5 files changed, 28 insertions, 70 deletions
diff --git a/layout/tables/crashtests/1555757-1.html b/layout/tables/crashtests/1555757-1.html
deleted file mode 100644
index 04f2b27a60..0000000000
--- a/layout/tables/crashtests/1555757-1.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<html>
-<head>
-    <style>
-        .class_1 {
-            transition-delay: 2129ms;
-            contain: strict;
-        }
-    </style>
-</head>
-<math>
-    <mover>
-        <ms></ms>
-        <mtable class="class_1"></mtable>
-    </mover>
-</math>
-</html>
diff --git a/layout/tables/crashtests/1555757-2.html b/layout/tables/crashtests/1555757-2.html
deleted file mode 100644
index eff048784a..0000000000
--- a/layout/tables/crashtests/1555757-2.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <style>
-    #testElem {
-        border: 1px solid black;
-        background: yellow;
-        contain: layout size;
-        width: 300px;
-    }
-  </style>
-  <script>
-    function go() {
-        /* trigger an incremental reflow.
-         * Note: elem.style is undefined for MathML elements, so we have
-         * to use setAttribute().
-         */
-        testElem.setAttribute("style", "width:150px");
-    }
-  </script>
-</head>
-<body onload="go()">
-  <math>
-    <mtable id="testElem">Change my size</mtable>
-  </math>
-</body>
-</html>
diff --git a/layout/tables/crashtests/1881157.html b/layout/tables/crashtests/1881157.html
new file mode 100644
index 0000000000..d9beb64429
--- /dev/null
+++ b/layout/tables/crashtests/1881157.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<style>
+#a {
+  min-height: 1vw;
+  line-height: 0vw;
+}
+#b {
+  scale: 0.67976 1 1;
+}
+:root {
+  column-width: 1em;
+}
+</style>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  b.appendChild(a)
+  document.execCommand("fontSize", false, 5)
+  b.style.setProperty("border-top-style", "dotted")
+})
+function func_0() {
+  b.rules = "cols"
+}
+</script>
+<dialog id="a" open="true">,&#x27;/,_J</dialog>
+<table id="b">
+<details open="true" ontoggle="func_0()">
diff --git a/layout/tables/crashtests/347506-1.xhtml b/layout/tables/crashtests/347506-1.xhtml
deleted file mode 100644
index 4119389a56..0000000000
--- a/layout/tables/crashtests/347506-1.xhtml
+++ /dev/null
@@ -1,23 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-
-<body>
-
-<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
-
-  <mtable>
-    <mtr>
-       <mtd><mi>x</mi></mtd>
-       <mtd rowspan="4" columnspan="4"><mi>y</mi></mtd>
-    </mtr>
-    <mtr>
-       <mtd rowspan="0" columnspan="0"><mi>z</mi></mtd>
-       <mtd><mi>w</mi></mtd>
-    </mtr>
-  </mtable>
-
-
-</math></div>
-
-</body>
-
-</html>
-\ No newline at end of file
diff --git a/layout/tables/crashtests/crashtests.list b/layout/tables/crashtests/crashtests.list
index 92bca235e3..58bdad5c78 100644
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -45,7 +45,6 @@ load 343087-1.html
 load 343588-1.xhtml
 load 344000-1.html
 load 347367.html
-load 347506-1.xhtml
 load 347506-2.xhtml
 load 347725-1.xhtml
 load 348977-1.xhtml
@@ -140,7 +139,7 @@ load 580481-1.xhtml
 asserts(1) load 595758-1.xhtml # Bug 714667
 load 595758-2.xhtml
 load 678447-1.html
-skip-if(Android&&browserIsRemote) load 691824-1.xhtml # bug 1507207
+skip-if(Android) load 691824-1.xhtml # bug 1507207
 load 695430-1.html
 load 696640-1.html
 load 696640-2.html
@@ -167,8 +166,6 @@ load 1232881-1.html
 load 1243623-1.html
 load 1335552-1.html
 load 1335552-2.html
-load 1555757-1.html
-load 1555757-2.html
 load 1555757-3.html
 load 1555757-4.html
 load 1607045.html
@@ -180,3 +177,4 @@ load 1767364-4.html
 load 1795030.html
 load 1795051.html
 load 1821177.html
+asserts(0-2) load 1881157.html # bug 1884058