<p id="p">This tests for a bug where a creating a list from a particular selection inside a table would create list items beyond the end of the selection.  Only the second two table cells should contain list items.</p>
<div id="div" contenteditable="true"><table border="1"><tr><td>foo</td><td id="td">bar</td><td>baz</td></tr></table><div>foo</div><div>bar</div></div>

<script>
div = document.getElementById("div");
td = document.getElementById("td");
window.getSelection().setBaseAndExtent(td, 0, div, 1);
document.execCommand("InsertUnorderedList");

if (window.testRunner) {
    window.testRunner.dumpAsText();
    div = document.getElementById("div");
    p = document.getElementById("p");
    document.body.innerText = p.innerText + "\n\nDOM:\n" + div.innerHTML;
}
</script>