REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox
[WebKit-https.git] / Source / WebCore / rendering / RenderFlexibleBox.cpp
index 612c4d3..fb41e8c 100644 (file)
@@ -1392,4 +1392,10 @@ bool RenderFlexibleBox::isLeftLayoutOverflowAllowed() const
     return isHorizontalFlow();
 }
 
+void RenderFlexibleBox::removeChild(RenderObject& child)
+{
+    RenderBlock::removeChild(child);
+    m_orderIterator.invalidate();
+}
+
 }