Don't delete objects from the floating list during layout

LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html

Index: LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html
diff --git a/LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html b/LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html
new file mode 100644
index 0000000000000000000000000000000000000000..2f588635c7696163b321241503ef4090445abf9b
--- /dev/null
+++ b/LayoutTests/http/tests/shapes/crash-image-changed-during-layout.html
@@ -0,0 +1,74 @@
+|m~w B  y	 6,s3/e86s}&  *v-*5$HEw[ ?U; jyN8 m[Y

[Julien - ping for review, 2014/10/20 23:53:02]

DOCTYPE?

+2 =^q  f	%6
+M@ j Cg^dzL

[Julien - ping for review, 2014/10/20 23:53:02]

Can we use some non-random text here?

+<style>
+* { line-height: 30rem; shape-outside: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg'> fill='blue'/></svg>");}
+</style>
+<style>
+.c29 {
+    border-width-top: -9px;
+    src: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAkAAAAJCAIAAABv85FHAAAABnRSTlMA/wAAAACkwsAdAAAAIUlEQVR4nGP4z8CAC+GUIEXuABhgkTuABEiRw2cmae4EAH05X7xDolNRAAAAAElFTkSuQmCC") format(attr(r));
+    float: left;
+    min-width: 30in;
+    border-top: solid rgba(185, 191, 175, 0.254400) 66em;
+}
+</style>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+// crbug.com/423891: Crashes if we remove a float from the floating objects list during layout.
+var docElement = document.body ? document.body : document.documentElement;
+function initCF() {
+    tCF7 = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+    tCF7.setAttribute("class", "c6");
+    tCF7.setAttribute("clip", "url(#tCF4.contentDocument.documentElement)");
+    tCF8 = document.createElementNS("http://example.org/notsvg", "a");
+    try{tCF8.setAttribute("xlink:href", "../images/linkingToc-t.svg");}catch(e){}
+    try{tCF8.setAttribute("xmlns", "http://example.org/notsvg");}catch(e){}
+    try{tCF4.contentDocument.documentElement.appendChild(tCF8);}catch(e){}
+    tCF10 = document.createTextNode(" :+bwtq4#X;Q(Tea`l	jodaF8)~P,`s@F4E&fW}ZCN3");
+    tCF55 = document.createElementNS("http://www.w3.org/1999/xhtml", "fespotlight");
+    tCF55.setAttribute("class", "c29");
+    docElement.appendChild(tCF55);
+    tCF56 = document.createElementNS("http://www.w3.org/1999/xhtml", "fespotlight");
+    tCF56.setAttribute("class", "c29");
+    docElement.appendChild(tCF56);
+    tCF74 = document.createElementNS("http://www.w3.org/2000/svg", "p");
+    tCF74.setAttribute("class", "c28");
+    try{docElement.appendChild(tCF74);}catch(e){}
+    try{tCF75 = document.createElementNS("http://www.w3.org/2000/svg", "animattributeattrs");}catch(e){}
+    try{tCF75.setAttribute("class", "c18");}catch(e){}
+    try{tCF77.setAttribute("class", "c31");}catch(e){}
+    try{docElement.appendChild(tCF77);}catch(e){}
+    try{tCF78 = document.createElementNS("http://www.w3.org/1999/xhtml", "picture");}catch(e){}
+    try{tCF78.setAttribute("class", "c29");}catch(e){}
+    try{docElement.appendChild(tCF78);}catch(e){}
+    tCF79 = document.createElementNS("http://www.w3.org/1999/xhtml", "picture");
+    tCF79.setAttribute("class", "c35");
+    docElement.appendChild(tCF79);
+    tCF80 = document.createTextNode("mjNfLsb	dy	]S	~R=?YC, *q-Q		cvqH[b 	 u{$A|r yLb");
+    docElement.appendChild(tCF80);
+    tCF81 = document.createElementNS("http://www.w3.org/1999/xhtml", "picture");
+    mtObserver4.observe(tCF51_contentDocument, { attributes: true,  })
+    setTimeout("tCFcrash()", 195);
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+function tCF_custom_1() {
+    try{tCF59.appendChild(tCF55.previousSibling);}catch(e){}
+    try{docElement.appendChild(tCF466);}catch(e){}
+    try{tCF277.outerHTML = tCF273.outerHTML;}catch(e){}
+    try{tCF281.insertBefore(tCF283, tCF281.childNodes[50 % tCF281.childNodes.length]); } catch(e) { try{tCF281.appendChild(tCF283);}catch(e){} }
+    try{tCF145.childNodes[166 % tCF145.childNodes.length].appendChild(tCF528);}catch(e){}
+    try{tCF217.style.zoom = 1;}catch(e){}
+    try{id = tCF235.attributes[32 % tCF235.attributes.length].name;}catch(e){}
+    try{docElement.appendChild(tCF426);}catch(e){}
+    setTimeout('try{tCF444.setAttribute("class", }catch(e){}', 444);
+    try{eventSender.addTouchPoint(PP,PP);}catch(e){}
+    try{tCF370.appendChild(tCF17_content);}catch(e){}
+    try{tCFEvent373 = 0; tCF488.parentNode.addEventListener("beforeunload", false);}catch(e){}
+    try{tCF420.insertBefore(tCF364, tCF420.childNodes[36 % tCF420.childNodes.length]); } catch(e) { try{tCF420.appendChild(tCF364);}catch(e){} }
+    setTimeout("window.location.reload();", 2182);

[Julien - ping for review, 2014/10/20 23:53:01]

That's a 2 seconds wait :(

There is no way we will land this test with that.

+
+}
+</script>