1 files changed, 22 insertions, 0 deletions
diff --git a/layout/generic/crashtests/468771-2.xhtml b/layout/generic/crashtests/468771-2.xhtml
new file mode 100644
index 000000000..19c806d02
--- /dev/null
+++ b/layout/generic/crashtests/468771-2.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var newTD = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+  newTD.setAttribute("rowspan", 3);
+  document.getElementById("tr1").appendChild(newTD);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<table id="table" border="1">AAAA<tr id="tr1"></tr><tr><td><div style="-moz-column-width: 1px;">B C</div></td></tr></table>
+
+</body>
+</html>