REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox