diff --git a/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp b/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp
index 1020b57c12d..7d782e4aa0b 100644
--- a/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp
+++ b/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp
@@ -100,8 +100,8 @@ void SVGSVGPaintable::paint_descendants(PaintContext& context, PaintableBox cons
     };
 
     paintable.before_children_paint(context, PaintPhase::Foreground);
-    paintable.for_each_child([&](auto& child) {
-        paint_svg_box(verify_cast<PaintableBox>(child));
+    paintable.for_each_child_of_type<PaintableBox>([&](PaintableBox& child) {
+        paint_svg_box(child);
         return IterationDecision::Continue;
     });
     paintable.after_children_paint(context, PaintPhase::Foreground);
diff --git a/Tests/LibWeb/Ref/input/svg-text-crash.html b/Tests/LibWeb/Ref/input/svg-text-crash.html
new file mode 100644
index 00000000000..5e409546230
--- /dev/null
+++ b/Tests/LibWeb/Ref/input/svg-text-crash.html
@@ -0,0 +1,7 @@
+<!-- matches against itself because the only thing being tested is that this does not crash. -->
+<link rel="match" href="./svg-text-crash.html" />
+<svg>
+    <foreignObject>
+        <span>foo</span>
+    </foreignObject>
+</svg>