Demonstrates use after free

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
index e204dee20f2c25baeb1b0746585c7cce154cab4b..82b6c6e06f6afc2b3485fce2d182a1b476b0187e 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
@@ -54,6 +54,8 @@
 #include "wtf/PtrUtil.h"
 #include <memory>
 
+#include <iostream>
+
 namespace blink {
 
 bool LayoutBlockFlow::s_canPropagateFloatIntoSibling = false;
@@ -3890,6 +3892,8 @@ void LayoutBlockFlow::addOverhangingFloats(LayoutBlockFlow* child,
             floatingObject.copyToNewContainer(offset, shouldPaint, true));
       }
     } else {
+      std::cout << "floating object test: " << floatingObject.layoutObject() << std::endl;
+      std::cout << "This call to hasLayer causes use after free: " << floatingObject.layoutObject()->hasLayer() << std::endl;
       if (makeChildPaintOtherFloats && !floatingObject.shouldPaint() &&
           !floatingObject.layoutObject()->hasSelfPaintingLayer() &&
           !floatingObject.isLowestNonOverhangingFloatInChild() &&