Don't delete nodes in the float interval tree while traversing it.

Source/core/rendering/shapes/ShapeOutsideInfo.cpp

 /*
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 124 matching lines @@
     RefPtr<Image> image = styleImage->image(const_cast<RenderBox*>(&m_renderer), imageSize);
 
     return Shape::createRasterShape(image.get(), shapeImageThreshold, imageRect, marginRect, writingMode, margin);
 }
 
 const Shape& ShapeOutsideInfo::computedShape() const
 {
     if (Shape* shape = m_shape.get())
         return *shape;
 
+    m_computingShape = true;

[Julien - ping for review, 2014/10/08 18:13:27]

TemporaryChange<bool> isInComputingShape(m_computingShape, true);

     const RenderStyle& style = *m_renderer.style();
     ASSERT(m_renderer.containingBlock());
     const RenderStyle& containingBlockStyle = *m_renderer.containingBlock()->style();
 
     WritingMode writingMode = containingBlockStyle.writingMode();
     LayoutUnit maximumValue = m_renderer.containingBlock() ? m_renderer.containingBlock()->contentWidth() : LayoutUnit();
     float margin = floatValueForLength(m_renderer.style()->shapeMargin(), maximumValue.toFloat());
 
     float shapeImageThreshold = style.shapeImageThreshold();
     ASSERT(style.shapeOutside());
     const ShapeValue& shapeValue = *style.shapeOutside();
 
     switch (shapeValue.type()) {
     case ShapeValue::Shape:
         ASSERT(shapeValue.shape());
         m_shape = Shape::createShape(shapeValue.shape(), m_referenceBoxLogicalSize, writingMode, margin);
         break;
     case ShapeValue::Image:
         ASSERT(shapeValue.isImageValid());
         m_shape = createShapeForImage(shapeValue.image(), shapeImageThreshold, writingMode, margin);
         break;
     case ShapeValue::Box: {
         const RoundedRect& shapeRect = style.getRoundedBorderFor(LayoutRect(LayoutPoint(), m_referenceBoxLogicalSize), m_renderer.view());
         m_shape = Shape::createLayoutBoxShape(shapeRect, writingMode, margin);
         break;
     }
     }
 
+    m_computingShape = false;
     ASSERT(m_shape);
     return *m_shape;
 }
 
 inline LayoutUnit borderBeforeInWritingMode(const RenderBox& renderer, WritingMode writingMode)
 {
     switch (writingMode) {
     case TopToBottomWritingMode: return renderer.borderTop();
     case BottomToTopWritingMode: return renderer.borderBottom();
     case LeftToRightWritingMode: return renderer.borderLeft();
@@ skipping 156 matching lines @@
 }
 
 FloatSize ShapeOutsideInfo::shapeToRendererSize(FloatSize size) const
 {
     if (!m_renderer.style()->isHorizontalWritingMode())
         return size.transposedSize();
     return size;
 }
 
 } // namespace blink