Move runin to original position when sibling element is destroyed. Additionally, if If moveRunInUnd…

Source/core/rendering/RenderBlock.cpp

Index: Source/core/rendering/RenderBlock.cpp
diff --git a/Source/core/rendering/RenderBlock.cpp b/Source/core/rendering/RenderBlock.cpp
index ae65a0665341d0cc668d8592562733d56a189ed1..52206ff1a07158c31a8034f8a2beb5899fd99219 100644
--- a/Source/core/rendering/RenderBlock.cpp
+++ b/Source/core/rendering/RenderBlock.cpp
@@ -279,6 +279,16 @@ void RenderBlock::willBeDestroyed()
     // Mark as being destroyed to avoid trouble with merges in removeChild().
     m_beingDestroyed = true;
 
+    if (!documentBeingDestroyed()) {
+        if (firstChild() && firstChild()->isRunIn()) {
+            // If we are moving inline children(run-in) from |this| to |parent|, then we need
+            // to clear our line box tree.
+            if (childrenInline())
+                deleteLineBoxTree();
+            moveRunInToOriginalPosition(firstChild());
+        }
+    }
+
     // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
     // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise.
     children()->destroyLeftoverChildren();
@@ -1981,6 +1991,9 @@ void RenderBlock::moveRunInUnderSiblingBlockIfNeeded(RenderObject* runIn)
     if (!curr || !curr->isRenderBlock() || !curr->childrenInline())
         return;
 
+    if (toRenderBlock(curr)->beingDestroyed())
+        return;
+
     // Per CSS3, "A run-in cannot run in to a block that already starts with a
     // run-in or that itself is a run-in".
     if (curr->isRunIn() || (curr->firstChild() && curr->firstChild()->isRunIn()))