Don't delete nodes in the float interval tree while traversing it.

Source/core/rendering/shapes/ShapeOutsideInfo.h

Index: Source/core/rendering/shapes/ShapeOutsideInfo.h
diff --git a/Source/core/rendering/shapes/ShapeOutsideInfo.h b/Source/core/rendering/shapes/ShapeOutsideInfo.h
index 9596e528af4f6b77fc326e50a67bd43565a805c7..92bd491a257a5381437ecfe7d55ff08356310a79 100644
--- a/Source/core/rendering/shapes/ShapeOutsideInfo.h
+++ b/Source/core/rendering/shapes/ShapeOutsideInfo.h
@@ -111,6 +111,7 @@ public:
     void markShapeAsDirty() { m_shape.clear(); }
     bool isShapeDirty() { return !m_shape.get(); }
     LayoutSize shapeSize() const { return m_referenceBoxLogicalSize; }
+    bool isComputingShape() const { return m_computingShape; }
 
     LayoutRect computedShapePhysicalBoundingBox() const;
     FloatPoint shapeToRendererPoint(FloatPoint) const;
@@ -120,6 +121,7 @@ public:
 protected:
     ShapeOutsideInfo(const RenderBox& renderer)
         : m_renderer(renderer)
+        , m_computingShape(false)
     { }
 
 private:
@@ -139,6 +141,7 @@ private:
     mutable OwnPtr<Shape> m_shape;
     LayoutSize m_referenceBoxLogicalSize;
     ShapeOutsideDeltas m_shapeOutsideDeltas;
+    mutable bool m_computingShape: 1;

[Julien - ping for review, 2014/10/08 18:13:27]

Per our style guide, this should be m_isComputingShape (which matches
isComputingShape())

 };
 
 }