Don't delete nodes in the float interval tree while traversing it.

Source/core/rendering/RenderBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 1242 matching lines @@
 
     AllowPaintInvalidationScope scoper(frameView());
 
     if ((style()->borderImage().image() && style()->borderImage().image()->data() == image) ||
         (style()->maskBoxImage().image() && style()->maskBoxImage().image()->data() == image)) {
         setShouldDoFullPaintInvalidation(true);
         return;
     }
 
     ShapeValue* shapeOutsideValue = style()->shapeOutside();
-    if (!frameView()->isInPerformLayout() && isFloating() && shapeOutsideValue && shapeOutsideValue->image() && shapeOutsideValue->image()->data() == image) {
-        ShapeOutsideInfo::ensureInfo(*this).markShapeAsDirty();
-        markShapeOutsideDependentsForLayout();
+    if (isFloating() && shapeOutsideValue && shapeOutsideValue->image() && shapeOutsideValue->image()->data() == image) {
+        ShapeOutsideInfo& info = ShapeOutsideInfo::ensureInfo(*this);
+        if (!info.isComputingShape()) {
+            info.markShapeAsDirty();
+            markShapeOutsideDependentsForLayout();
+        }
     }
 
     if (!paintInvalidationLayerRectsForImage(image, style()->backgroundLayers(), true))
         paintInvalidationLayerRectsForImage(image, style()->maskLayers(), false);
 }
 
 bool RenderBox::paintInvalidationLayerRectsForImage(WrappedImagePtr image, const FillLayer& layers, bool drawingBackground)
 {
     for (const FillLayer* curLayer = &layers; curLayer; curLayer = curLayer->next()) {
         if (curLayer->image() && image == curLayer->image()->data() && curLayer->image()->canRender(*this, style()->effectiveZoom())) {
@@ skipping 3233 matching lines @@
     ASSERT(style()->hasBackground() || style()->hasBoxDecorations());
 
     if (m_rareData && m_rareData->m_previousBorderBoxSize.width() != -1)
         return m_rareData->m_previousBorderBoxSize;
 
     // We didn't save the old border box size because it was the same as the size of oldBounds.
     return previousBoundsSize;
 }
 
 } // namespace blink