Merge 100677

LayoutTests/fast/css-generated-content/positioned-generated-content-under-run-in-crash.html

 <style>
 .testclass::before { position: absolute; content: ""; }
 .testclass { display: run-in; }
 </style>
 PASS, if no exceptions or crash observed
 <script>
 function runTest() 
 {
     test1 = document.createElement('div');
     test1.setAttribute('class', 'testclass');
     document.documentElement.appendChild(test1);
     test2 = document.createElement('b');
     test2.setAttribute('class', 'testclass');
     document.documentElement.appendChild(test2);
     test3 = document.createElement('div');
     document.documentElement.appendChild(test3);
     if (window.layoutTestController)
         layoutTestController.dumpAsText();
 }
 window.onload = runTest;
 </script>