<html>
<style>
td {
counter-increment: list-item;
}
</style>
<script>
if (window.testRunner) {
testRunner.waitUntilDone();
}
function crash() {
document.body.innerHTML = "PASS: Malformed table counters do not cause crash";
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.notifyDone();
}
}
</script>
<body onload="crash()">
<table>
<tbody>
<td>
</tbody>
<ol>re-parent me</ol>
<ol>re-parent me</ol>
</td>
<td></td>
</table>
</body>
</html>