<p>This tests for a crash when trying to switch the list type of an inner list at the end. You shouldn't get a crash. This test used to flatten the list but this behavior was correct to match Firefox and MSIE in the bug 43166.</p>
<div id="div" contenteditable="true"><ol><li>One</li><li>Two</li><ul><li>Three</li><li>Four</li></div>
<p id="console"></p>

<script>

if (window.testRunner)
    testRunner.dumpAsText();

function log(message) {
    var console = document.getElementById("console");
    var text = document.createTextNode(message);
    console.appendChild(text);
}

var div = document.getElementById("div");
div.focus();
document.execCommand("SelectAll");
document.execCommand("InsertUnorderedList");

log(div.innerHTML);

</script>

PASS