Consider merging https://chromium.googlesource.com/chromium/blink/+/cb5552c1c914de3c57d21256245219db73234e48 RenderListItem::updateMarkerLocation can move a list marker from one block to another, but it simply called remove without dirtying the line boxes it may have been in. When the marker is being moved to another block, specifically call dirtyLinesFromChangedChild to avoid this.
I think this is already renamed: https://github.com/WebKit/WebKit/blob/835b3f86b66bb2f7c66045c353a458a60d43800f/Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp#L110