FindPlaceForCounter (in layout_counter.cc) causes stack overflows because it's recursive in the sibling direction. We should consider rewriting it to make it harder to hit that stack limit.

Case from fuzzer which shows the recursiveness for 2000 added siblings:

<p>
  </p>
  <script>
            function __f_0() {
                var __v_1 = document.createElement("div");
                return __v_1;
            }
            for (var __v_0 = 0; __v_0 < 2000; ++__v_0)
                document.body.appendChild(__f_0());
</script>
  <style>
  div { counter-reset: c }
  #two:before { content: counter(c) }
  </style>
   <span id="two">