Don't delete objects from the floating list during layout

Source/core/rendering/RenderBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 1243 matching lines @@
 
     AllowPaintInvalidationScope scoper(frameView());
 
     if ((style()->borderImage().image() && style()->borderImage().image()->data() == image) ||
         (style()->maskBoxImage().image() && style()->maskBoxImage().image()->data() == image)) {
         setShouldDoFullPaintInvalidation();
         return;
     }
 
     ShapeValue* shapeOutsideValue = style()->shapeOutside();
-    if (isFloating() && shapeOutsideValue && shapeOutsideValue->image() && shapeOutsideValue->image()->data() == image) {
+    if (!frameView()->isInPerformLayout() && isFloating() && shapeOutsideValue && shapeOutsideValue->image() && shapeOutsideValue->image()->data() == image) {
         ShapeOutsideInfo& info = ShapeOutsideInfo::ensureInfo(*this);
         if (!info.isComputingShape()) {
             info.markShapeAsDirty();
             markShapeOutsideDependentsForLayout();
         }
     }
 
     if (!paintInvalidationLayerRectsForImage(image, style()->backgroundLayers(), true))
         paintInvalidationLayerRectsForImage(image, style()->maskLayers(), false);
 }
@@ skipping 3250 matching lines @@
     ASSERT(style()->hasBackground() || style()->hasBoxDecorations());
 
     if (m_rareData && m_rareData->m_previousBorderBoxSize.width() != -1)
         return m_rareData->m_previousBorderBoxSize;
 
     // We didn't save the old border box size because it was the same as the size of oldBounds.
     return previousBoundsSize;
 }
 
 } // namespace blink