Demonstrates use after free

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 36 matching lines @@
 #include "core/layout/line/InlineIterator.h"
 #include "core/layout/line/InlineTextBox.h"
 #include "core/layout/line/LineWidth.h"
 #include "core/layout/shapes/ShapeOutsideInfo.h"
 #include "core/paint/BlockFlowPaintInvalidator.h"
 #include "core/paint/PaintLayer.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "wtf/PtrUtil.h"
 #include <memory>
 
+#include <iostream>
+
 namespace blink {
 
 bool LayoutBlockFlow::s_canPropagateFloatIntoSibling = false;
 
 struct SameSizeAsLayoutBlockFlow : public LayoutBlock {
   LineBoxList lineBoxes;
   void* pointers[2];
 };
 
 static_assert(sizeof(LayoutBlockFlow) == sizeof(SameSizeAsLayoutBlockFlow),
@@ skipping 3816 matching lines @@
           shouldPaint = true;
         }
         // We create the floating object list lazily.
         if (!m_floatingObjects)
           createFloatingObjects();
 
         m_floatingObjects->add(
             floatingObject.copyToNewContainer(offset, shouldPaint, true));
       }
     } else {
+      std::cout << "floating object test: " << floatingObject.layoutObject() << std::endl;
+      std::cout << "This call to hasLayer causes use after free: " << floatingObject.layoutObject()->hasLayer() << std::endl;
       if (makeChildPaintOtherFloats && !floatingObject.shouldPaint() &&
           !floatingObject.layoutObject()->hasSelfPaintingLayer() &&
           !floatingObject.isLowestNonOverhangingFloatInChild() &&
           floatingObject.layoutObject()->isDescendantOf(child) &&
           floatingObject.layoutObject()->enclosingFloatPaintingLayer() ==
               child->enclosingFloatPaintingLayer()) {
         // The float is not overhanging from this block, so if it is a
         // descendant of the child, the child should paint it (the other case is
         // that it is intruding into the child), unless it has its own layer or
         // enclosing layer.
@@ skipping 702 matching lines @@
   return LayoutBlock::invalidatePaintIfNeeded(paintInvalidationState);
 }
 
 void LayoutBlockFlow::invalidateDisplayItemClients(
     PaintInvalidationReason invalidationReason) const {
   BlockFlowPaintInvalidator(*this).invalidateDisplayItemClients(
       invalidationReason);
 }
 
 }  // namespace blink