Fix UB with LayerTreeImpl::PassSwapPromises usage

cc/trees/layer_tree_host.cc

 // Copyright 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cc/trees/layer_tree_host.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 493 matching lines @@
   }
   // Setting property trees must happen before pushing the page scale.
   sync_tree->SetPropertyTrees(&property_trees_);
 
   sync_tree->PushPageScaleFromMainThread(
       page_scale_factor_, min_page_scale_factor_, max_page_scale_factor_);
   sync_tree->elastic_overscroll()->PushFromMainThread(elastic_overscroll_);
   if (sync_tree->IsActiveTree())
     sync_tree->elastic_overscroll()->PushPendingToActive();
 
-  sync_tree->PassSwapPromises(std::move(swap_promise_list_));

[brianderson, 2016/08/15 17:05:55]

Thanks for catching this!

It would be more straightforward to call swap_promise_list_.clear() after this
line which, looking online, seems to be just as valid.

[svartmetal, 2016/08/15 19:04:33]

Fixed. It's OK to use std::vector::clear since it has no preconditions. On the
other hand, it leaves the capacity() of the vector unchanged (maybe it is better
to use assignment operator instead).

+  {
+    std::vector<std::unique_ptr<SwapPromise>> to_pass;
+    swap_promise_list_.swap(to_pass);
+    sync_tree->PassSwapPromises(std::move(to_pass));
+  }
 
   sync_tree->set_top_controls_shrink_blink_size(
       top_controls_shrink_blink_size_);
   sync_tree->set_top_controls_height(top_controls_height_);
   sync_tree->PushTopControlsFromMainThread(top_controls_shown_ratio_);
 
   host_impl->SetHasGpuRasterizationTrigger(has_gpu_rasterization_trigger_);
   host_impl->SetContentIsSuitableForGpuRasterization(
       content_is_suitable_for_gpu_rasterization_);
   RecordGpuRasterizationHistogram();
@@ skipping 1146 matching lines @@
 
   surface_client_id_ = proto.surface_client_id();
   next_surface_sequence_ = proto.next_surface_sequence();
 }
 
 AnimationHost* LayerTreeHost::animation_host() const {
   return layer_tree_.animation_host();
 }
 
 }  // namespace cc