Never position a float after it has been placed.

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 3619 matching lines @@
 
     if (width)
       width->shrinkAvailableWidthForNewFloatIfNeeded(floatingObject);
   }
   return true;
 }
 
 LayoutUnit LayoutBlockFlow::positionAndLayoutFloat(
     FloatingObject& floatingObject,
     LayoutUnit logicalTopMarginEdge) {
+  // Once a float has been placed, we cannot update its position, or the float
+  // interval tree will be out of sync with reality. This may in turn lead to
+  // objects being used after they have been deleted.
+  CHECK(!floatingObject.isPlaced());
+
   LayoutBox& child = *floatingObject.layoutObject();
 
   // FIXME Investigate if this can be removed. crbug.com/370006
   child.setMayNeedPaintInvalidation();
 
   logicalTopMarginEdge = std::max(
       logicalTopMarginEdge, lowestFloatLogicalBottom(child.style()->clear()));
 
   bool isPaginated = view()->layoutState()->isPaginated();
   if (isPaginated && !childrenInline()) {
@@ skipping 914 matching lines @@
   return LayoutBlock::invalidatePaintIfNeeded(paintInvalidationState);
 }
 
 void LayoutBlockFlow::invalidateDisplayItemClients(
     PaintInvalidationReason invalidationReason) const {
   BlockFlowPaintInvalidator(*this).invalidateDisplayItemClients(
       invalidationReason);
 }
 
 }  // namespace blink