Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline

Source/core/rendering/RenderFlexibleBox.h

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 46 matching lines @@
     virtual void paintChildren(PaintInfo&, const LayoutPoint&) OVERRIDE FINAL;
 
     bool isHorizontalFlow() const;
 
 protected:
     virtual void computeIntrinsicLogicalWidths(LayoutUnit& minLogicalWidth, LayoutUnit& maxLogicalWidth) const OVERRIDE;
     virtual void computePreferredLogicalWidths() OVERRIDE;
 
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    virtual void removeChild(RenderObject* child) OVERRIDE;
+
 private:
     enum FlexSign {
         PositiveFlexibility,
         NegativeFlexibility,
     };
 
     enum PositionedLayoutMode {
         FlipForRowReverse,
         NoFlipForRowReverse,
     };
@@ skipping 94 matching lines @@
     ASSERT_WITH_SECURITY_IMPLICATION(!object || object->isFlexibleBox());
     return static_cast<const RenderFlexibleBox*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
 void toRenderFlexibleBox(const RenderFlexibleBox*);
 
 } // namespace WebCore
 
 #endif // RenderFlexibleBox_h