1 files changed, 27 insertions, 0 deletions
diff --git a/layout/generic/crashtests/468771-1.xhtml b/layout/generic/crashtests/468771-1.xhtml
new file mode 100644
index 000000000..58196fc89
--- /dev/null
+++ b/layout/generic/crashtests/468771-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var newTD = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+  newTD.setAttribute("rowspan", 3);
+  document.getElementById("tr1").appendChild(newTD);
+
+  document.documentElement.offsetHeight;
+
+  var newTR = document.createElementNS("http://www.w3.org/1999/xhtml", "tr");
+  document.getElementById("table").appendChild(newTR);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<table id="table">AAAA<tr id="tr1"></tr><tr><td><div style="-moz-column-width: 1px;">B C</div></td></tr></table>
+
+</body>
+</html>