Don't delete nodes in the float interval tree while traversing it.

Source/core/rendering/shapes/ShapeOutsideInfo.cpp

 /*
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 124 matching lines @@
     RefPtr<Image> image = styleImage->image(const_cast<RenderBox*>(&m_renderer), imageSize);
 
     return Shape::createRasterShape(image.get(), shapeImageThreshold, imageRect, marginRect, writingMode, margin);
 }
 
 const Shape& ShapeOutsideInfo::computedShape() const
 {
     if (Shape* shape = m_shape.get())
         return *shape;
 
+    TemporaryChange<bool> isInComputingShape(m_isComputingShape, true);
+
     const RenderStyle& style = *m_renderer.style();
     ASSERT(m_renderer.containingBlock());
     const RenderStyle& containingBlockStyle = *m_renderer.containingBlock()->style();
 
     WritingMode writingMode = containingBlockStyle.writingMode();
     LayoutUnit maximumValue = m_renderer.containingBlock() ? m_renderer.containingBlock()->contentWidth() : LayoutUnit();
     float margin = floatValueForLength(m_renderer.style()->shapeMargin(), maximumValue.toFloat());
 
     float shapeImageThreshold = style.shapeImageThreshold();
     ASSERT(style.shapeOutside());
@@ skipping 184 matching lines @@
 }
 
 FloatSize ShapeOutsideInfo::shapeToRendererSize(FloatSize size) const
 {
     if (!m_renderer.style()->isHorizontalWritingMode())
         return size.transposedSize();
     return size;
 }
 
 } // namespace blink