Test: fast/block/float-avoids-padding-inline-ancestors.html

This test crashes because:
1. The original HTML contains
<div class="container">
  <span class="padded" style="padding-right: 160px;">
  <span class="padded" style="padding-right: 100px;">
    a
    <span class="float" data-offset-y=22>Float</span>
  </span>
  </span>
</div>
2. Then checkLayout() inserts <pre> after <span class="float">
3. Which calls SplitInline() to create anonymous blocks.
4. The float is in container.floating_objects_ list. In normal layout, this is cleared by RemoveFloatingOrPositionedChildFromBlockLists(), but SplitInline() does not clear floats.
5. In normal layout, LayoutBlockFlow::UpdateBlockLayout() -> LayoutChildren() -> ResetLayout() -> RebuildFloatsFromIntruding(), which rebuilds floating_objects_. LayoutNGBlowFlow::UpdateBlockLayout() does not do this, so the float is still in container.floating_objects_.
6. Then NG lays out:
<div class="container">
  <anon>
    <span class="padded" style="padding-right: 160px;">
    <span class="padded" style="padding-right: 100px;">
      a
      <span class="float" data-offset-y=22>Float</span>
    </span>
    </span>
  </anon>
  <anon>
    <pre>...</pre>
  </anon>
  <anon>
    <span><span></span></span>
  </anon>
</div>
which, CopyChildFragmentPosition() inserts the float into the 1st <anon>.
7. NG paint paints the float as a child of the 1st anon, then the legacy paint paints it again as a child of <div id=container>. Painting the same object twice hits DCHECK failure.