Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline

Source/core/rendering/OrderIterator.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 56 matching lines @@
     return m_currentChild;
 }
 
 void OrderIterator::reset()
 {
     m_currentOrderIndex = 0;
     m_currentChildIndex = 0;
     m_currentChild = 0;
 }
 
+void OrderIterator::invalidate()
+{
+    // Note that we don't release the memory here, we only invalidate the size.
+    // This avoids unneeded reallocation if the size ends up not changing.
+    m_orderValues.shrink(0);
+    m_orderedValues.clear();
+
+    reset();
+}
+
 OrderIteratorPopulator::~OrderIteratorPopulator()
 {
     m_iterator.reset();
 
     std::sort(m_iterator.m_orderValues.begin(), m_iterator.m_orderValues.end());
 
     // Ensure that we release any extra memory we hold onto.
     m_iterator.m_orderValues.shrinkToFit();
 }
 
 void OrderIteratorPopulator::collectChild(RenderBox* child)
 {
     int order = child->style()->order();
 
     // FIXME: Ideally we would want to avoid inserting into the HashMap for the common case where there are only items
     // with the default 'order' 0. The current API is designed to blend into a single iteration which makes having a
     // slower fallback difficult without having to store the children (grid items may not be contiguous in DOM order).
     OrderIterator::OrderedValuesMap::AddResult result = m_iterator.m_orderedValues.add(order, Vector<RenderBox*>());
     result.iterator->value.append(child);
     if (result.isNewEntry)
         m_iterator.m_orderValues.append(order);
 }
 
 } // namespace WebCore