1 files changed, 23 insertions, 0 deletions
diff --git a/layout/tables/crashtests/450311-1.html b/layout/tables/crashtests/450311-1.html
new file mode 100644
index 000000000..283b3774a
--- /dev/null
+++ b/layout/tables/crashtests/450311-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head><style type="text/css" id="s"></style>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("x").style.cssFloat = "";
+  document.getElementById("s").textContent = "span { margin: -9684px; word-spacing: 31851153225in; }";
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<table>
+  <tr><td colspan="2"></td></tr>
+  <tr><td><span>1 2 3</span></td><td id="x" style="float: right;"><span>4 5 6</span></td></tr>
+</table>
+
+</body>
+</html>