Avoid anchoring to pseudo elements when using logical ordering in a selection

LayoutTests/fast/css-generated-content/crash-selection-editing-removes-pseudo.html

Index: LayoutTests/fast/css-generated-content/crash-selection-editing-removes-pseudo.html
diff --git a/LayoutTests/fast/css-generated-content/crash-selection-editing-removes-pseudo.html b/LayoutTests/fast/css-generated-content/crash-selection-editing-removes-pseudo.html
index 2325abc680c32a30b55e35457a79b36c6fb530a0..18e3374f396e969e1d29e421a017fdc5f7e479db 100644
--- a/LayoutTests/fast/css-generated-content/crash-selection-editing-removes-pseudo.html
+++ b/LayoutTests/fast/css-generated-content/crash-selection-editing-removes-pseudo.html
@@ -6,10 +6,15 @@
         display: inline-block;
         content: 'before';
     }
+    #start:after {
+        /* must be an inline-block */
+        display: inline-block;
+        content: 'after';
+    }
 </style>
 
 
-<p>Passes if it doesn't crash and the pseudo exists.</p>
+<p>Passes if it doesn't crash.</p>
 
 <div id="test">
     <span id="before"><!-- no content can be here --></span>
@@ -22,17 +27,18 @@ if (window.testRunner)
     testRunner.dumpAsText();
 
 var before = document.getElementById('before');
+var start = document.getElementById('start');
 var test = document.getElementById('test');
 
 // Select from the #start backwards to the start of the line.
 window.getSelection().setBaseAndExtent(document.getElementById('start'));
 window.getSelection().modify('extend', 'backward', 'lineBoundary')
 
-// Replace the selection with a break. This apparently puts two <br>'s before
-// the #before and removes the span with "text" and the #start.
+// Replace the selection with a break. This replaces #before, text,
+// #start with two <br>'s.
 document.designMode = 'on';
 document.execCommand('InsertLineBreak');
 
 // Crash during tear down.
-test.innerHTML = "Pseudo still exists: " + (before.offsetHeight > 0);
+test.innerHTML = "Both pseudos have been removed: " + (before.offsetHeight == 0 && start.offsetHeight == 0);
 </script>