REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox

[WebKit-https.git] / Source / WebCore / rendering / RenderFlexibleBox.cpp

diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index 612c4d3..fb41e8c 100644 (file)
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -1392,4 +1392,10 @@ bool RenderFlexibleBox::isLeftLayoutOverflowAllowed() const
     return isHorizontalFlow();
 }
 
+void RenderFlexibleBox::removeChild(RenderObject& child)
+{
+    RenderBlock::removeChild(child);
+    m_orderIterator.invalidate();
+}
+
 }