Don't delete objects from the floating list during layout

In https://codereview.chromium.org/635533003 I was wrong to treat isInPerformLayout
as equivalent to when a shape is being computed. This crash reveals there are cases
where that doesn't hold - so reinstating the check.

This is a reduced version of the clusterfuzz test - it resisted my attempts to remove
anything further from it.

BUG=423891

Review URL: https://codereview.chromium.org/647953004

git-svn-id: svn://svn.chromium.org/blink/trunk@184123 bbb929c8-8fbe-4397-9dbb-9b2b20218538