Save the insertion point before beforeload events
Created attachment 59346 [details] Patch
Comment on attachment 59346 [details] Patch HTML5 talks about needing to save the insertion point at the start of runScript and then restore at the end, whch would cover this case. This may end up restoring "too early" but I'm not sure what that would mean (if anything). In either case, this brings us closer to correct behavior.
Committed r61604: <http://trac.webkit.org/changeset/61604>