palemoon-dev/platform/accessible/tests/crashtests/471493.xul

<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin" type="text/css"?>

<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
        title="bug 471493 'crash [@ nsPropertyTable::GetPropertyInternal]'"
        onload="doTest();">

  <script type="application/javascript">
  <![CDATA[
    function doTest()
    {
      var accService = SpecialPowers.Cc["@mozilla.org/accessibilityService;1"].
        getService(SpecialPowers.Ci.nsIAccessibilityService);

      var treecol = document.getElementById("col");
      var x = treecol.boxObject.screenX;
      var y = treecol.boxObject.screenY;

      var tree = document.getElementById("tree");
      var treeAcc = accService.getAccessibleFor(tree);
      treeAcc.getChildAtPoint(x + 1, y + 1);
    }
  ]]>
  </script>

  <tree id="tree" flex="1">
    <treecols>
      <treecol id="col" flex="1" primary="true" label="column"/>
      <treecol id="scol" flex="1" label="column 2"/>
    </treecols>
    <treechildren id="treechildren"/>
  </tree>

</window>