The Tor Browser / file revision

 <?xml version="1.0"?>

 <?xml-stylesheet href="chrome://global/skin" type="text/css"?>

 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"

         title="bug 471493 'crash [@ nsPropertyTable::GetPropertyInternal]'"

         onload="doTest();">

   <script type="application/javascript">

   <![CDATA[

     function doTest()

     {

       var accRetrieval = SpecialPowers.Cc["@mozilla.org/accessibleRetrieval;1"].

         getService(SpecialPowers.Ci.nsIAccessibleRetrieval);

       var treecol = document.getElementById("col");

       var x = treecol.boxObject.screenX;

       var y = treecol.boxObject.screenY;

       var tree = document.getElementById("tree");

       var treeAcc = accRetrieval.getAccessibleFor(tree);

       treeAcc.getChildAtPoint(x + 1, y + 1);

     }

   ]]>

   </script>

   <tree id="tree" flex="1">

     <treecols>

       <treecol id="col" flex="1" primary="true" label="column"/>

       <treecol id="scol" flex="1" label="column 2"/>

     </treecols>

     <treechildren id="treechildren"/>

   </tree>

 </window>