1 files changed, 37 insertions, 0 deletions
diff --git a/dom/xul/test/test_bug236853.xul b/dom/xul/test/test_bug236853.xul
new file mode 100644
index 000000000..9b79deb75
--- /dev/null
+++ b/dom/xul/test/test_bug236853.xul
@@ -0,0 +1,37 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<window
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  xmlns:svg="http://www.w3.org/2000/svg">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+  <script type="application/javascript">
+  <![CDATA[
+    SimpleTest.waitForExplicitFinish();
+    window.onload = function() {
+      ok(true, "Didn't crash");
+      SimpleTest.finish();
+    }
+  ]]>
+  </script>
+  <vbox flex="1">
+    <svg:svg datasources="file_bug236853.rdf" ref="urn:root">
+      <template>
+        <rule>
+          <conditions>
+            <content uri="?root"/>
+            <triple subject="?root"
+                predicate="http://www.ex.org/ex-rdf#nodes"
+                object="?nodes"/>
+            <member container="?nodes" child="?node"/>
+          </conditions>
+          <action>
+            <!-- The line below causes Mozilla to crash -->
+            <svg:text uri="?node" x="64" y="64">Text</svg:text>
+          </action>
+        </rule>
+      </template>
+      <!--<svg:text x="64" y="64">Text</svg:text>-->
+    </svg:svg>
+  </vbox>
+</window>