1 files changed, 31 insertions, 0 deletions
diff --git a/layout/tables/crashtests/430374.html b/layout/tables/crashtests/430374.html
new file mode 100644
index 0000000000..de3a4af53b
--- /dev/null
+++ b/layout/tables/crashtests/430374.html
@@ -0,0 +1,31 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var odiv = document.createElement("div");
+  odiv.style.height = "30px";
+  var idiv = document.createElement("div");
+  idiv.style.columnWidth = "1px";
+  var table = document.createElement("TABLE");
+  var x = document.createTextNode("x");
+  table.appendChild(x);
+  var tr = document.createElement("TR");
+  var td = document.createElement("TD");
+  tr.appendChild(td);
+  table.appendChild(tr);
+  idiv.appendChild(table);
+  odiv.appendChild(idiv);
+  document.body.appendChild(odiv);
+  
+  document.body.offsetHeight;
+  
+  td.style.fontFamily = "X";
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>