Heap-use-after-free in WebCore::RenderFlexibleBox::firstLineBoxBaseline

This is a regression from introducing the OrderIterator. The issue is
that we don't invalidate our iterator when a child is removed. This
means that we could hold onto free'd memory until the next layout
when we will recompute the iterator.

The solution is simple: just clear the memory when we remove a child.

Note that RenderGrid is not impacted by this bug as we don't use the
iterator outside layout but as I intent to change that, the same
treatment was applied to the class.

R=inferno@chromium.org, ojan@chromium.org

Review URL: https://codereview.chromium.org/19558006

git-svn-id: svn://svn.chromium.org/blink/trunk@154582 bbb929c8-8fbe-4397-9dbb-9b2b20218538
8 files changed