Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline

Source/core/rendering/OrderIterator.cpp

Index: Source/core/rendering/OrderIterator.cpp
diff --git a/Source/core/rendering/OrderIterator.cpp b/Source/core/rendering/OrderIterator.cpp
index 1bc7bc2929cc8cbb0718a96ca7f6fd928df9e97d..4d19918af38086bd604155b6e83958c720fa03b2 100644
--- a/Source/core/rendering/OrderIterator.cpp
+++ b/Source/core/rendering/OrderIterator.cpp
@@ -74,6 +74,16 @@ void OrderIterator::reset()
     m_currentChild = 0;
 }
 
+void OrderIterator::invalidate()
+{
+    // Note that we don't release the memory here, we only invalidate the size.
+    // This avoids unneeded reallocation if the size ends up not changing.
+    m_orderValues.shrink(0);
+    m_orderedValues.clear();
+
+    reset();
+}
+
 OrderIteratorPopulator::~OrderIteratorPopulator()
 {
     m_iterator.reset();