1 files changed, 55 insertions, 0 deletions
diff --git a/accessible/tests/crashtests/471493.xhtml b/accessible/tests/crashtests/471493.xhtml
new file mode 100644
index 0000000000..ca703f2aae
--- /dev/null
+++ b/accessible/tests/crashtests/471493.xhtml
@@ -0,0 +1,55 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        title="bug 471493 'crash [@ nsPropertyTable::GetPropertyInternal]'"
+        onload="doTest();" class="reftest-wait">
+
+  <script type="application/javascript">
+  <![CDATA[
+    function addA11yLoadEvent(accService, func) {
+      function waitForDocLoad() {
+        setTimeout(() => {
+            let accDoc = accService.getAccessibleFor(document);
+            let state = {};
+            accDoc.getState(state, {});
+
+            if (state.value & SpecialPowers.Ci.nsIAccessibleStates.STATE_BUSY) {
+              return waitForDocLoad();
+            }
+            setTimeout(func, 0);
+          }, 0);
+      }
+
+      waitForDocLoad();
+    }
+
+    function doTest()
+    {
+      var accService = SpecialPowers.Cc["@mozilla.org/accessibilityService;1"].
+        getService(SpecialPowers.Ci.nsIAccessibilityService);
+
+      var treecol = document.getElementById("col");
+      var x = treecol.screenX;
+      var y = treecol.screenY;
+
+      var tree = document.getElementById("tree");
+      addA11yLoadEvent(accService, () => {
+        var treeAcc = accService.getAccessibleFor(tree);
+        treeAcc.getChildAtPoint(x + 1, y + 1);
+        document.documentElement.removeAttribute("class");
+      });
+    }
+  ]]>
+  </script>
+
+  <tree id="tree" flex="1">
+    <treecols>
+      <treecol id="col" flex="1" primary="true" label="column"/>
+      <treecol id="scol" flex="1" label="column 2"/>
+    </treecols>
+    <treechildren id="treechildren"/>
+  </tree>
+
+</window>
+