diff --git a/components/layout/table_row.rs b/components/layout/table_row.rs
index a332bc668ac..933d3be632e 100644
--- a/components/layout/table_row.rs
+++ b/components/layout/table_row.rs
@@ -123,7 +123,16 @@ impl TableRowFlow {
                 if *span == 1 {
                     break;
                 }
-                let incoming = incoming_rowspan_data[*col];
+                let incoming = if let Some(incoming) = incoming_rowspan_data.get(*col) {
+                    *incoming
+                } else {
+                    // This happens when we have a cell with both rowspan and colspan
+                    // incoming_rowspan_data only records the data for the first column,
+                    // but that's ok because we only need to account for each spanning cell
+                    // once. So we skip ahead.
+                    *col += 1;
+                    continue;
+                };
                 *max_block_size = max(*max_block_size, incoming);
                 *col += 1;
             }
diff --git a/tests/wpt/mozilla/meta/MANIFEST.json b/tests/wpt/mozilla/meta/MANIFEST.json
index f8e62ba7282..c8778734319 100644
--- a/tests/wpt/mozilla/meta/MANIFEST.json
+++ b/tests/wpt/mozilla/meta/MANIFEST.json
@@ -39144,6 +39144,12 @@
      {}
     ]
    ],
+   "mozilla/table_rowspan_colspan_crashtest.html": [
+    [
+     "/_mozilla/mozilla/table_rowspan_colspan_crashtest.html",
+     {}
+    ]
+   ],
    "mozilla/textcontent.html": [
     [
      "/_mozilla/mozilla/textcontent.html",
@@ -70765,6 +70771,10 @@
    "f43703402d539a05a55990cd2a03c50eabea122b",
    "support"
   ],
+  "mozilla/table_rowspan_colspan_crashtest.html": [
+   "6890b7ec8b29dd5fb02c8e93035728f2b5bf8668",
+   "testharness"
+  ],
   "mozilla/table_valign_bottom.html": [
    "43814fb9c385f2501ff88673acf4b58079670015",
    "reftest"
diff --git a/tests/wpt/mozilla/tests/mozilla/table_rowspan_colspan_crashtest.html b/tests/wpt/mozilla/tests/mozilla/table_rowspan_colspan_crashtest.html
new file mode 100644
index 00000000000..05c16a5d905
--- /dev/null
+++ b/tests/wpt/mozilla/tests/mozilla/table_rowspan_colspan_crashtest.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<title></title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+var load_test = async_test("Doesn't crash");
+</script>
+</head>
+<body onload="load_test.done()">
+<!-- Shouldn't crash (#20162) -->
+<table border>
+    <tr><td>a</td><td>b</td><td>c</td><td>d</td></tr>
+    <tr><td rowspan=2>a</td><td>b</td><td colspan=2 rowspan=2>cd</td>  </tr>
+    <tr>                    <td>b</td></tr>
+    <tr><td>a</td><td>b</td><td>c</td><td>d</td></tr>
+
+</table>
+</body>
+</html>
