Zero-width float edges in BFC slots; float state snapshot/restore

[nicoburns]

Objective

Fix remaining Blitz WPT failures in the "floats × inline content / line boxes" group involving zero-width floats and BFC roots with negative margins, and add an API needed by Blitz's inline layout (see DioxusLabs/blitz#630).

This PR has been rebuilt on top of latest main (which already landed overlapping fixes in #1055, #1056, #1061, #1062, #1064, #1065), so it is now much smaller than its original form.

Changes

1. find_bfc_slot: zero-width float edges vs. real float edges

Segment now tracks zero_width_edge: [bool; 2] alongside has_float (which is now only set for positive-width floats). When searching for the slot for a float-avoiding box (BFC root):

• Segments with no real float edge on either side (e.g. created only by zero-width floats) don't constrain the box's width: the search continues below them to find the constraining segment, while keeping the box's original (unconstrained) y position.
• Zero-width float edges passed over on the way act as obstacles: a negative margin may not move the box's border edge past them (matching Chromium's behavior per WPT zero-width-floats-positioning.tentative.html).
• When no real float edge exists at all, margins (including negative margins) apply as usual (WPT zero-width-floats.html).

This distinguishes three previously-conflated cases which WPT expects to behave differently:

scenario	expected behavior
only zero-width floats beside box	negative margins fully applied (no clamping)
real float on trailing side only	negative leading margin fully applied (#1061 behavior preserved, floats-wrap-bfc-with-margin-006)
real float on trailing side + zero-width float edge on leading side	leading negative margin clamped at the zero-width edge; box narrowed by the real float

2. BlockContext::snapshot_float_state / restore_float_state

New public API (exporting a new opaque FloatStateSnapshot type) allowing callers performing speculative layout — such as inline layout that may need to re-run line breaking — to roll back float placements made during a discarded layout attempt. Used by Blitz's inline layout in DioxusLabs/blitz#630 to fix floats-in-inline placement when Parley rewinds content.

Context

Diagnosed from Blitz WPT failures on DioxusLabs/blitz#625; the Blitz-side changes are in DioxusLabs/blitz#630 (which pins taffy to this branch for CI; it should be re-pinned to main once this merges).

Newly passing WPT tests attributable to the taffy changes in this PR (measured with blitz#630, css/CSS2/floats css/CSS2/floats-clear suites):

• css/CSS2/floats/zero-width-floats.html
• css/CSS2/floats/zero-width-floats-positioning.tentative.html (kept passing; regressed by upstream main alone)

Overall suite result with blitz#630 (retargeted to blitz main, which now includes #625) + this branch: 231 PASS / 106 FAIL / 0 CRASH of 337 vs a blitz-main baseline of 227 PASS / 110 FAIL. No previously-passing test regresses.

Testing

• cargo test (all pass, including 3 new hand-written regression tests covering the three scenarios above)
• cargo fmt and cargo clippy --workspace clean

Link to Devin session: https://app.devin.ai/sessions/ca393611e919410aaa93e816fdf90a54
Requested by: @nicoburns

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring