Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline
This is a regression from introducing the OrderIterator. The issue is
that we don't invalidate our iterator when a child is removed. This
means that we could hold onto free'd memory until the next layout
when we will recompute the iterator.
The solution is simple: just clear the memory when we remove a child.
Note that RenderGrid is not impacted by this bug as we don't use the
iterator outside layout but as I intent to change that, the same
treatment was applied to the class.
BUG=261891
TEST=fast/flexbox/order-iterator-crash.html
R=inferno@chromium.org, ojan@chromium.org
Review URL: https://codereview.chromium.org/19558006
git-svn-id: svn://svn.chromium.org/blink/trunk@154582 bbb929c8-8fbe-4397-9dbb-9b2b20218538
8 files changed
