Fix incorrectly positioned block element inside list-style-position:inside item

third_party/WebKit/Source/core/layout/LayoutListItem.cpp

 /**
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 281 matching lines @@
     while (result && result->isListMarker())
         result = result->nextSibling();
     return result;
 }
 
 bool LayoutListItem::updateMarkerLocation()
 {
     ASSERT(m_marker);
 
     LayoutObject* markerParent = m_marker->parent();
-    LayoutObject* lineBoxParent = getParentOfFirstLineBox(this, m_marker);
+    // list-style-position:inside makes the ::marker pseudo an ordinary position:static element that should be attached to LayoutListItem block.
+    LayoutObject* lineBoxParent = m_marker->isInside() ? this : getParentOfFirstLineBox(this, m_marker);
     if (!lineBoxParent) {
         // If the marker is currently contained inside an anonymous box, then we
         // are the only item in that anonymous box (since no line box parent was
         // found). It's ok to just leave the marker where it is in this case.
         if (markerParent && markerParent->isAnonymousBlock())
             lineBoxParent = markerParent;
         else
             lineBoxParent = this;
     }
 
@@ skipping 195 matching lines @@
             // assume that all the following ones have too.
             // This gives us the opportunity to stop here and avoid
             // marking the same nodes again.
             break;
         }
         item->updateValue();
     }
 }
 
 } // namespace blink