Merge 117865

Source/WebCore/rendering/RenderObjectChildList.cpp

Index: Source/WebCore/rendering/RenderObjectChildList.cpp
===================================================================
--- Source/WebCore/rendering/RenderObjectChildList.cpp	(revision 118863)
+++ Source/WebCore/rendering/RenderObjectChildList.cpp	(working copy)
@@ -397,7 +397,7 @@
     }
 }
 
-static RenderObject* createRenderForBeforeAfterContent(RenderObject* owner, const ContentData* content, RenderStyle* pseudoElementStyle)
+static RenderObject* createRendererForBeforeAfterContent(RenderObject* owner, const ContentData* content, RenderStyle* pseudoElementStyle)
 {
     RenderObject* renderer = 0;
     switch (content->type()) {
@@ -514,13 +514,18 @@
         insertBefore = insertBefore->firstChild();
     }
 
+    // Nothing goes before the intruded run-in, not even generated content.
+    if (insertBefore && insertBefore->isRunIn() && owner->isRenderBlock()
+        && toRenderBlock(owner)->runInIsPlacedIntoSiblingBlock(insertBefore))
+        insertBefore = insertBefore->nextSibling();
+
     // Generated content consists of a single container that houses multiple children (specified
     // by the content property).  This generated content container gets the pseudo-element style set on it.
     RenderObject* generatedContentContainer = 0;
 
     // Walk our list of generated content and create render objects for each.
     for (const ContentData* content = pseudoElementStyle->contentData(); content; content = content->next()) {
-        RenderObject* renderer =  createRenderForBeforeAfterContent(owner, content, pseudoElementStyle);
+        RenderObject* renderer =  createRendererForBeforeAfterContent(owner, content, pseudoElementStyle);
 
         if (renderer) {
             if (!generatedContentContainer) {
@@ -552,6 +557,14 @@
                 renderer->destroy();
         }
     }
+
+    if (!generatedContentContainer)
+        return;
+
+    // Handle placement of run-ins. We do the run-in placement at the end since generatedContentContainer can get destroyed.
+    RenderObject* generatedContentContainerImmediateParent = generatedContentContainer->parent();
+    if (generatedContentContainerImmediateParent->isRenderBlock())
+        toRenderBlock(generatedContentContainerImmediateParent)->placeRunInIfNeeded(generatedContentContainer, PlaceGeneratedRunIn);
 }
 
 } // namespace WebCore