diff --git a/layout/tables/crashtests/423514-1.xhtml b/layout/tables/crashtests/423514-1.xhtml
new file mode 100644
index 000000000000..b6e3876ded59
--- /dev/null
+++ b/layout/tables/crashtests/423514-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+window.addEventListener("load", boom, false);
+
+function boom()
+{
+  var d = document.getElementById("d");
+
+  var c = document.createElement("td");
+  c.setAttribute("rowspan", 2);
+  d.parentNode.insertBefore(c, d);
+
+  document.getElementById("d").focus();
+  
+  // Wait long enough for the caret to blink at least once.
+  setTimeout(done, 1200);
+}
+
+function done()
+{
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<!-- no <body>, intentionally -->
+
+<div dir="rtl"></div>
+
+<table><tr contenteditable="true" id="d"><td></td></tr></table>
+
+</html>
diff --git a/layout/tables/crashtests/crashtests.list b/layout/tables/crashtests/crashtests.list
index e74297362c38..c794be294a63 100644
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -45,3 +45,4 @@ load 403579-1.html
 load 404301-1.xhtml
 load 411582.xhtml
 load 413180-1.html
+load 423514-1.xhtml
