1 files changed, 35 insertions, 0 deletions
diff --git a/layout/tables/crashtests/308752-2-inner.html b/layout/tables/crashtests/308752-2-inner.html
new file mode 100644
index 0000000000..8ad3b51986
--- /dev/null
+++ b/layout/tables/crashtests/308752-2-inner.html
@@ -0,0 +1,35 @@
+<html>
+<head>
+<script>
+function init2() {
+var one = document.getElementById('one');
+var four = document.getElementById('two');
+document.getElementsByTagName('table')[0].appendChild(one);
+setTimeout('clickit()', 0);
+}
+
+function doe(){
+two.remove();
+}
+function clickit()
+{
+  var evt = document.createEvent("MouseEvents");
+  evt.initMouseEvent("click", true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);
+  document.body.dispatchEvent(evt);
+}
+window.addEventListener("load", init2);
+window.addEventListener("click", doe);
+</script>
+</head>
+<body>
+<table style="border-collapse: collapse;">
+ <tbody>
+  <tr><td rowspan="2">r11</td></tr>
+  <tr id="one"><td id="two">r21</td></tr>
+  <tr></tr>
+ </tbody>
+</table>
+Mozilla should not crash when clicking in the document
+</body>
+</html>
+