Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline

Source/core/rendering/OrderIterator.cpp

Index: Source/core/rendering/OrderIterator.cpp
diff --git a/Source/core/rendering/OrderIterator.cpp b/Source/core/rendering/OrderIterator.cpp
index 1bc7bc2929cc8cbb0718a96ca7f6fd928df9e97d..4d19918af38086bd604155b6e83958c720fa03b2 100644
--- a/Source/core/rendering/OrderIterator.cpp
+++ b/Source/core/rendering/OrderIterator.cpp
@@ -74,6 +74,16 @@ void OrderIterator::reset()
     m_currentChild = 0;
 }
 
+void OrderIterator::invalidate()
+{
+    // Note that we don't release the memory here, we only invalidate the size.
+    // This avoids unneeded reallocation if the size ends up not changing.
+    m_orderValues.shrink(0);
+    m_orderedValues.clear();

[ojan, 2013/07/19 20:27:50]

Nit: can't we also do m_orderedValues.shrink(0)?

[Julien - ping for review, 2013/07/19 20:52:31]

It should be possible indeed.

[Julien - ping for review, 2013/07/19 21:25:44]

I have to retract that: m_orderedValues is a HashMap which doesn't have the
concept of shrinking. We could shrink all the values' Vector but that seems
expensive so I will stick with the existing clear().

+
+    reset();
+}
+
 OrderIteratorPopulator::~OrderIteratorPopulator()
 {
     m_iterator.reset();