--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -112,17 +112,17 @@ load 444431-1.html
 load 444702-1.html
 load 448988-1.xhtml
 load 450311-1.html
 load 451170.html
 load 451355-1.html
 load 456041.html
 load 457115.html
 load 460637-1.xhtml
-asserts(1) load 460637-2.xhtml # bug 1389295
+load 460637-2.xhtml
 load 460637-3.xhtml
 load 462849.xhtml
 load 467141-1.html
 load 488388-1.html
 load 501870-1.html
 load 509562-1.xhtml
 load 512749-1.html
 load 513732-1.html

--- a/layout/tables/nsCellMap.cpp
+++ b/layout/tables/nsCellMap.cpp
@@ -1486,18 +1486,18 @@ nsCellMap::AppendCell(nsTableCellMap&   
     if (!origData) ABORT1(origData);
     SetDataAt(aMap, *origData, aRowIndex, startColIndex);
   }
 
   if (aRebuildIfNecessary) {
     //the caller depends on the damageArea
     // The special case for zeroRowSpan is to adjust for the '2' in
     // GetRowSpanForNewCell.
-    uint32_t height = zeroRowSpan ? endRowIndex - aRowIndex  :
-                                    1 + endRowIndex - aRowIndex;
+    uint32_t height = std::min(zeroRowSpan ? rowSpan - 1 : rowSpan,
+                               GetRowCount() - aRowIndex);
     SetDamageArea(startColIndex, aRgFirstRowIndex + aRowIndex,
                   1 + endColIndex - startColIndex, height, aDamageArea);
   }
 
   if (!aCellFrame) {
     return origData;
   }