Index: domdoc.c
===================================================================
--- domdoc.c    (revision 57310)
+++ domdoc.c    (working copy)
@@ -1447,6 +1447,9 @@
 #define EXPECT_HR(hr,hr_exp) \
     ok(hr == hr_exp, "got 0x%08x, expected 0x%08x\n", hr, hr_exp)

+#define EXPECT_NOT_HR(hr,hr_exp) \
+    ok(hr != hr_exp, "got 0x%08x, expected not 0x%08x\n", hr, hr_exp)
+
 static const WCHAR szEmpty[] = { 0 };
 static const WCHAR szIncomplete[] = {
     '<','?','x','m','l',' ',
@@ -4244,6 +4247,30 @@
     free_bstrs();
 }

+/*
+ * This function is to display that xmlnodelist_QueryInterface
+ * generates SEGV for these conditions, and once fixed make sure
+ * it never does it again.
+ */
+static void verify_nodelist_query_interface(IXMLDOMNodeList *node_list)
+{
+    HRESULT hr;
+    /*
+     * NOTE: The following calls are supposed to test wine's
+     * xmlnodelist_QueryInterface behaving properly.
+     * While we should be able to expect E_POINTER (due to the NULL pointer),
+     * it seems MS' own implementation(s) violate the spec and return
+     * E_INVALIDARG. To not get cought be a potentially correct implementation
+     * in the future, we check for NOT S_OK.
+     */
+    hr = IXMLDOMNodeList_QueryInterface(node_list, &IID_IUnknown, NULL);
+    EXPECT_NOT_HR(hr, S_OK);
+    hr = IXMLDOMNodeList_QueryInterface(node_list, &IID_IDispatch, NULL);
+    EXPECT_NOT_HR(hr, S_OK);
+    hr = IXMLDOMNodeList_QueryInterface(node_list, &IID_IXMLDOMNodeList, NULL);
+    EXPECT_NOT_HR(hr, S_OK);
+}
+
 static void test_get_childNodes(void)
 {
     IXMLDOMNodeList *node_list, *node_list2;
@@ -4271,6 +4298,8 @@
     hr = IXMLDOMElement_get_childNodes( element, &node_list );
     EXPECT_HR(hr, S_OK);

+    verify_nodelist_query_interface(node_list);
+
     hr = IXMLDOMNodeList_get_length( node_list, &len );
     EXPECT_HR(hr, S_OK);
     ok( len == 4, "len %d\n", len);
Index: domdoc.c
===================================================================
--- domdoc.c	(revision 57539)
+++ domdoc.c	(revision 57540)
@@ -1398,7 +1398,9 @@
     istream_Clone
 };
 
+#if CORE_6738_IS_FIXED
 static IStream savestream = { &StreamVtbl };
+#endif
 
 #define EXPECT_CHILDREN(node) _expect_children((IXMLDOMNode*)node, __LINE__)
 static void _expect_children(IXMLDOMNode *node, int line)
@@ -7274,6 +7276,7 @@
     free_bstrs();
 }
 
+#if CORE_6738_IS_FIXED
 static void test_save(void)
 {
     IXMLDOMDocument *doc, *doc2;
@@ -7410,6 +7413,7 @@
     IXMLDOMDocument_Release(doc);
     free_bstrs();
 }
+#endif /* CORE_6738_IS_FIXED */
 
 static void test_testTransforms(void)
 {
@@ -12538,7 +12542,9 @@
     test_XSLPattern();
     test_cloneNode();
     test_xmlTypes();
+#if CORE_6738_IS_FIXED
     test_save();
+#endif
     test_testTransforms();
     test_namespaces_basic();
     test_namespaces_change();