Don't delete objects from the floating list during layout

Don't delete objects from the floating list during layout

In https://codereview.chromium.org/635533003 I was wrong to treat isInPerformLayout
as equivalent to when a shape is being computed. This crash reveals there are cases
where that doesn't hold - so reinstating the check.

This is a reduced version of the clusterfuzz test - it resisted my attempts to remove
anything further from it.

BUG=423891
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=184123

[rhogan, 2014-10-20 18:01:59]

robhogan@gmail.com changed reviewers:
+ jchaffraix@chromium.org

[Julien - ping for review, 2014-10-20 23:53:02]

It is crazy that we can't simplify this test.

https://codereview.chromium.org/647953004/diff/1/LayoutTests/http/tests/shape...
File LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html
(right):

https://codereview.chromium.org/647953004/diff/1/LayoutTests/http/tests/shape...
LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html:1: |m~w B 
y	 6,s3/e86s}&  *v-*5$HEw[ ?U; jyN8 m[Y
DOCTYPE?

https://codereview.chromium.org/647953004/diff/1/LayoutTests/http/tests/shape...
LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html:3: M@ j
Cg^dzL
Can we use some non-random text here?

https://codereview.chromium.org/647953004/diff/1/LayoutTests/http/tests/shape...
LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html:71:
setTimeout("window.location.reload();", 2182);
That's a 2 seconds wait :(

There is no way we will land this test with that.

[Julien - ping for review, 2014-10-21 19:15:29]

lgtm

https://codereview.chromium.org/647953004/diff/20001/LayoutTests/http/tests/s...
File LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html
(right):

https://codereview.chromium.org/647953004/diff/20001/LayoutTests/http/tests/s...
LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html:6: * {
line-height: 30rem; shape-outside: url("data:image/svg+xml;utf8,<svg
xmlns='http://www.w3.org/2000/svg'> fill='blue'/></svg>");}
Really not a huge fan of using the universal selector but I guess you tried to
remove / narrow it already.

https://codereview.chromium.org/647953004/diff/20001/LayoutTests/http/tests/s...
LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html:8: <style>
And we also need the 2 <style>?

https://codereview.chromium.org/647953004/diff/20001/LayoutTests/http/tests/s...
LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html:28: text =
document.createTextNode("This test should not crash. This test should not
crash.");
That's a lot of "This test should not crash." (3 times total).

How about we keep the first one (and include that there should be a PASS) and
just insert here that we PASS?

[rhogan, 2014-10-21 20:09:44]

The CQ bit was checked by robhogan@gmail.com

[commit-bot: I haz the power, 2014-10-21 20:10:12]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/647953004/40001

[commit-bot: I haz the power, 2014-10-21 22:19:38]

Committed patchset #3 (id:40001) as 184123