Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline

LayoutTests/fast/flexbox/order-iterator-crash-expected.txt

Index: LayoutTests/fast/flexbox/order-iterator-crash-expected.txt
diff --git a/LayoutTests/fast/flexbox/order-iterator-crash-expected.txt b/LayoutTests/fast/flexbox/order-iterator-crash-expected.txt
new file mode 100644
index 0000000000000000000000000000000000000000..15aba57c0583e4c7b8821c02899366963f4142b4
--- /dev/null
+++ b/LayoutTests/fast/flexbox/order-iterator-crash-expected.txt
@@ -0,0 +1,3 @@
+This test has passed if it doesn't crash under ASAN.
+* { display: flex; }

[inferno, 2013/07/19 20:25:08]

Why are these last two lines showing up in expectations file.

[Julien - ping for review, 2013/07/19 20:52:31]

That's because we turn <script> and <style> into flexboxes so they show their
content.

[inferno, 2013/07/19 20:57:22]

This is weird, but if the crashing testcase cannot be minimized more (like
display:flex on specific elements than *), then it is ok.

[Julien - ping for review, 2013/07/19 21:05:45]

I tried narrowing the * but that didn't work unfortunately (like adding the
DOCTYPE) so I didn't press further.

+if (window.testRunner) testRunner.dumpAsText(); crashy.offsetLeft; crashy.parentNode.removeChild(crashy);