10"/>
+    <rect id="limeRect" fill="lime" height="10" width="10"/>
+  </defs>
+  <rect fill="lime" height="100%" width="100%"/>
+
+  <g transform="translate(0, 0)">
+    <use xlink:href="#redRect"/>
+    <!-- negative width/height in viewBox should ignore entire attribute -->
+    <svg width="20" height="20" viewBox="0,0,0,-1">
+      <use xlink:href="#limeRect"/>
+    </svg>
+  </g>
+  <g transform="translate(20, 0)">
+    <use xlink:href="#redRect"/>
+    <!-- negative width/height in viewBox should ignore entire attribute -->
+    <svg width="20" height="20" viewBox="0,0,-1,0">
+      <use xlink:href="#limeRect"/>
+    </svg>
+  </g>
+  <g transform="translate(40, 0)">
+    <use xlink:href="#limeRect"/>
+    <!-- zero width/height in viewBox should render nothing -->
+    <svg width="20" height="20" viewBox="0,0,0,20">
+      <use xlink:href="#redRect"/>
+    </svg>
+  </g>
+  <g transform="translate(60, 0)">
+    <use xlink:href="#limeRect"/>
+    <!-- zero width/height in viewBox should render nothing -->
+    <svg width="20" height="20" viewBox="0,0,20,0">
+      <use xlink:href="#redRect"/>
+    </svg>
+  </g>
+</svg>