summaryrefslogtreecommitdiffstats
path: root/layout/xul/tree/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'layout/xul/tree/crashtests')
-rw-r--r--layout/xul/tree/crashtests/307298-1.xhtml21
-rw-r--r--layout/xul/tree/crashtests/309732-1.xhtml30
-rw-r--r--layout/xul/tree/crashtests/309732-2.xhtml31
-rw-r--r--layout/xul/tree/crashtests/366583-1.xhtml43
-rw-r--r--layout/xul/tree/crashtests/380217-1.xhtml31
-rw-r--r--layout/xul/tree/crashtests/382444-1-inner.html15
-rw-r--r--layout/xul/tree/crashtests/382444-1.html9
-rw-r--r--layout/xul/tree/crashtests/391178-1.xhtml41
-rw-r--r--layout/xul/tree/crashtests/391178-2.xhtml20
-rw-r--r--layout/xul/tree/crashtests/393665-1.xhtml3
-rw-r--r--layout/xul/tree/crashtests/399227-1.xhtml44
-rw-r--r--layout/xul/tree/crashtests/399692-1.xhtml10
-rw-r--r--layout/xul/tree/crashtests/399715-1.xhtml9
-rw-r--r--layout/xul/tree/crashtests/409807-1.xhtml25
-rw-r--r--layout/xul/tree/crashtests/414170-1.xhtml20
-rw-r--r--layout/xul/tree/crashtests/479931-1.xhtml19
-rw-r--r--layout/xul/tree/crashtests/585815-iframe.xhtml72
-rw-r--r--layout/xul/tree/crashtests/585815.html18
-rw-r--r--layout/xul/tree/crashtests/601427.html30
-rw-r--r--layout/xul/tree/crashtests/730441-3.xhtml38
-rw-r--r--layout/xul/tree/crashtests/crashtests.list18
21 files changed, 547 insertions, 0 deletions
diff --git a/layout/xul/tree/crashtests/307298-1.xhtml b/layout/xul/tree/crashtests/307298-1.xhtml
new file mode 100644
index 0000000000..6c04a01321
--- /dev/null
+++ b/layout/xul/tree/crashtests/307298-1.xhtml
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="var tree = document.getElementById('tree'), treeitem = document.getElementById('treeitem'); tree.parentNode.insertBefore(treeitem, tree);">
+
+<tree flex="1" id="tree">
+ <treecols>
+ <treecol id="name" label="Name" primary="true" flex="1"/>
+ </treecols>
+
+ <treechildren>
+ <treeitem id="treeitem">
+ <treerow>
+ <treecell label="Click the button below to crash"/>
+ </treerow>
+ </treeitem>
+ </treechildren>
+</tree>
+
+</window>
diff --git a/layout/xul/tree/crashtests/309732-1.xhtml b/layout/xul/tree/crashtests/309732-1.xhtml
new file mode 100644
index 0000000000..a7e40b75b9
--- /dev/null
+++ b/layout/xul/tree/crashtests/309732-1.xhtml
@@ -0,0 +1,30 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30)">
+
+
+ <script>
+ function boom()
+ {
+ document.documentElement.appendChild(document.getElementById("TC"));
+ document.documentElement.appendChild(document.getElementById("TI"));
+
+ document.documentElement.removeAttribute("class");
+ }
+ </script>
+
+<tree flex="1">
+ <treecols>
+ <treecol label="Name"/>
+ </treecols>
+ <treechildren id="TC">
+ <treeitem id="TI">
+ <treerow>
+ <treecell label="First treecell"/>
+ </treerow>
+ </treeitem>
+ </treechildren>
+ </tree>
+</window>
diff --git a/layout/xul/tree/crashtests/309732-2.xhtml b/layout/xul/tree/crashtests/309732-2.xhtml
new file mode 100644
index 0000000000..354c58dacf
--- /dev/null
+++ b/layout/xul/tree/crashtests/309732-2.xhtml
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30)">
+
+ <script>
+ function boom()
+ {
+ document.documentElement.appendChild(document.getElementById('TC'));
+ document.getElementById('TI').hidden = false;
+
+ document.documentElement.removeAttribute("class");
+ }
+ </script>
+
+
+ <tree flex="1">
+ <treecols>
+ <treecol label="Name" flex="1"/>
+ </treecols>
+ <treechildren id="TC">
+ <treeitem>
+ <treerow>
+ <treecell label="First treecell"/>
+ </treerow>
+ </treeitem>
+ </treechildren>
+ </tree>
+ <treeitem id="TI" hidden="true"/>
+</window>
diff --git a/layout/xul/tree/crashtests/366583-1.xhtml b/layout/xul/tree/crashtests/366583-1.xhtml
new file mode 100644
index 0000000000..11b548f556
--- /dev/null
+++ b/layout/xul/tree/crashtests/366583-1.xhtml
@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="boom1();"
+ class="reftest-wait">
+
+<script>
+
+var tree;
+
+function boom1()
+{
+ tree = document.getElementById("tree");
+ tree.style.position = "fixed";
+ setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+ tree.style.overflow = "visible";
+ document.documentElement.removeAttribute("class");
+}
+</script>
+
+<tree rows="6" id="tree" style="display: list-item; overflow: auto; visibility: collapse;">
+ <treecols>
+ <treecol id="firstname" label="First Name" primary="true" flex="3"/>
+ <treecol id="lastname" label="Last Name" flex="7"/>
+ </treecols>
+
+ <treechildren>
+ <treeitem container="true" open="true">
+ <treerow>
+ <treecell label="Foo"/>
+ </treerow>
+ </treeitem>
+ </treechildren>
+</tree>
+
+
+</window>
diff --git a/layout/xul/tree/crashtests/380217-1.xhtml b/layout/xul/tree/crashtests/380217-1.xhtml
new file mode 100644
index 0000000000..251b3c450d
--- /dev/null
+++ b/layout/xul/tree/crashtests/380217-1.xhtml
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+<window xmlns:html="http://www.w3.org/1999/xhtml"
+ xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="document.documentElement.style.content = '\'a\'';">
+
+<html:style>
+* { position: fixed; }
+*:not(style) {
+ /* At the time this testcase was added, the above `float` styling would
+ have automatically forced "display:block" for these elements, so we
+ should preserve that styling to preserve the integrity of the crashtest
+ since blockification behavior for -moz-box is changing. */
+ display: block;
+}
+</html:style>
+
+<tree rows="6">
+ <treecols>
+ <treecol id="firstname" label="First Name" primary="true"/>
+ </treecols>
+ <treechildren>
+ <treeitem>
+ <treerow>
+ <treecell/>
+ </treerow>
+ </treeitem>
+ </treechildren>
+</tree>
+
+</window>
diff --git a/layout/xul/tree/crashtests/382444-1-inner.html b/layout/xul/tree/crashtests/382444-1-inner.html
new file mode 100644
index 0000000000..01805e6b34
--- /dev/null
+++ b/layout/xul/tree/crashtests/382444-1-inner.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<title>Testcase bug - Crash [@ nsINodeInfo::Equals] with underflow event, tree stuff and removing window</title>
+</head>
+<body>
+<iframe src="data:application/xhtml+xml;charset=utf-8,%3Cwindow%20xmlns%3D%22http%3A//www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%22%3E%0A%3Ctree%20style%3D%22overflow%3A%20auto%3B%20display%3A%20-moz-inline-box%3B%22%3E%0A%3Ctreeitem%20style%3D%22overflow%3A%20scroll%3B%20display%3A%20table-cell%3B%22%3E%0A%3Ctreechildren%20style%3D%22%20display%3A%20table-row%3B%22%3E%0A%3Ctreeitem%20id%3D%22a%22%20style%3D%22display%3A%20table-cell%3B%22%3E%0A%3C/treeitem%3E%0A%3C/treechildren%3E%0A%3C/treeitem%3E%0A%0A%3C/tree%3E%0A%0A%3Cscript%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3E%0Afunction%20doe%28%29%20%7B%0Adocument.getElementById%28%27a%27%29.parentNode.removeChild%28document.getElementById%28%27a%27%29%29%3B%0A%7D%0AsetTimeout%28doe%2C%20100%29%3B%0Adocument.addEventListener%28%27underflow%27%2C%20function%28e%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%20%7D%2C%20true%29%3B%0Awindow.addEventListener%28%27underflow%27%2C%20function%28e%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%20%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/window%3E" id="content"></iframe>
+
+<script>
+function doe() {
+window.location.reload();
+}
+setTimeout(doe, 500);
+</script>
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/382444-1.html b/layout/xul/tree/crashtests/382444-1.html
new file mode 100644
index 0000000000..8926cf16d7
--- /dev/null
+++ b/layout/xul/tree/crashtests/382444-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+<body>
+<iframe src="382444-1-inner.html"></iframe>
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/391178-1.xhtml b/layout/xul/tree/crashtests/391178-1.xhtml
new file mode 100644
index 0000000000..0f4b16cd99
--- /dev/null
+++ b/layout/xul/tree/crashtests/391178-1.xhtml
@@ -0,0 +1,41 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+var ccc;
+
+function boom()
+{
+ var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+ var hbox = document.createElementNS(XUL_NS, 'hbox');
+ var tree = document.createElementNS(XUL_NS, 'tree');
+ var treecol = document.createElementNS(XUL_NS, 'treecol');
+
+ ccc = document.getElementById("ccc");
+
+ ccc.style.position = "fixed";
+
+ hbox.appendChild(treecol);
+ tree.appendChild(hbox);
+ ccc.appendChild(tree);
+
+ setTimeout(boom2, 200);
+}
+
+function boom2()
+{
+ ccc.style.position = "";
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div id="ccc">
+</div>
+
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/391178-2.xhtml b/layout/xul/tree/crashtests/391178-2.xhtml
new file mode 100644
index 0000000000..423b5d1bfe
--- /dev/null
+++ b/layout/xul/tree/crashtests/391178-2.xhtml
@@ -0,0 +1,20 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<tree id="a" style="display: block; position: fixed;">
+ <box style=" display: block; position: fixed;">
+ <treecol style=" display: -moz-box;"/>
+ </box>
+ <box style="display: block; position: fixed;">
+ <treechildren style="display: block; position: absolute;"/>
+ </box>
+</tree>
+
+<script xmlns="http://www.w3.org/1999/xhtml">
+function removestyles(){
+ document.getElementById('a').removeAttribute('style');
+ document.documentElement.removeAttribute("class");
+}
+setTimeout(removestyles, 100);
+</script>
+</window>
diff --git a/layout/xul/tree/crashtests/393665-1.xhtml b/layout/xul/tree/crashtests/393665-1.xhtml
new file mode 100644
index 0000000000..6fb5ec0c9e
--- /dev/null
+++ b/layout/xul/tree/crashtests/393665-1.xhtml
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <treechildren style="display: block" />
+</window>
diff --git a/layout/xul/tree/crashtests/399227-1.xhtml b/layout/xul/tree/crashtests/399227-1.xhtml
new file mode 100644
index 0000000000..3ae4dfa764
--- /dev/null
+++ b/layout/xul/tree/crashtests/399227-1.xhtml
@@ -0,0 +1,44 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30)">
+
+
+ <script>
+ function boom()
+ {
+ var tree = document.getElementById("thetree");
+ var selection = tree.view.selection;
+
+ selection.select(0);
+ tree.parentNode.removeChild(tree);
+
+ // This is expected to throw an error (it used to crash).
+ try {
+ selection.rangedSelect(1, 1, false);
+ }
+ catch (ex) {}
+
+ document.documentElement.removeAttribute("class");
+ }
+ </script>
+
+<tree flex="1" id="thetree">
+ <treecols>
+ <treecol label="Name"/>
+ </treecols>
+ <treechildren id="TC">
+ <treeitem id="TI1">
+ <treerow>
+ <treecell label="First treecell"/>
+ </treerow>
+ </treeitem>
+ <treeitem id="TI2">
+ <treerow>
+ <treecell label="Second treecell"/>
+ </treerow>
+ </treeitem>
+ </treechildren>
+ </tree>
+</window>
diff --git a/layout/xul/tree/crashtests/399692-1.xhtml b/layout/xul/tree/crashtests/399692-1.xhtml
new file mode 100644
index 0000000000..97eec26742
--- /dev/null
+++ b/layout/xul/tree/crashtests/399692-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+</head>
+<body>
+
+<xul:treechildren style="display: inline;" />
+
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/399715-1.xhtml b/layout/xul/tree/crashtests/399715-1.xhtml
new file mode 100644
index 0000000000..ea0a20cfa2
--- /dev/null
+++ b/layout/xul/tree/crashtests/399715-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<body style="float: right;" onload="document.body.style.cssFloat = '';">
+
+<xul:tree><xul:hbox><xul:treecol /></xul:hbox></xul:tree>
+
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/409807-1.xhtml b/layout/xul/tree/crashtests/409807-1.xhtml
new file mode 100644
index 0000000000..a3af3da41b
--- /dev/null
+++ b/layout/xul/tree/crashtests/409807-1.xhtml
@@ -0,0 +1,25 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+ var tree = document.getElementById("tree");
+ var tc = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "treechildren");
+
+ document.addEventListener("DOMAttrModified", m, false);
+
+ tree.appendChild(tc);
+
+ function m()
+ {
+ document.removeEventListener("DOMAttrModified", m, false);
+ tree.removeChild(tc);
+ }
+}
+
+</script>
+
+<tree id="tree" />
+
+</window>
diff --git a/layout/xul/tree/crashtests/414170-1.xhtml b/layout/xul/tree/crashtests/414170-1.xhtml
new file mode 100644
index 0000000000..82ea63bcfd
--- /dev/null
+++ b/layout/xul/tree/crashtests/414170-1.xhtml
@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+ var option = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+ document.getElementById("tc").appendChild(option);
+}
+
+</script>
+
+<tree><treechildren id="tc"><hbox/></treechildren></tree>
+
+</window>
diff --git a/layout/xul/tree/crashtests/479931-1.xhtml b/layout/xul/tree/crashtests/479931-1.xhtml
new file mode 100644
index 0000000000..458a192501
--- /dev/null
+++ b/layout/xul/tree/crashtests/479931-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var o = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+ var q = document.getElementById("q");
+ q.appendChild(o);
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<xul:tree><xul:treechildren id="q"><div/></xul:treechildren></xul:tree>
+
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/585815-iframe.xhtml b/layout/xul/tree/crashtests/585815-iframe.xhtml
new file mode 100644
index 0000000000..ce9d294485
--- /dev/null
+++ b/layout/xul/tree/crashtests/585815-iframe.xhtml
@@ -0,0 +1,72 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="setInterval(run, 25)">
+
+<tree flex="1" rows="2">
+ <treecols>
+ <treecol id="sender" label="Sender" flex="1"/>
+ <treecol id="subject" label="Subject" flex="2"/>
+ </treecols>
+ <treechildren>
+ <treeitem>
+ <treerow>
+ <treecell label="joe@somewhere.com"/>
+ <treecell label="Top secret plans"/>
+ </treerow>
+ </treeitem>
+ <treeitem>
+ <treerow>
+ <treecell label="mel@whereever.com"/>
+ <treecell label="Let's do lunch"/>
+ </treerow>
+ </treeitem>
+ <treeitem>
+ <treerow>
+ <treecell label="mel@whereever.com"/>
+ <treecell label="Let's do lunch"/>
+ </treerow>
+ </treeitem>
+ <treeitem>
+ <treerow>
+ <treecell label="mel@whereever.com"/>
+ <treecell label="Let's do lunch"/>
+ </treerow>
+ </treeitem>
+ <treeitem>
+ <treerow>
+ <treecell label="mel@whereever.com"/>
+ <treecell label="Let's do lunch"/>
+ </treerow>
+ </treeitem>
+ <treeitem>
+ <treerow>
+ <treecell label="mel@whereever.com"/>
+ <treecell label="Let's do lunch"/>
+ </treerow>
+ </treeitem>
+ <treeitem>
+ <treerow>
+ <treecell label="mel@whereever.com"/>
+ <treecell label="Let's do lunch"/>
+ </treerow>
+ </treeitem>
+ <treeitem>
+ <treerow>
+ <treecell label="mel@whereever.com"/>
+ <treecell label="Let's do lunch"/>
+ </treerow>
+ </treeitem>
+ </treechildren>
+</tree>
+
+<script type="text/javascript"><![CDATA[
+function run() {
+ var tree = document.getElementsByTagName("tree")[0];
+ var sel = tree.view.selection;
+ sel.rangedSelect(0, 0, true);
+ sel.rangedSelect(1000, 1001, true);
+ sel.adjustSelection(1, 0x7fffffff);
+}
+]]></script>
+
+</window>
diff --git a/layout/xul/tree/crashtests/585815.html b/layout/xul/tree/crashtests/585815.html
new file mode 100644
index 0000000000..7c3b27f6aa
--- /dev/null
+++ b/layout/xul/tree/crashtests/585815.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+ <meta charset="utf-8">
+ <title>Testcase for bug 585815</title>
+<script>
+function done()
+{
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(done,1000)">
+
+<iframe src="585815-iframe.xhtml"></iframe>
+
+
+</body>
+</html>
diff --git a/layout/xul/tree/crashtests/601427.html b/layout/xul/tree/crashtests/601427.html
new file mode 100644
index 0000000000..2a2999052e
--- /dev/null
+++ b/layout/xul/tree/crashtests/601427.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+
+var onPaintFunctions =
+[
+ function() { document.documentElement.style.MozAppearance = "treeheadersortarrow"; },
+ function() { document.documentElement.style.position = "fixed"; },
+ function() { document.documentElement.removeAttribute("class"); }
+];
+
+var i = 0;
+
+function advance()
+{
+ var f = onPaintFunctions[i++];
+ if (f)
+ f();
+}
+
+function start()
+{
+ window.addEventListener("MozAfterPaint", advance, true);
+ advance();
+}
+
+window.addEventListener("load", start);
+
+</script>
+</html>
diff --git a/layout/xul/tree/crashtests/730441-3.xhtml b/layout/xul/tree/crashtests/730441-3.xhtml
new file mode 100644
index 0000000000..c3fe199a83
--- /dev/null
+++ b/layout/xul/tree/crashtests/730441-3.xhtml
@@ -0,0 +1,38 @@
+<?xml version="1.0"?>
+<!--
+###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../../../dist/include/nsCOMPtr.h, line 796
+
+Program received signal SIGSEGV, Segmentation fault.
+0xb6b7463a in nsTreeContentView::SetTree (this=0xb0ba2510, aTree=0xaaecece0) at layout/xul/base/src/tree/src/nsTreeContentView.cpp:571
+571 boxObject->GetElement(getter_AddRefs(element));
+(gdb) bt 3
+#0 0xb6b7463a in nsTreeContentView::SetTree (this=0xb0ba2510, aTree=0xaaecece0) at layout/xul/base/src/tree/src/nsTreeContentView.cpp:571
+#1 0xb736c76f in NS_InvokeByIndex_P () at xpcom/reflect/xptcall/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
+#2 0xb6171901 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD)
+ at js/src/xpconnect/src/xpcwrappednative.cpp:2722
+(More stack frames follow...)
+(gdb) list 566
+561 nsTreeContentView::SetTree(nsITreeBoxObject* aTree)
+562 {
+563 ClearRows();
+564
+565 mBoxObject = aTree;
+566
+567 if (aTree && !mRoot) {
+568 // Get our root element
+569 nsCOMPtr<nsIBoxObject> boxObject = do_QueryInterface(mBoxObject);
+570 nsCOMPtr<Element> element;
+571 boxObject->GetElement(getter_AddRefs(element));
+(gdb) p boxObject
+$16 = {mRawPtr = 0x0}
+
+|aTree| does not implement |nsIBoxObject|, so |do_QueryInterface(mBoxObject)|
+returns null. Then we have |null->GetElement()|.
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="document.getElementById('tree').view.setTree({});">
+<tree id="tree">
+ <treechildren/>
+</tree>
+</window>
+
diff --git a/layout/xul/tree/crashtests/crashtests.list b/layout/xul/tree/crashtests/crashtests.list
new file mode 100644
index 0000000000..8ed749aca4
--- /dev/null
+++ b/layout/xul/tree/crashtests/crashtests.list
@@ -0,0 +1,18 @@
+load chrome://reftest/content/crashtests/layout/xul/tree/crashtests/307298-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/tree/crashtests/309732-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/tree/crashtests/309732-2.xhtml
+load chrome://reftest/content/crashtests/layout/xul/tree/crashtests/366583-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/tree/crashtests/380217-1.xhtml
+load 382444-1.html
+load 391178-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/tree/crashtests/391178-2.xhtml
+load chrome://reftest/content/crashtests/layout/xul/tree/crashtests/393665-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/tree/crashtests/399227-1.xhtml
+load 399692-1.xhtml
+load 399715-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/tree/crashtests/409807-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/tree/crashtests/414170-1.xhtml
+load 479931-1.xhtml
+load 585815.html
+load 601427.html
+load chrome://reftest/content/crashtests/layout/xul/tree/crashtests/730441-3.xhtml