1 files changed, 26 insertions, 0 deletions
diff --git a/layout/tables/crashtests/351328-1.xhtml b/layout/tables/crashtests/351328-1.xhtml
new file mode 100644
index 000000000..a7c7e10ca
--- /dev/null
+++ b/layout/tables/crashtests/351328-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+
+function boom()
+{
+  document.getElementById('A').setAttribute('colspan', 0);
+  document.getElementById('B').setAttribute('rowspan', 3);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<table>
+  <tr>
+    <td id="A">TD</td>
+    <td id="B" colspan="3">TD</td>
+  </tr>
+</table>
+
+</body>
+</html>