Don't delete nodes in the float interval tree while traversing it.

LayoutTests/fast/shapes/crash-caused-by-dirtying-a-shape-while-computing-it-requires-a-long-filename-to-crash.html

Index: LayoutTests/fast/shapes/crash-caused-by-dirtying-a-shape-while-computing-it-requires-a-long-filename-to-crash.html
diff --git a/LayoutTests/fast/shapes/crash-caused-by-dirtying-a-shape-while-computing-it-requires-a-long-filename-to-crash.html b/LayoutTests/fast/shapes/crash-caused-by-dirtying-a-shape-while-computing-it-requires-a-long-filename-to-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..fb4ff322c94e0cdb614cf62ee4b1be375c6b51c1
--- /dev/null
+++ b/LayoutTests/fast/shapes/crash-caused-by-dirtying-a-shape-while-computing-it-requires-a-long-filename-to-crash.html
@@ -0,0 +1,19 @@
+<div id=start><br><br></div>

[Julien - ping for review, 2014/10/08 18:13:27]

DOCTYPE!!!!

+<div id=end></div>
+<script>
+    if (window.testRunner) {
+        testRunner.waitUntilDone();
+        testRunner.dumpAsText();
+    }
+    // crbug.com/409508: Crashes if we attempt to delete a node in the interval tree of floats while traversing it.
+    var selection = window.getSelection();
+    selection.setBaseAndExtent(start, 0, end, end.childNodes.length);
+    if (window.testRunner)
+        testRunner.notifyDone();
+</script>
+<style>
+div,br {
+    shape-outside: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg'></svg>");
+    float: left;
+}
+</style>