<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
    // Insert "body" element into "div" element. Simple repetition of "body"
    // element or renaming "body" to "div" doesn't reproduce bug.
    var targetNode = document.getElementById('target');
    targetNode.appendChild(document.body.cloneNode(true));

    document.designMode = 'on';
    document.execCommand('SelectAll');
    document.execCommand('JustifyRight');
    document.body.textContent = 'PASS if Blink doesn\'t crash.';
};
</script>
</head>
<body>
<textarea></textarea>
<span></span>
<div id="target" style="display:inline-table">foo</div>
</body>
</html>