Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline

Source/core/rendering/RenderFlexibleBox.cpp

Index: Source/core/rendering/RenderFlexibleBox.cpp
diff --git a/Source/core/rendering/RenderFlexibleBox.cpp b/Source/core/rendering/RenderFlexibleBox.cpp
index d1c9cfc192bfbb9eb0cfdfc63080be7e27ef337a..62f6d971e3a6fc4b9c6b4ed35dfac471d7e7c5dd 100644
--- a/Source/core/rendering/RenderFlexibleBox.cpp
+++ b/Source/core/rendering/RenderFlexibleBox.cpp
@@ -265,6 +265,13 @@ void RenderFlexibleBox::styleDidChange(StyleDifference diff, const RenderStyle*
     }
 }
 
+void RenderFlexibleBox::removeChild(RenderObject* child)
+{
+    m_orderIterator.invalidate();
+
+    RenderBlock::removeChild(child);
+}
+
 void RenderFlexibleBox::layoutBlock(bool relayoutChildren, LayoutUnit)
 {
     ASSERT(needsLayout());