[CSS Shapes] Add basic support for shape-inside with inline/block content with floats
    
Float positioning inside shape-inside has been working only for simple cases when the float boundaries didn't overlap with the shape.
This patch introduces the basic support for left floats and shapes with inline content, and shapes with block content with inline content (paragraphs).
This patch doesn't add test cases for float content with border/margin/padding, for those cases I'll make a separate patch.
    
Merged WebKit Revisions:
- http://trac.webkit.org/changeset/156846
- http://trac.webkit.org/changeset/156107
- http://trac.webkit.org/changeset/156022

Review URL: https://codereview.chromium.org/26926002

git-svn-id: svn://svn.chromium.org/blink/trunk@159472 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert "Make compositingState explicit (re-land #2 with bogus ASSERT removed)"

This is in an attempt to remove the crashing occurring on tip of tree.
There's no strong reason to suspect this patch except that this patch
was a bit large.

BUG=306096
TBR=kareng@chromium.org, vollick@chromium.org

Review URL: https://codereview.chromium.org/27030009

git-svn-id: svn://svn.chromium.org/blink/trunk@159473 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Revert "Revert "Don't crash by form submission in a document with null encoding.""

This reverts r159463. It turns out it was not the cause of the test failure.

TBR=tkent@chromium.org

Review URL: https://codereview.chromium.org/27065002

git-svn-id: svn://svn.chromium.org/blink/trunk@159474 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Add a flaky crash line.

TBR=esprehn@chromium.org
BUG=306645

Review URL: https://codereview.chromium.org/26824005

git-svn-id: svn://svn.chromium.org/blink/trunk@159475 bbb929c8-8fbe-4397-9dbb-9b2b20218538