Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline

Source/core/rendering/RenderGrid.cpp

 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 234 matching lines @@
 
     computeIntrinsicLogicalWidths(m_minPreferredLogicalWidth, m_maxPreferredLogicalWidth);
 
     LayoutUnit borderAndPaddingInInlineDirection = borderAndPaddingLogicalWidth();
     m_minPreferredLogicalWidth += borderAndPaddingInInlineDirection;
     m_maxPreferredLogicalWidth += borderAndPaddingInInlineDirection;
 
     setPreferredLogicalWidthsDirty(false);
 }
 
+void RenderGrid::removeChild(RenderObject* child)
+{
+    m_orderIterator.invalidate();
+
+    RenderBlock::removeChild(child);
+}
+
 LayoutUnit RenderGrid::computePreferredTrackWidth(const GridLength& gridLength, size_t trackIndex) const
 {
     if (gridLength.isFlex())
         return 0;
 
     const Length& length = gridLength.length();
 
     if (length.isFixed()) {
         // Grid areas don't have borders, margins or paddings so we don't need to account for them.
         return length.intValue();
@@ skipping 786 matching lines @@
     if (isOutOfFlowPositioned())
         return "RenderGrid (positioned)";
     if (isAnonymous())
         return "RenderGrid (generated)";
     if (isRelPositioned())
         return "RenderGrid (relative positioned)";
     return "RenderGrid";
 }
 
 } // namespace WebCore