Track intruding and overhanging floats

Track intruding and overhanging floats

Keep track of which floats in the floating object list are intruding or
overhanging so that they can be removed from the list before the
container is and it's children are destoryed. This makes it impossible
to access an already destroyed float renderer when detaching the tree.

In addition, use the new knowledge about intruding and overhanging
floats to only copy the FloatingObject entries for contained floats in
moveAllChildrenIncludingFloatsTo.

This also fixes a bug in FloatingObject::unsafeClone, it shouldn't copy
the originatingLine, because that allows breaking the rule that the
renderer for the line must be the same as the renderer that contains the
FloatingObject instance.

BUG=245727
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=165002

[Bem Jones-Bey (adobe), 2014-01-12 06:17:02]

This seems to have a very small perf impact, but also fixes the issue with
intruding and overhanging floats.

[leviw_travelin_and_unemployed, 2014-01-13 19:35:26]

LGTM!

[commit-bot: I haz the power, 2014-01-13 19:41:51]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/bjonesbe@adobe.com/131223003/80001

[commit-bot: I haz the power, 2014-01-13 21:12:48]

Change committed as 165002