IE9 Crash: Accessing SVG viewport Property from DOMParser

Parsing an SVG document via DOMParser and then accessing the viewport property on the root SVG element caused a crash in IE9. The DOMParser-created document was not a fully initialized rendering document, so the viewport property had no valid backing object to return.

var dp = new DOMParser();
var svgDoc = dp.parseFromString(
    '<svg xmlns="http://www.w3.org/2000/svg"></svg>',
    'image/svg+xml'
);
svgDoc.all[0].viewport; // Crash

The viewport property on an SVG element is tied to the rendering viewport of the containing document. A DOMParser document is a detached, non-rendered document, so there was no viewport to reference. Accessing the property dereferenced a null pointer in the SVG layout code.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.