Track intruding and overhanging floats

LayoutTests/fast/block/float/float-selection-delete-crash.html

Index: LayoutTests/fast/block/float/float-selection-delete-crash.html
diff --git a/LayoutTests/fast/block/float/float-selection-delete-crash.html b/LayoutTests/fast/block/float/float-selection-delete-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..42d0139c6ed1acb3446d73e9f2e36ce8004012f6
--- /dev/null
+++ b/LayoutTests/fast/block/float/float-selection-delete-crash.html
@@ -0,0 +1,33 @@
+<style>
+    * {
+        float: left;
+    }
+    *:after {
+        content: url();
+        display: block;
+    }
+</style>
+<script>
+function domNodeRemovedFromDocumentHandler() {
+  document.removeEventListener("DOMNodeRemovedFromDocument", domNodeRemovedFromDocumentHandler, true);
+  var selection = window.getSelection();
+  selection.deleteFromDocument();
+  var range = selection.getRangeAt(81 % selection.rangeCount);
+  var elements = document.getElementsByTagName("*");
+  range.surroundContents(elements[1]);
+}
+document.addEventListener("DOMNodeRemovedFromDocument", domNodeRemovedFromDocumentHandler, true);
+window.onload = function() {
+  var selection = window.getSelection();
+  var body = document.getElementsByTagName("body")[0];
+  selection.collapse(body, 2);
+  selection.deleteFromDocument();
+};
+
+if (window.testRunner)
+    testRunner.dumpAsText();
+</script>
+PASS: This passes if it does not crash with an ASAN enabled build.
+<table>
+<caption>
+<col>