Heap-use-after-free in WebCore::GraphicsContext::drawImage

Source/core/rendering/shapes/ShapeOutsideInfo.h

 /*
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 83 matching lines @@
     FloatSize shapeToRendererSize(FloatSize) const;
     const Shape& computedShape() const;
 
 protected:
     ShapeOutsideInfo(const RenderBox& renderer)
         : m_renderer(renderer)
         , m_lineOverlapsShape(false)
     { }
 
 private:
+    PassOwnPtr<Shape> createShapeForImage(StyleImage*, float shapeImageThreshold, WritingMode, float margin) const;
+
     LayoutUnit logicalTopOffset() const;
     LayoutUnit logicalLeftOffset() const;
 
     typedef HashMap<const RenderBox*, OwnPtr<ShapeOutsideInfo> > InfoMap;
     static InfoMap& infoMap()
     {
         DEFINE_STATIC_LOCAL(InfoMap, staticInfoMap, ());
         return staticInfoMap;
     }
 
     LayoutUnit m_referenceBoxLineTop;
     LayoutUnit m_lineHeight;
 
     const RenderBox& m_renderer;
     mutable OwnPtr<Shape> m_shape;
     LayoutSize m_referenceBoxLogicalSize;
     LayoutUnit m_leftMarginBoxDelta;
     LayoutUnit m_rightMarginBoxDelta;
     LayoutUnit m_borderBoxLineTop;
     bool m_lineOverlapsShape;
 };
 
 }
 #endif