Created attachment 34935 [details] Six-line minimal test case Tested on Chrome 3.0.198.1 (Official Build 23116) on Linux, and some version of Chrome or other on Windows. about:version reports WebKit 532.0. I'm assuming this is a WebKit bug; if people using Safari can't reproduce, I'll file a bug with Chrome. A six-line test case is attached. The text "I'm running in!" should display at the beginning of the next line. Instead, it just doesn't appear. This only seems to occur when 1) run-in actually occurs (removing the third div causes it to display), and 2) the run-in box is inside a list-item. Opera works as expected.
The marker is put inside the run-in since it begins life as a block. When the run-in morphs to become an inline, we only pick up one child from the block. This is because the loop is buggy in handleRunInChild... it needs to cache nextSibling before advancing. However markers aren't supposed to end up inside inline children. The final marker placement should actually be inside the block that the inline runs in to. getParentOfFirstLineBox could be modified to skip run-ins that are going to successfully run in, but then the run-in code has to make sure that children are added after pre-existing markers. (I think it needs to do this anyway, in the case where the block you run into is a list-item itself). Basically there are a bunch of bugs here.
Steps to reproduce from comment #0 failed to reproduce the bug in Chrome 22 dev. Seems to have been fixed somewhere along the way.