1 files changed, 93 insertions, 0 deletions
diff --git a/layout/tables/crashtests/220536-1.html b/layout/tables/crashtests/220536-1.html
new file mode 100644
index 0000000000..e15548cc77
--- /dev/null
+++ b/layout/tables/crashtests/220536-1.html
@@ -0,0 +1,93 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+<title>Essai</title>
+<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+<script type="text/javascript" language="javascript">
+
+function remove_col2() {
+
+var colp = document.getElementById("colp");
+
+var c4= document.getElementById("c4");
+
+
+
+colp.colSpan=0;
+
+colp.style.display="none";
+
+c4.style.display="none";
+
+
+
+
+
+
+
+}
+
+function remove_col() {
+var tr1 = document.getElementById("tr1");
+
+var tr2 = document.getElementById("tr2");
+
+var tr3 = document.getElementById("tr3");
+
+var colp = document.getElementById("colp");
+
+var c1 = document.getElementById("c1");
+
+var c2 = document.getElementById("c2");
+
+var c3 = document.getElementById("c3");
+
+var c4= document.getElementById("c4");
+
+
+
+c1.style.display="none";
+
+colp.colSpan=1;
+
+c3.style.display="none";
+
+c2.style.display="none";
+
+document.documentElement.offsetHeight;
+
+remove_col2();
+
+}
+
+
+
+</script>
+</head>
+<body onload="remove_col()">
+<table border="1" id="t_0">
+  <thead>
+    <tr id="tr1">
+      <th rowspan="2">aaaa</th>
+      <th rowspan="2">bbbb</th>
+      <th colspan="2" id ="colp">cccc</th>
+      <th rowspan="2">dddd</th>
+    </tr>
+    <tr id="tr2">
+      <th id="c1">eeee</th>
+      <th id="c2">ffff</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr  id="tr3">
+      <td>1111</td>
+      <td>2222</td>
+      <td id="c3">3333</td>
+      <td id="c4">4444</td>
+      <td>5555</td>
+    </tr>
+  </tbody>
+</table>
+
+</body>
+</html>