REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox

[WebKit-https.git] / Source / WebCore / rendering / OrderIterator.h

diff --git a/Source/WebCore/rendering/OrderIterator.h b/Source/WebCore/rendering/OrderIterator.h
index 1d1f58a..27f89bf 100644 (file)
--- a/Source/WebCore/rendering/OrderIterator.h
+++ b/Source/WebCore/rendering/OrderIterator.h
@@ -47,6 +47,8 @@ public:
     RenderBox* first();
     RenderBox* next();
 
+    void invalidate();
+
 private:
     void reset();
 
@@ -61,7 +63,7 @@ public:
         , m_childIndex(0)
         , m_allChildrenHaveDefaultOrderValue(true)
     {
-        m_iterator.m_children.clear();
+        m_iterator.invalidate();
     }
 
     ~OrderIteratorPopulator();