layout: Rewrite the block formatting context/float inline-size

speculation code.

The old code tried to do the speculation as a single bottom-up pass
after intrinsic inline-size calculation, which was unable to handle
cases like this:

    <div>
        <div style="float: left">Foo</div>
    </div>
    <div>
        <div style="overflow: hidden">Bar</div>
    </div>

No single bottom-up pass could possibly handle this case, because the
inline-size of the float flowing out of the "Foo" block could never make
it down to the "Bar" block, where it is needed for speculation.

On the pages I tried, this regresses layout performance by 1%-2%.

I first noticed this breaking some pages, like the Google SERPs, several
months ago.

components/profile/time.rs

@@ -59,6 +59,7 @@ impl Formattable for ProfilerCategory {
             ProfilerCategory::LayoutNonIncrementalReset |
             ProfilerCategory::LayoutGeneratedContent |
             ProfilerCategory::LayoutDisplayListSorting |
+            ProfilerCategory::LayoutFloatPlacementSpeculation |
             ProfilerCategory::LayoutMain |
             ProfilerCategory::LayoutStoreOverflow |
             ProfilerCategory::LayoutDispListBuild |
@@ -83,6 +84,7 @@ impl Formattable for ProfilerCategory {
             ProfilerCategory::LayoutDamagePropagate => "Damage Propagation",
             ProfilerCategory::LayoutDisplayListSorting => "Sorting Display List",
             ProfilerCategory::LayoutGeneratedContent => "Generated Content Resolution",
+            ProfilerCategory::LayoutFloatPlacementSpeculation => "Float Placement Speculation",
             ProfilerCategory::LayoutMain => "Primary Layout Pass",
             ProfilerCategory::LayoutStoreOverflow => "Store Overflow",
             ProfilerCategory::LayoutParallelWarmup => "Parallel Warmup",