Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline

Source/core/rendering/OrderIterator.h

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 43 matching lines @@
 public:
     friend class OrderIteratorPopulator;
 
     OrderIterator(const RenderBox*);
 
     RenderBox* currentChild() const { return m_currentChild; }
     RenderBox* first();
     RenderBox* next();
     void reset();
 
+    void invalidate();
+
 private:
     const RenderBox* m_containerBox;
 
     // The inline capacity for a single item is used to cover the most
     // common case by far: if we only have the default 'order' value 0.
     typedef Vector<int, 1> OrderValues;
     OrderValues m_orderValues;
 
     RenderBox* m_currentChild;
     size_t m_currentOrderIndex;
     size_t m_currentChildIndex;
 
     // This HashMap is empty if there is only one value.
     typedef HashMap<int, Vector<RenderBox*>, DefaultHash<int>::Hash, OrdererValueMapKeyHashTraits > OrderedValuesMap;
     OrderedValuesMap m_orderedValues;
 };
 
 class OrderIteratorPopulator {
 public:
     OrderIteratorPopulator(OrderIterator& iterator)
         : m_iterator(iterator)
     {
-        // Note that we don't release the memory here, we only invalidate the size.
-        // This avoids unneeded reallocation if the size ends up not changing.
-        m_iterator.m_orderValues.shrink(0);
-        m_iterator.m_orderedValues.clear();
+        m_iterator.invalidate();
     }
 
     ~OrderIteratorPopulator();
 
     void collectChild(RenderBox*);
 
 private:
     OrderIterator& m_iterator;
 };
 
 } // namespace WebCore
 
 #endif //  OrderIterator_h