Avoid unnecessary descents into nested boxes with floats.

LayoutTests/fast/block/float/float-mark-descendants-for-layout-crash-2.html

Index: LayoutTests/fast/block/float/float-mark-descendants-for-layout-crash-2.html
diff --git a/LayoutTests/fast/block/float/float-mark-descendants-for-layout-crash-2.html b/LayoutTests/fast/block/float/float-mark-descendants-for-layout-crash-2.html
new file mode 100644
index 0000000000000000000000000000000000000000..b0a8446327365440dbc3322d73eabe38b829bb0b
--- /dev/null
+++ b/LayoutTests/fast/block/float/float-mark-descendants-for-layout-crash-2.html
@@ -0,0 +1,22 @@
+<style>
+.c8 { display: -webkit-inline-flexbox; float: left; }
+.c8:nth-last-of-type(2n+1) { vertical-align: bottom; height: 65536px; }
+</style>
+<script>
+var nodes = Array();
+function boom() {
+    try { nodes[0] = document.createElement('em'); } catch(e) {}
+    try { nodes[8] = document.createElement('mark'); } catch(e) {}
+    try { nodes[8].setAttribute('class', 'c8'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[8]); } catch(e) {}
+    try { nodes[63] = document.createElement('blockquote'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[63]); } catch(e) {}
+    try { nodes[66] = document.createElement('i'); } catch(e) {}
+    try { nodes[66].setAttribute('class', 'c8'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[66]); } catch(e) {}
+    setTimeout("try { nodes[8].setAttribute('class', 'c10'); } catch(e) {}", 148);
+    setTimeout('try { nodes[0].appendChild(nodes[66]); } catch(e) {}', 212);
+}
+window.onload = boom;
+</script>
+