Don't delete nodes in the float interval tree while traversing it.

Source/core/rendering/shapes/ShapeOutsideInfo.h

 /*
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 93 matching lines @@
             return *info;
         InfoMap::AddResult result = infoMap.add(&key, ShapeOutsideInfo::createInfo(key));
         return *result.storedValue->value;
     }
     static void removeInfo(const RenderBox& key) { infoMap().remove(&key); }
     static ShapeOutsideInfo* info(const RenderBox& key) { return infoMap().get(&key); }
 
     void markShapeAsDirty() { m_shape.clear(); }
     bool isShapeDirty() { return !m_shape.get(); }
     LayoutSize shapeSize() const { return m_referenceBoxLogicalSize; }
+    bool isComputingShape() const { return m_isComputingShape; }
 
     LayoutRect computedShapePhysicalBoundingBox() const;
     FloatPoint shapeToRendererPoint(FloatPoint) const;
     FloatSize shapeToRendererSize(FloatSize) const;
     const Shape& computedShape() const;
 
 protected:
     ShapeOutsideInfo(const RenderBox& renderer)
         : m_renderer(renderer)
+        , m_isComputingShape(false)
     { }
 
 private:
     PassOwnPtr<Shape> createShapeForImage(StyleImage*, float shapeImageThreshold, WritingMode, float margin) const;
 
     LayoutUnit logicalTopOffset() const;
     LayoutUnit logicalLeftOffset() const;
 
     typedef HashMap<const RenderBox*, OwnPtr<ShapeOutsideInfo> > InfoMap;
     static InfoMap& infoMap()
     {
         DEFINE_STATIC_LOCAL(InfoMap, staticInfoMap, ());
         return staticInfoMap;
     }
 
     const RenderBox& m_renderer;
     mutable OwnPtr<Shape> m_shape;
     LayoutSize m_referenceBoxLogicalSize;
     ShapeOutsideDeltas m_shapeOutsideDeltas;
+    mutable bool m_isComputingShape;
 };
 
 }
 #endif