LayoutTests/editing/execCommand/5543472-2.html

<p id="p">This tests for a bug when performing the list operation on a selection that starts just before a list and ends inside the list.  This should only create list items in selected cells.</p>
<div id="div" contenteditable="true"><table border="1"><tr><td>foo</td><td id="td">bar</td><td>baz</td></tr></table></div>

<script>
div = document.getElementById("div");
td = document.getElementById("td");
window.getSelection().setBaseAndExtent(div, 0, td, td.childNodes.length);
document.execCommand("InsertUnorderedList");

if (window.testRunner) {
    window.testRunner.dumpAsText();
    div = document.getElementById("div");
    p = document.getElementById("p");
    document.body.innerText = p.innerText + "\n\nDOM:\n" + div.innerHTML;
}
</script>