diff --git a/selection/crashtests/table.html b/selection/crashtests/table.html
new file mode 100644
index 000000000000000..36eb803a5cbbe6b
--- /dev/null
+++ b/selection/crashtests/table.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script>
+  function go() {
+    let b = window.getSelection();
+    b.setPosition(a.insertRow(0), 0)
+    b.modify("extend", "right", "word")
+  }
+</script>
+
+<body onload=go()>
+  <dd dir="rtl">M!}\\)M6\X</dd>
+  <table id="a">
+    <tr>
