Add m-esr52 at 52.6.0

28 files changed, 748 insertions, 0 deletions

diff --git a/layout/xul/tree/crashtests/307298-1.xul b/layout/xul/tree/crashtests/307298-1.xul
new file mode 100644
index 000000000..57396755a
--- /dev/null
+++ b/layout/xul/tree/crashtests/307298-1.xul
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="var tree = document.getElementById('tree'), treeitem = document.getElementById('treeitem'); tree.parentNode.insertBefore(treeitem, tree);">
+
+<tree flex="1" id="tree">
+  <treecols>
+    <treecol id="name" label="Name" primary="true" flex="1"/>
+  </treecols>
+
+  <treechildren>
+    <treeitem id="treeitem">
+      <treerow>
+        <treecell label="Click the button below to crash"/>
+      </treerow>
+    </treeitem>
+  </treechildren>
+</tree>
+
+</window>
diff --git a/layout/xul/tree/crashtests/309732-1.xul b/layout/xul/tree/crashtests/309732-1.xul
new file mode 100644
index 000000000..df955e14e
--- /dev/null
+++ b/layout/xul/tree/crashtests/309732-1.xul
@@ -0,0 +1,30 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30)">
+
+
+  <script>
+  function boom()
+  {
+    document.documentElement.appendChild(document.getElementById("TC")); 
+    document.documentElement.appendChild(document.getElementById("TI"));
+
+    document.documentElement.removeAttribute("class");
+  }
+  </script>
+
+<tree flex="1">
+    <treecols>
+      <treecol label="Name"/>
+    </treecols>
+    <treechildren id="TC">
+      <treeitem id="TI">
+        <treerow>
+          <treecell label="First treecell"/>
+        </treerow>
+      </treeitem>
+    </treechildren>
+  </tree>
+</window>
diff --git a/layout/xul/tree/crashtests/309732-2.xul b/layout/xul/tree/crashtests/309732-2.xul
new file mode 100644
index 000000000..9c65e7379
--- /dev/null
+++ b/layout/xul/tree/crashtests/309732-2.xul
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30)">
+
+  <script>
+  function boom()
+  {
+    document.documentElement.appendChild(document.getElementById('TC'));   
+    document.getElementById('TI').hidden = false;
+    
+    document.documentElement.removeAttribute("class");
+  }
+  </script>
+
+
+  <tree flex="1">
+    <treecols>
+      <treecol label="Name" flex="1"/>
+    </treecols>
+    <treechildren id="TC">
+      <treeitem>
+        <treerow>
+          <treecell label="First treecell"/>
+        </treerow>
+      </treeitem>
+    </treechildren>
+  </tree>
+  <treeitem id="TI" hidden="true"/>
+</window>
diff --git a/layout/xul/tree/crashtests/366583-1.xul b/layout/xul/tree/crashtests/366583-1.xul
new file mode 100644
index 000000000..db37b444e
--- /dev/null
+++ b/layout/xul/tree/crashtests/366583-1.xul
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="boom1();"
+        class="reftest-wait">
+
+<script>
+        
+var tree;
+
+function boom1()
+{
+  tree = document.getElementById("tree");
+  tree.style.position = "fixed";
+  setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+  tree.style.overflow = "visible";
+  document.documentElement.removeAttribute("class");
+}
+</script>
+
+<tree rows="6" id="tree" style="display: list-item; overflow: auto; visibility: collapse;">
+  <treecols>
+      <treecol id="firstname" label="First Name" primary="true" flex="3"/>
+      <treecol id="lastname" label="Last Name" flex="7"/>
+  </treecols>
+
+  <treechildren>
+    <treeitem container="true" open="true">
+      <treerow>
+        <treecell label="Foo"/>
+      </treerow>
+    </treeitem>
+  </treechildren>
+</tree>
+
+
+</window>
diff --git a/layout/xul/tree/crashtests/380217-1.xul b/layout/xul/tree/crashtests/380217-1.xul
new file mode 100644
index 000000000..b834f7e1f
--- /dev/null
+++ b/layout/xul/tree/crashtests/380217-1.xul
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns:html="http://www.w3.org/1999/xhtml"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="document.documentElement.style.content = '\'a\'';">
+        
+<html:style>
+* { position: fixed; }
+</html:style>
+
+<tree rows="6">
+  <treecols>
+      <treecol id="firstname" label="First Name" primary="true"/>
+  </treecols>
+  <treechildren>
+    <treeitem>
+      <treerow>
+        <treecell/>
+      </treerow>
+    </treeitem>
+  </treechildren>
+</tree>
+
+</window>
diff --git a/layout/xul/tree/crashtests/382444-1-inner.html b/layout/xul/tree/crashtests/382444-1-inner.html
new file mode 100644
index 000000000..d59a2e787
--- /dev/null
+++ b/layout/xul/tree/crashtests/382444-1-inner.html
@@ -0,0 +1,15 @@
+<html>

+<head>

+<title>Testcase bug - Crash [@ nsINodeInfo::Equals] with underflow event, tree stuff and removing window</title>

+</head>

+<body>

+<iframe src="data:application/vnd.mozilla.xul+xml;charset=utf-8,%3Cwindow%20xmlns%3D%22http%3A//www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%22%3E%0A%3Ctree%20style%3D%22overflow%3A%20auto%3B%20display%3A%20-moz-inline-box%3B%22%3E%0A%3Ctreeitem%20style%3D%22overflow%3A%20scroll%3B%20display%3A%20table-cell%3B%22%3E%0A%3Ctreechildren%20style%3D%22%20display%3A%20table-row%3B%22%3E%0A%3Ctreeitem%20id%3D%22a%22%20style%3D%22display%3A%20table-cell%3B%22%3E%0A%3C/treeitem%3E%0A%3C/treechildren%3E%0A%3C/treeitem%3E%0A%0A%3C/tree%3E%0A%0A%3Cscript%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3E%0Afunction%20doe%28%29%20%7B%0Adocument.getElementById%28%27a%27%29.parentNode.removeChild%28document.getElementById%28%27a%27%29%29%3B%0A%7D%0AsetTimeout%28doe%2C%20100%29%3B%0Adocument.addEventListener%28%27underflow%27%2C%20function%28e%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%20%7D%2C%20true%29%3B%0Awindow.addEventListener%28%27underflow%27%2C%20function%28e%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%20%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/window%3E" id="content"></iframe>

+

+<script>

+function doe() {

+window.location.reload();

+}

+setTimeout(doe, 500);

+</script>

+</body>

+</html>

diff --git a/layout/xul/tree/crashtests/382444-1.html b/layout/xul/tree/crashtests/382444-1.html
new file mode 100644
index 000000000..8926cf16d
--- /dev/null
+++ b/layout/xul/tree/crashtests/382444-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+<body>
+<iframe src="382444-1-inner.html"></iframe>
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/391178-1.xhtml b/layout/xul/tree/crashtests/391178-1.xhtml
new file mode 100644
index 000000000..0f4b16cd9
--- /dev/null
+++ b/layout/xul/tree/crashtests/391178-1.xhtml
@@ -0,0 +1,41 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+var ccc;
+
+function boom()
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+  var hbox = document.createElementNS(XUL_NS, 'hbox');
+  var tree = document.createElementNS(XUL_NS, 'tree');
+  var treecol = document.createElementNS(XUL_NS, 'treecol');
+
+  ccc = document.getElementById("ccc");
+
+  ccc.style.position = "fixed";
+
+  hbox.appendChild(treecol);
+  tree.appendChild(hbox);
+  ccc.appendChild(tree);
+  
+  setTimeout(boom2, 200);
+}
+
+function boom2()
+{
+  ccc.style.position = "";
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div id="ccc">
+</div>
+
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/391178-2.xul b/layout/xul/tree/crashtests/391178-2.xul
new file mode 100644
index 000000000..491fbe77b
--- /dev/null
+++ b/layout/xul/tree/crashtests/391178-2.xul
@@ -0,0 +1,20 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<tree id="a" style="position: fixed;">
+  <box style=" display: -moz-box; position: fixed;">
+    <treecol style=" display: -moz-box;"/>
+  </box>
+  <box style="position: fixed;">
+    <treechildren style="display: -moz-box; position: absolute;"/>
+  </box>
+</tree>
+
+<script xmlns="http://www.w3.org/1999/xhtml">
+function removestyles(){
+  document.getElementById('a').removeAttribute('style');
+  document.documentElement.removeAttribute("class");
+}
+setTimeout(removestyles, 100);
+</script>
+</window>
diff --git a/layout/xul/tree/crashtests/393665-1.xul b/layout/xul/tree/crashtests/393665-1.xul
new file mode 100644
index 000000000..6fb5ec0c9
--- /dev/null
+++ b/layout/xul/tree/crashtests/393665-1.xul
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <treechildren style="display: block" />
+</window>
diff --git a/layout/xul/tree/crashtests/399227-1.xul b/layout/xul/tree/crashtests/399227-1.xul
new file mode 100644
index 000000000..bfc381892
--- /dev/null
+++ b/layout/xul/tree/crashtests/399227-1.xul
@@ -0,0 +1,44 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30)">
+
+
+  <script>
+  function boom()
+  {
+    var tree = document.getElementById("thetree");
+    var selection = tree.view.selection;
+
+    selection.select(0);
+    tree.parentNode.removeChild(tree);
+
+    // This is expected to throw an error (it used to crash).
+    try {
+      selection.rangedSelect(1, 1, false);
+    }
+    catch (ex) {}
+
+    document.documentElement.removeAttribute("class");
+  }
+  </script>
+
+<tree flex="1" id="thetree">
+    <treecols>
+      <treecol label="Name"/>
+    </treecols>
+    <treechildren id="TC">
+      <treeitem id="TI1">
+        <treerow>
+          <treecell label="First treecell"/>
+        </treerow>
+      </treeitem>
+      <treeitem id="TI2">
+        <treerow>
+          <treecell label="Second treecell"/>
+        </treerow>
+      </treeitem>
+    </treechildren>
+  </tree>
+</window>
diff --git a/layout/xul/tree/crashtests/399227-2.xul b/layout/xul/tree/crashtests/399227-2.xul
new file mode 100644
index 000000000..55665ec47
--- /dev/null
+++ b/layout/xul/tree/crashtests/399227-2.xul
@@ -0,0 +1,50 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30);">
+
+
+  <script>
+  function boom()
+  {
+    var tree = document.getElementById("thetree");
+    var selection = tree.view.selection;
+    var treecolumn0 = tree.columns[0];
+    var treecolumn1 = tree.columns[1];
+
+    selection.select(0);
+    selection.currentColumn = treecolumn0;
+    tree.parentNode.removeChild(tree);
+
+    // This is expected to throw an error (it used to crash).
+    try {
+      selection.currentColumn = treecolumn1;
+    }
+    catch (ex) {}
+
+    document.documentElement.removeAttribute("class");
+  }
+  </script>
+
+<tree flex="1" id="thetree" seltype="cell">
+    <treecols>
+      <treecol label="Name"/>
+      <treecol label="Test"/>
+    </treecols>
+    <treechildren id="TC">
+      <treeitem id="TI1">
+        <treerow>
+          <treecell label="First treecell"/>
+          <treecell label="Second treecell"/>
+        </treerow>
+      </treeitem>
+      <treeitem id="TI2">
+        <treerow>
+          <treecell label="Third treecell"/>
+          <treecell label="Fourth treecell"/>
+        </treerow>
+      </treeitem>
+    </treechildren>
+  </tree>
+</window>
diff --git a/layout/xul/tree/crashtests/399692-1.xhtml b/layout/xul/tree/crashtests/399692-1.xhtml
new file mode 100644
index 000000000..97eec2674
--- /dev/null
+++ b/layout/xul/tree/crashtests/399692-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+</head>
+<body>
+
+<xul:treechildren style="display: inline;" />
+
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/399715-1.xhtml b/layout/xul/tree/crashtests/399715-1.xhtml
new file mode 100644
index 000000000..ea0a20cfa
--- /dev/null
+++ b/layout/xul/tree/crashtests/399715-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+      
+<body style="float: right;" onload="document.body.style.cssFloat = '';">
+
+<xul:tree><xul:hbox><xul:treecol /></xul:hbox></xul:tree>
+
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/409807-1.xul b/layout/xul/tree/crashtests/409807-1.xul
new file mode 100644
index 000000000..a3af3da41
--- /dev/null
+++ b/layout/xul/tree/crashtests/409807-1.xul
@@ -0,0 +1,25 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+  var tree = document.getElementById("tree");
+  var tc = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "treechildren");
+  
+  document.addEventListener("DOMAttrModified", m, false);
+  
+  tree.appendChild(tc);
+  
+  function m()
+  {
+    document.removeEventListener("DOMAttrModified", m, false);
+    tree.removeChild(tc);
+  }
+}
+
+</script>
+
+<tree id="tree" />
+
+</window>
diff --git a/layout/xul/tree/crashtests/414170-1.xul b/layout/xul/tree/crashtests/414170-1.xul
new file mode 100644
index 000000000..f3bc1d134
--- /dev/null
+++ b/layout/xul/tree/crashtests/414170-1.xul
@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="boom();">
+        
+<script type="text/javascript">
+
+function boom()
+{
+  var option = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+  document.getElementById("tc").appendChild(option);
+}
+
+</script>
+
+<tree><treechildren id="tc"><hbox/></treechildren></tree>
+
+</window>
diff --git a/layout/xul/tree/crashtests/430394-1.xul b/layout/xul/tree/crashtests/430394-1.xul
new file mode 100644
index 000000000..63f4c3780
--- /dev/null
+++ b/layout/xul/tree/crashtests/430394-1.xul
@@ -0,0 +1,8 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<tree id="a" style="content: 't';" rows="-2">
+  <menuitem id="b" onoverflow="event.currentTarget.parentNode.removeAttribute('style')">
+    <treechildren style="display: block;" onoverflow="event.target.parentNode.removeChild(event.target)" />
+    <treechildren style="display: block;" ordinal="0.5"/>
+  </menuitem>
+</tree>
+</window>
\ No newline at end of file
diff --git a/layout/xul/tree/crashtests/454186-1.xul b/layout/xul/tree/crashtests/454186-1.xul
new file mode 100644
index 000000000..edf266e43
--- /dev/null
+++ b/layout/xul/tree/crashtests/454186-1.xul
@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<tree flex="1">
+  <treecols>
+    <treecol label="test" flex="1" type="progressmeter" />
+  </treecols>
+  <treechildren>
+    <treeitem>
+      <treerow>
+        <treecell value="50" mode="normal" />
+      </treerow>
+    </treeitem>
+    <treeitem>
+      <treerow>
+        <treecell mode="undetermined" />
+      </treerow>
+    </treeitem>
+  </treechildren>
+</tree>
+
+</window>
diff --git a/layout/xul/tree/crashtests/479931-1.xhtml b/layout/xul/tree/crashtests/479931-1.xhtml
new file mode 100644
index 000000000..458a19250
--- /dev/null
+++ b/layout/xul/tree/crashtests/479931-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var o = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+  var q = document.getElementById("q");
+  q.appendChild(o);
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<xul:tree><xul:treechildren id="q"><div/></xul:treechildren></xul:tree>
+
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/509602-1-overlay.xul b/layout/xul/tree/crashtests/509602-1-overlay.xul
new file mode 100644
index 000000000..f5cecd40e
--- /dev/null
+++ b/layout/xul/tree/crashtests/509602-1-overlay.xul
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>

+<overlay xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

+<box id="b">
+<box onDOMAttrModified="event.target.parentNode.removeChild(event.target)" id="d"/>
+<tree/>
+</box>
+
+<tree>
+<box  id="b" observes="d"/>
+<treechildren observes="b"/>
+</tree>
+</overlay>
\ No newline at end of file
diff --git a/layout/xul/tree/crashtests/509602-1.xul b/layout/xul/tree/crashtests/509602-1.xul
new file mode 100644
index 000000000..a1cdcf1cc
--- /dev/null
+++ b/layout/xul/tree/crashtests/509602-1.xul
@@ -0,0 +1,3 @@
+<?xul-overlay href="509602-1-overlay.xul"?>

+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>

+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/>
\ No newline at end of file
diff --git a/layout/xul/tree/crashtests/585815-iframe.xul b/layout/xul/tree/crashtests/585815-iframe.xul
new file mode 100644
index 000000000..ce9d29448
--- /dev/null
+++ b/layout/xul/tree/crashtests/585815-iframe.xul
@@ -0,0 +1,72 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="setInterval(run, 25)">
+
+<tree flex="1" rows="2">
+ <treecols>  
+    <treecol id="sender" label="Sender" flex="1"/>  
+    <treecol id="subject" label="Subject" flex="2"/>  
+  </treecols>  
+  <treechildren>
+    <treeitem>
+      <treerow>
+        <treecell label="joe@somewhere.com"/>  
+        <treecell label="Top secret plans"/>  
+      </treerow>
+    </treeitem>  
+    <treeitem>  
+      <treerow>  
+        <treecell label="mel@whereever.com"/>  
+        <treecell label="Let's do lunch"/>  
+      </treerow>  
+    </treeitem> 
+    <treeitem>  
+      <treerow>  
+        <treecell label="mel@whereever.com"/>  
+        <treecell label="Let's do lunch"/>  
+      </treerow>  
+    </treeitem> 
+    <treeitem>  
+      <treerow>  
+        <treecell label="mel@whereever.com"/>  
+        <treecell label="Let's do lunch"/>  
+      </treerow>  
+    </treeitem> 
+    <treeitem>  
+      <treerow>  
+        <treecell label="mel@whereever.com"/>  
+        <treecell label="Let's do lunch"/>  
+      </treerow>  
+    </treeitem> 
+    <treeitem>  
+      <treerow>  
+        <treecell label="mel@whereever.com"/>  
+        <treecell label="Let's do lunch"/>  
+      </treerow>  
+    </treeitem> 
+    <treeitem>  
+      <treerow>  
+        <treecell label="mel@whereever.com"/>  
+        <treecell label="Let's do lunch"/>  
+      </treerow>  
+    </treeitem> 
+    <treeitem>  
+      <treerow>  
+        <treecell label="mel@whereever.com"/>  
+        <treecell label="Let's do lunch"/>  
+      </treerow>  
+    </treeitem> 
+  </treechildren>
+</tree>
+
+<script type="text/javascript"><![CDATA[
+function run() {
+  var tree = document.getElementsByTagName("tree")[0];
+  var sel = tree.view.selection;
+  sel.rangedSelect(0, 0, true);
+  sel.rangedSelect(1000, 1001, true);
+  sel.adjustSelection(1, 0x7fffffff);
+}
+]]></script>
+
+</window>
diff --git a/layout/xul/tree/crashtests/585815.html b/layout/xul/tree/crashtests/585815.html
new file mode 100644
index 000000000..0b8b01827
--- /dev/null
+++ b/layout/xul/tree/crashtests/585815.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+    <meta charset="utf-8">
+    <title>Testcase for bug 585815</title>
+<script>
+function done()
+{
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(done,1000)">
+
+<iframe src="585815-iframe.xul"></iframe>
+
+
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/601427.html b/layout/xul/tree/crashtests/601427.html
new file mode 100644
index 000000000..cd9574eef
--- /dev/null
+++ b/layout/xul/tree/crashtests/601427.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+
+var onPaintFunctions =
+[
+  function() { document.documentElement.style.MozAppearance = "treeheadersortarrow"; },
+  function() { document.documentElement.style.position = "fixed"; },
+  function() { document.documentElement.removeAttribute("class"); }
+];
+
+var i = 0;
+
+function advance()
+{
+  var f = onPaintFunctions[i++];
+  if (f)
+    f();
+}
+
+function start()
+{
+  window.addEventListener("MozAfterPaint", advance, true);
+  advance();
+}
+
+window.addEventListener("load", start, false);
+
+</script>
+</html>
diff --git a/layout/xul/tree/crashtests/730441-1.xul b/layout/xul/tree/crashtests/730441-1.xul
new file mode 100644
index 000000000..a31c3b63f
--- /dev/null
+++ b/layout/xul/tree/crashtests/730441-1.xul
@@ -0,0 +1,54 @@
+<?xml version="1.0"?>
+<!--
+Program received signal SIGSEGV, Segmentation fault.
+0xb6457185 in nsIContent::SetAttr (this=0x0, aNameSpaceID=0, aName=0xb0cb064c, aValue=..., aNotify=1) at ../../dist/include/nsIContent.h:285
+285	    return SetAttr(aNameSpaceID, aName, nsnull, aValue, aNotify);
+(gdb) p this
+$6 = (nsIContent * const) 0x0
+(gdb) bt 3
+#0  0xb6457185 in nsIContent::SetAttr (this=0x0, aNameSpaceID=0, aName=0xb0cb064c, aValue=..., aNotify=1) at ../../dist/include/nsIContent.h:285
+#1  0xb6b72072 in nsTreeColumns::RestoreNaturalOrder (this=0xaaf83cc0) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:605
+#2  0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
+(More stack frames follow...)
+(gdb) frame 1
+#1  0xb6b72072 in nsTreeColumns::RestoreNaturalOrder (this=0xaaf83cc0) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:605
+605	    child->SetAttr(kNameSpaceID_None, nsGkAtoms::ordinal, ordinal, PR_TRUE);
+(gdb) list
+600	  PRUint32 numChildren = colsContent->GetChildCount();
+601	  for (PRUint32 i = 0; i < numChildren; ++i) {
+602	    nsIContent *child = colsContent->GetChildAt(i);
+603	    nsAutoString ordinal;
+604	    ordinal.AppendInt(i);
+605	    child->SetAttr(kNameSpaceID_None, nsGkAtoms::ordinal, ordinal, PR_TRUE);
+606	  }
+(gdb) p child
+$7 = (nsIContent *) 0x0
+
+First loop iteration: |child->SetAttr()| dispatches "DOMAttrModified" event.
+Event listener removes next column. Second loop iteration: |colsContent->GetChildAt(i)|
+returns null. Then we have |null->SetAttr()|.
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="run();">
+<tree id="tree">
+  <treecols>
+    <treecol id="col1"/>
+    <treecol id="col2"/>
+  </treecols>
+  <treechildren/>
+</tree>
+<script type="text/javascript"><![CDATA[
+function listener() {
+  var col2 = document.getElementById("col2");
+  col2.parentNode.removeChild(col2);
+}
+
+function run() {
+  var col1 = document.getElementById("col1");
+  col1.addEventListener("DOMAttrModified", listener, true);
+  var tree = document.getElementById("tree");
+  tree.columns.restoreNaturalOrder();
+}
+]]></script>
+</window>
+
diff --git a/layout/xul/tree/crashtests/730441-2.xul b/layout/xul/tree/crashtests/730441-2.xul
new file mode 100644
index 000000000..02b3a307e
--- /dev/null
+++ b/layout/xul/tree/crashtests/730441-2.xul
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<!--
+Program received signal SIGSEGV, Segmentation fault.
+0xb6b720a6 in nsTreeColumns::RestoreNaturalOrder (this=0xa947a580) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:610
+610	  mTree->Invalidate();
+(gdb) bt 3
+#0  0xb6b720a6 in nsTreeColumns::RestoreNaturalOrder (this=0xa947a580) at layout/xul/base/src/tree/src/nsTreeColumns.cpp:610
+#1  0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
+#2  0xb6171901 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD)
+    at js/src/xpconnect/src/xpcwrappednative.cpp:2722
+(More stack frames follow...)
+(gdb) list
+605	    child->SetAttr(kNameSpaceID_None, nsGkAtoms::ordinal, ordinal, PR_TRUE);
+606	  }
+607	
+608	  nsTreeColumns::InvalidateColumns();
+609	
+610	  mTree->Invalidate();
+611	
+612	  return NS_OK;
+613	}
+614	
+(gdb) p mTree
+$9 = (nsITreeBoxObject *) 0x0
+
+|child->SetAttr()| dispatches "DOMAttrModified" event. Event listener removes
+whole tree, |mTree| is being set to null. Then we have |null->Invalidate()|.
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="run();">
+<tree id="tree">
+  <treecols>
+    <treecol id="col"/>
+  </treecols>
+  <treechildren/>
+</tree>
+<script type="text/javascript"><![CDATA[
+var tree = null;
+
+function listener() {
+  tree.parentNode.removeChild(tree);
+}
+
+function run() {
+  col = document.getElementById("col");
+  col.addEventListener("DOMAttrModified", listener, true);
+  tree = document.getElementById("tree");
+  tree.columns.restoreNaturalOrder();
+}
+]]></script>
+</window>
+
diff --git a/layout/xul/tree/crashtests/730441-3.xul b/layout/xul/tree/crashtests/730441-3.xul
new file mode 100644
index 000000000..2cf74d1b9
--- /dev/null
+++ b/layout/xul/tree/crashtests/730441-3.xul
@@ -0,0 +1,38 @@
+<?xml version="1.0"?>
+<!--
+###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../../../dist/include/nsCOMPtr.h, line 796
+
+Program received signal SIGSEGV, Segmentation fault.
+0xb6b7463a in nsTreeContentView::SetTree (this=0xb0ba2510, aTree=0xaaecece0) at layout/xul/base/src/tree/src/nsTreeContentView.cpp:571
+571        boxObject->GetElement(getter_AddRefs(element));
+(gdb) bt 3
+#0  0xb6b7463a in nsTreeContentView::SetTree (this=0xb0ba2510, aTree=0xaaecece0) at layout/xul/base/src/tree/src/nsTreeContentView.cpp:571
+#1  0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
+#2  0xb6171901 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD)
+    at js/src/xpconnect/src/xpcwrappednative.cpp:2722
+(More stack frames follow...)
+(gdb) list 566
+561    nsTreeContentView::SetTree(nsITreeBoxObject* aTree)
+562    {
+563      ClearRows();
+564
+565      mBoxObject = aTree;
+566
+567      if (aTree && !mRoot) {
+568        // Get our root element
+569        nsCOMPtr<nsIBoxObject> boxObject = do_QueryInterface(mBoxObject);
+570        nsCOMPtr<nsIDOMElement> element;
+571        boxObject->GetElement(getter_AddRefs(element));
+(gdb) p boxObject
+$16 = {mRawPtr = 0x0}
+
+|aTree| does not implement |nsIBoxObject|, so |do_QueryInterface(mBoxObject)|
+returns null. Then we have |null->GetElement()|.
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="document.getElementById('tree').view.setTree({});">
+<tree id="tree">
+  <treechildren/>
+</tree>
+</window>
+
diff --git a/layout/xul/tree/crashtests/crashtests.list b/layout/xul/tree/crashtests/crashtests.list
new file mode 100644
index 000000000..d462e9550
--- /dev/null
+++ b/layout/xul/tree/crashtests/crashtests.list
@@ -0,0 +1,24 @@
+load 307298-1.xul
+load 309732-1.xul
+load 309732-2.xul
+load 366583-1.xul
+load 380217-1.xul
+load 382444-1.html
+load 391178-1.xhtml
+load 391178-2.xul
+load 393665-1.xul
+load 399227-1.xul
+load 399227-2.xul
+load 399692-1.xhtml
+load 399715-1.xhtml
+load 409807-1.xul
+load 414170-1.xul
+load 430394-1.xul
+load 454186-1.xul
+load 479931-1.xhtml
+load 509602-1.xul
+load 585815.html
+load 601427.html
+load 730441-1.xul
+load 730441-2.xul
+load 730441-3.xul