<!DOCTYPE html>
<html>
<head>
<title>This tests that we don't mutate the render tree during selection.</title>
<style>
  body {
    column-count: 2;
  }
</style>
<script>
  if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
  }
  
  function runTest() {
    setTimeout(function() {
      li.style.webkitWritingMode = "horizontal-tb";
      innerSpan.style.display = "list-item";
      mostInnerSpan.style.display = "list-item";
      document.getSelection().setBaseAndExtent(container, 0, document.body, document.body.childNodes.length);
      if (window.testRunner)
        testRunner.notifyDone();
    }, 0);
  }
</script>
</head>
<body onload=runTest()>
Pass if no crash or assert.
<div id="container" style="-webkit-writing-mode: vertical-rl"><table><tr><td><li id="li"><span id="innerSpan"><span id="mostInnerSpan"></span></span></li></tr></td></table>
</body>
</html>