DescriptionHeap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline
This is a regression from introducing the OrderIterator. The issue is
that we don't invalidate our iterator when a child is removed. This
means that we could hold onto free'd memory until the next layout
when we will recompute the iterator.
The solution is simple: just clear the memory when we remove a child.
Note that RenderGrid is not impacted by this bug as we don't use the
iterator outside layout but as I intent to change that, the same
treatment was applied to the class.
BUG=261891
TEST=fast/flexbox/order-iterator-crash.html
R=inferno@chromium.org, ojan@chromium.org
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=154582
Patch Set 1 #Patch Set 2 : Removed bad FINAL #
Total comments: 11
Patch Set 3 : Updated change after the review's comments #
Messages
Total messages: 9 (0 generated)
|