Don't delete nodes in the float interval tree while traversing it.

Source/core/rendering/shapes/ShapeOutsideInfo.h

Index: Source/core/rendering/shapes/ShapeOutsideInfo.h
diff --git a/Source/core/rendering/shapes/ShapeOutsideInfo.h b/Source/core/rendering/shapes/ShapeOutsideInfo.h
index 9596e528af4f6b77fc326e50a67bd43565a805c7..9ed8774ae0c860eeebc4a0da73b0755de9e6bcf8 100644
--- a/Source/core/rendering/shapes/ShapeOutsideInfo.h
+++ b/Source/core/rendering/shapes/ShapeOutsideInfo.h
@@ -111,6 +111,7 @@ public:
     void markShapeAsDirty() { m_shape.clear(); }
     bool isShapeDirty() { return !m_shape.get(); }
     LayoutSize shapeSize() const { return m_referenceBoxLogicalSize; }
+    bool isComputingShape() const { return m_isComputingShape; }
 
     LayoutRect computedShapePhysicalBoundingBox() const;
     FloatPoint shapeToRendererPoint(FloatPoint) const;
@@ -120,6 +121,7 @@ public:
 protected:
     ShapeOutsideInfo(const RenderBox& renderer)
         : m_renderer(renderer)
+        , m_isComputingShape(false)
     { }
 
 private:
@@ -139,6 +141,7 @@ private:
     mutable OwnPtr<Shape> m_shape;
     LayoutSize m_referenceBoxLogicalSize;
     ShapeOutsideDeltas m_shapeOutsideDeltas;
+    mutable bool m_isComputingShape;
 };
 
 }