Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline

Source/core/rendering/RenderFlexibleBox.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 247 matching lines @@
         // Flex items that were previously stretching need to be relayed out so we can compute new available cross axis space.
         // This is only necessary for stretching since other alignment values don't change the size of the box.
         for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
             EAlignItems previousAlignment = resolveAlignment(oldStyle, child->style());
             if (previousAlignment == AlignStretch && previousAlignment != resolveAlignment(style(), child->style()))
                 child->setChildNeedsLayout(true, MarkOnlyThis);
         }
     }
 }
 
+void RenderFlexibleBox::removeChild(RenderObject* child)
+{
+    m_orderIterator.invalidate();
+
+    RenderBlock::removeChild(child);
+}
+
 void RenderFlexibleBox::layoutBlock(bool relayoutChildren, LayoutUnit)
 {
     ASSERT(needsLayout());
 
     if (!relayoutChildren && simplifiedLayout())
         return;
 
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
 
     if (updateLogicalWidthAndColumnWidth())
@@ skipping 1137 matching lines @@
             ASSERT(child);
             LayoutUnit lineCrossAxisExtent = lineContexts[lineNumber].crossAxisExtent;
             LayoutUnit originalOffset = lineContexts[lineNumber].crossAxisOffset - crossAxisStartEdge;
             LayoutUnit newOffset = contentExtent - originalOffset - lineCrossAxisExtent;
             adjustAlignmentForChild(child, newOffset - originalOffset);
         }
     }
 }
 
 }