--- a/src/third_party/WebKit/WebCore/css/CSSCursorImageValue.cpp
+++ b/src/third_party/WebKit/WebCore/css/CSSCursorImageValue.cpp
@@ -70,7 +70,7 @@ CSSCursorImageValue::~CSSCursorImageValu
 
     for (; it != end; ++it) {
         SVGElement* referencedElement = *it;
-        referencedElement->setCursorImageValue(0);
+        referencedElement->cursorElementRemoved();
         if (SVGCursorElement* cursorElement = resourceReferencedByCursorElement(url, referencedElement->document()))
             cursorElement->removeClient(referencedElement);
     }
--- a/src/third_party/WebKit/WebCore/svg/SVGCursorElement.cpp
+++ b/src/third_party/WebKit/WebCore/svg/SVGCursorElement.cpp
@@ -44,7 +44,7 @@ SVGCursorElement::~SVGCursorElement()
 {
     HashSet<SVGElement*>::iterator end = m_clients.end();
     for (HashSet<SVGElement*>::iterator it = m_clients.begin(); it != end; ++it)
-        (*it)->setCursorElement(0);
+        (*it)->cursorElementRemoved();
 }
 
 void SVGCursorElement::parseMappedAttribute(Attribute* attr)
@@ -74,7 +74,12 @@ void SVGCursorElement::addClient(SVGElem
 void SVGCursorElement::removeClient(SVGElement* element)
 {
     m_clients.remove(element);
-    element->setCursorElement(0);
+    element->cursorElementRemoved();
+}
+
+void SVGCursorElement::removeReferencedElement(SVGElement* element)
+{
+    m_clients.remove(element);
 }
 
 void SVGCursorElement::svgAttributeChanged(const QualifiedName& attrName)
--- a/src/third_party/WebKit/WebCore/svg/SVGCursorElement.h
+++ b/src/third_party/WebKit/WebCore/svg/SVGCursorElement.h
@@ -43,6 +43,7 @@ namespace WebCore {
 
         virtual bool isValid() const { return SVGTests::isValid(); }
 
+    void removeReferencedElement(SVGElement*);
         virtual void parseMappedAttribute(Attribute*);
         virtual void svgAttributeChanged(const QualifiedName&);
         virtual void synchronizeProperty(const QualifiedName&);
--- a/src/third_party/WebKit/WebCore/svg/SVGElement.cpp
+++ b/src/third_party/WebKit/WebCore/svg/SVGElement.cpp
@@ -181,12 +181,36 @@ const HashSet<SVGElementInstance*>& SVGE
 
 void SVGElement::setCursorElement(SVGCursorElement* cursorElement)
 {
-    ensureRareSVGData()->setCursorElement(cursorElement);
+    SVGElementRareData* rareData = ensureRareSVGData();
+    if (SVGCursorElement* oldCursorElement = rareData->cursorElement()) {
+        if (cursorElement == oldCursorElement)
+            return;
+        oldCursorElement->removeReferencedElement(this);
+    }
+    rareData->setCursorElement(cursorElement);
+}
+
+void SVGElement::cursorElementRemoved() 
+{
+    ASSERT(hasRareSVGData());
+    rareSVGData()->setCursorElement(0);
 }
 
 void SVGElement::setCursorImageValue(CSSCursorImageValue* cursorImageValue)
 {
-    ensureRareSVGData()->setCursorImageValue(cursorImageValue);
+    SVGElementRareData* rareData = ensureRareSVGData();
+    if (CSSCursorImageValue* oldCursorImageValue = rareData->cursorImageValue()) {
+        if (cursorImageValue == oldCursorImageValue)
+            return;
+        oldCursorImageValue->removeReferencedElement(this);
+    }
+    rareData->setCursorImageValue(cursorImageValue);
+}
+
+void SVGElement::cursorImageElementRemoved()
+{
+    ASSERT(hasRareSVGData());
+    rareSVGData()->setCursorImageValue(0);
 }
 
 void SVGElement::parseMappedAttribute(Attribute* attr)
--- a/src/third_party/WebKit/WebCore/svg/SVGElement.h
+++ b/src/third_party/WebKit/WebCore/svg/SVGElement.h
@@ -77,7 +77,9 @@ namespace WebCore {
         const HashSet<SVGElementInstance*>& instancesForElement() const;
 
         void setCursorElement(SVGCursorElement*);
+        void cursorElementRemoved();
         void setCursorImageValue(CSSCursorImageValue*);
+        void cursorImageElementRemoved();
 
         virtual void updateAnimatedSVGAttribute(const QualifiedName&) const;