Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline

Source/core/rendering/OrderIterator.h

Index: Source/core/rendering/OrderIterator.h
diff --git a/Source/core/rendering/OrderIterator.h b/Source/core/rendering/OrderIterator.h
index 8704078968c6cd215facd2cacd9f4dfe71643039..ad1f795880faf154241d0f3adf5eeeb042c32a50 100644
--- a/Source/core/rendering/OrderIterator.h
+++ b/Source/core/rendering/OrderIterator.h
@@ -61,6 +61,8 @@ public:
     RenderBox* next();
     void reset();
 
+    void invalidate();
+
 private:
     const RenderBox* m_containerBox;
 
@@ -83,10 +85,7 @@ public:
     OrderIteratorPopulator(OrderIterator& iterator)
         : m_iterator(iterator)
     {
-        // Note that we don't release the memory here, we only invalidate the size.
-        // This avoids unneeded reallocation if the size ends up not changing.
-        m_iterator.m_orderValues.shrink(0);
-        m_iterator.m_orderedValues.clear();
+        m_iterator.invalidate();
     }
 
     ~OrderIteratorPopulator();