Fix layering problem with refs

The WebKit/Blink implementations had a bug where a float with shape
outside was creating a new layer, causing it to paint on top of adjacent
text. Fixing this bug showcased the bugs in these tests.