KEYGEN elements should always create LayoutBlockFlow, regardless of display type.

Source/core/html/HTMLKeygenElement.cpp

Index: Source/core/html/HTMLKeygenElement.cpp
diff --git a/Source/core/html/HTMLKeygenElement.cpp b/Source/core/html/HTMLKeygenElement.cpp
index fd60c60163468de51563628f59f9cebe114b1bbb..e1264d677b329f17afffd80fd51abee8dba69578 100644
--- a/Source/core/html/HTMLKeygenElement.cpp
+++ b/Source/core/html/HTMLKeygenElement.cpp
@@ -33,6 +33,7 @@
 #include "core/html/FormDataList.h"
 #include "core/html/HTMLOptionElement.h"
 #include "core/html/HTMLSelectElement.h"
+#include "core/layout/LayoutBlockFlow.h"
 #include "platform/text/PlatformLocale.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebLocalizedString.h"
@@ -56,6 +57,11 @@ PassRefPtrWillBeRawPtr<HTMLKeygenElement> HTMLKeygenElement::create(Document& do
     return keygen.release();
 }
 
+LayoutObject* HTMLKeygenElement::createLayoutObject(const LayoutStyle& style)
+{
+    return new LayoutBlockFlow(this);

[Julien - ping for review, 2015/03/23 15:16:51]

We have this pattern around the code but it's making us effectively disable
'display' on the element. This confuses webauthors (see e.g.
https://code.google.com/p/chromium/issues/detail?id=335040), however I think
that's fine with a TODO + general bug about this pattern.

[mstensho (USE GERRIT), 2015/03/23 22:46:46]

Done.

+}
+
 void HTMLKeygenElement::didAddClosedShadowRoot(ShadowRoot& root)
 {
     DEFINE_STATIC_LOCAL(AtomicString, keygenSelectPseudoId, ("-webkit-keygen-select", AtomicString::ConstructFromLiteral));