REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox

[WebKit-https.git] / Source / WebCore / rendering / RenderGrid.cpp

diff --git a/Source/WebCore/rendering/RenderGrid.cpp b/Source/WebCore/rendering/RenderGrid.cpp
index 13ae483..9c17b09 100644 (file)
--- a/Source/WebCore/rendering/RenderGrid.cpp
+++ b/Source/WebCore/rendering/RenderGrid.cpp
@@ -1186,6 +1186,12 @@ const char* RenderGrid::renderName() const
     return "RenderGrid";
 }
 
+void RenderGrid::removeChild(RenderObject& child)
+{
+    RenderBlock::removeChild(child);
+    m_orderIterator.invalidate();
+}
+
 } // namespace WebCore
 
 #endif /* ENABLE(CSS_GRID_LAYOUT) */