palemoon-dev/platform/dom/xul/test/test_bug236853.xul

<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
<window
  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
  xmlns:svg="http://www.w3.org/2000/svg">
  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
  <script type="application/javascript">
  <![CDATA[
    SimpleTest.waitForExplicitFinish();
    window.onload = function() {
      ok(true, "Didn't crash");
      SimpleTest.finish();
    }
  ]]>
  </script>
  <vbox flex="1">
    <svg:svg datasources="file_bug236853.rdf" ref="urn:root">
      <template>
        <rule>
          <conditions>
            <content uri="?root"/>
            <triple subject="?root"
                predicate="http://www.ex.org/ex-rdf#nodes"
                object="?nodes"/>
            <member container="?nodes" child="?node"/>
          </conditions>
          <action>
            <!-- The line below causes Mozilla to crash -->
            <svg:text uri="?node" x="64" y="64">Text</svg:text>
          </action>
        </rule>
      </template>
      <!--<svg:text x="64" y="64">Text</svg:text>-->
    </svg:svg>
  </vbox>
</window>