diff --git a/layout/tables/crashtests/358679-1.xhtml b/layout/tables/crashtests/358679-1.xhtml
new file mode 100644
index 00000000000..ef3e40b4bbf
--- /dev/null
+++ b/layout/tables/crashtests/358679-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+function foo() { 
+  var cell2 = document.createElementNS("http://www.w3.org/1999/xhtml", "td"); 
+  cell2.appendChild(document.createTextNode('2'));
+
+  document.getElementById("row2").appendChild(cell2);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(foo, 30);">
+
+<table border="1">
+  <tr>
+    <td>A</td>
+    <td>B</td>
+  </tr>
+  <tr id="row2">
+    <td colspan="0">1</td>
+  </tr>
+</table>
+
+
+</body>
+</html>
diff --git a/layout/tables/crashtests/358871-1.xhtml b/layout/tables/crashtests/358871-1.xhtml
new file mode 100644
index 00000000000..1964032e7b6
--- /dev/null
+++ b/layout/tables/crashtests/358871-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<table border="1">
+  <tbody>
+    <tr>
+      <td>A</td>
+      <td rowspan="3" colspan="0">B</td>
+    </tr>
+    <tr>
+      <td colspan="2">C</td>
+      <td>D</td>
+    </tr>
+  </tbody>
+</table>
+
+
+</body>
+</html>
diff --git a/layout/tables/crashtests/364512-1.html b/layout/tables/crashtests/364512-1.html
new file mode 100644
index 00000000000..3b8417e31fa
--- /dev/null
+++ b/layout/tables/crashtests/364512-1.html
@@ -0,0 +1,20 @@
+<html>
+<body>
+
+<table border="1">
+  <tbody style="overflow: hidden;">
+    <tr>
+      <td>
+        Foo
+      </td>
+    </tr>
+    <tr> 
+      <td>
+        <p style="height: 200%;">Bar</p>
+      </td>
+    </tr>
+  </tbody>
+</table>
+
+</body>
+</html>
diff --git a/layout/tables/crashtests/367673-1.xhtml b/layout/tables/crashtests/367673-1.xhtml
new file mode 100644
index 00000000000..e7fb6493e37
--- /dev/null
+++ b/layout/tables/crashtests/367673-1.xhtml
@@ -0,0 +1,38 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("wantstobeatable").style.display = "table";
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30)">
+
+<table width="100%" border="1">
+  <tr>
+    <td>
+      <table border="1" width="100%" style="table-layout: fixed;">
+        <tr>
+          <td>Foo</td>
+        </tr>
+      </table>
+    </td>
+    <td width="22">Bar</td>
+    <td id="wantstobeatable">
+      <table border="1" style="table-layout: fixed;">
+        <tr>
+          <td>Baz</td>
+        </tr>
+      </table>
+    </td>
+  </tr>
+</table>
+
+</body>
+
+</html>
diff --git a/layout/tables/crashtests/crashtests.list b/layout/tables/crashtests/crashtests.list
index d3cd74d9a38..2dcd11ae5f5 100644
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -9,6 +9,10 @@ load 347725-1.xhtml
 load 350524-1.xhtml
 load 351328-1.xhtml
 load 351628-1.xhtml
+load 358679-1.xhtml
+load 358871-1.xhtml
+load 364512-1.html
+load 367673-1.xhtml
 load 379687-1.html
 load 387051-1.html
 load 391898-1.html
