3 files changed, 111 insertions, 0 deletions
diff --git a/accessible/tests/crashtests/448064.xhtml b/accessible/tests/crashtests/448064.xhtml
new file mode 100644
index 000000000..64d6d851d
--- /dev/null
+++ b/accessible/tests/crashtests/448064.xhtml
@@ -0,0 +1,73 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+<div id="mw_b">
+<div id="mw_f">
+<div id="mw_g" style="display: none;"/>
+</div>
+</div>
+
+<div id="mw_c" style="display: none;">
+<div id="mw_d">
+<div id="mw_e"></div>
+</div>
+</div>
+
+<input id="mw_a"/>
+
+
+<script>
+function dumpAccessibleNode(aNode, level) {
+	var msg = "";
+	
+	try {
+		msg += "name=\"" + aNode.name + "\" ";
+	} catch (e) {
+		msg += " noName ";
+	}
+	
+	dump(msg + '\n');
+}
+
+
+function dumpAccessibleTree(aNode, level) {
+netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+	level = level || 0;
+
+	dumpAccessibleNode(aNode, level);
+	try {	
+		var child = aNode.firstChild;
+		while (child) {
+			dumpAccessibleTree(child, level + 1);
+			child = child.nextSibling;
+		}
+	} catch (e) {
+		dump("Error visiting child nodes: " + e + '\n');
+	}
+}
+
+function A(o) { 
+  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+  var acc = Components.classes['@mozilla.org/accessibilityService;1']
+                         .getService(Components.interfaces.nsIAccessibilityService);
+  return acc.getAccessibleFor(o);
+}
+
+function beginAccessible() {
+  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+  dumpAccessibleTree(A(document),0);
+}
+setTimeout(beginAccessible, 100);
+
+
+setTimeout(doe, 200);
+function doe() {
+   document.getElementById('mw_a').appendChild(document.getElementById('mw_b'));
+   document.getElementById('mw_c').appendChild(document.getElementById('mw_d'));
+   document.getElementById('mw_e').appendChild(document.getElementById('mw_f')); 
+   document.getElementById('mw_g').appendChild(document.getElementById('mw_b')); 
+}
+</script>
+</body>
+</html>
+\ No newline at end of file
diff --git a/accessible/tests/crashtests/471493.xul b/accessible/tests/crashtests/471493.xul
new file mode 100644
index 000000000..2524d47cc
--- /dev/null
+++ b/accessible/tests/crashtests/471493.xul
@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        title="bug 471493 'crash [@ nsPropertyTable::GetPropertyInternal]'"
+        onload="doTest();">
+
+  <script type="application/javascript">
+  <![CDATA[
+    function doTest()
+    {
+      var accService = SpecialPowers.Cc["@mozilla.org/accessibilityService;1"].
+        getService(SpecialPowers.Ci.nsIAccessibilityService);
+
+      var treecol = document.getElementById("col");
+      var x = treecol.boxObject.screenX;
+      var y = treecol.boxObject.screenY;
+
+      var tree = document.getElementById("tree");
+      var treeAcc = accService.getAccessibleFor(tree);
+      treeAcc.getChildAtPoint(x + 1, y + 1);
+    }
+  ]]>
+  </script>
+
+  <tree id="tree" flex="1">
+    <treecols>
+      <treecol id="col" flex="1" primary="true" label="column"/>
+      <treecol id="scol" flex="1" label="column 2"/>
+    </treecols>
+    <treechildren id="treechildren"/>
+  </tree>
+
+</window>
+
diff --git a/accessible/tests/crashtests/crashtests.list b/accessible/tests/crashtests/crashtests.list
new file mode 100644
index 000000000..6718706aa
--- /dev/null
+++ b/accessible/tests/crashtests/crashtests.list
@@ -0,0 +1,3 @@
+# Disabled because they cause assertions/crashes in later crashtests, see bug 918246
+skip load 448064.xhtml
+skip load 471493.xul