Fix UB with LayerTreeImpl::PassSwapPromises usage

cc/trees/layer_tree_impl.cc

 // Copyright 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cc/trees/layer_tree_impl.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 408 matching lines @@
   // offsets when UpdateViewportContainerSizes is called from e.g.
   // PushTopControls
   target_tree->UpdatePropertyTreesForBoundsDelta();
 
   if (next_activation_forces_redraw_) {
     target_tree->ForceRedrawNextActivation();
     next_activation_forces_redraw_ = false;
   }
 
   target_tree->PassSwapPromises(std::move(swap_promise_list_));
+  swap_promise_list_.clear();
 
   target_tree->set_top_controls_shrink_blink_size(
       top_controls_shrink_blink_size_);
   target_tree->set_top_controls_height(top_controls_height_);
   target_tree->PushTopControls(nullptr);
 
   // Active tree already shares the page_scale_factor object with pending
   // tree so only the limits need to be provided.
   target_tree->PushPageScaleFactorAndLimits(nullptr, min_page_scale_factor(),
                                             max_page_scale_factor());
@@ skipping 1626 matching lines @@
 
 void LayerTreeImpl::ResetAllChangeTracking() {
   layers_that_should_push_properties_.clear();
   // Iterate over all layers, including masks and replicas.
   for (auto& layer : *layers_)
     layer->ResetChangeTracking();
   property_trees_.ResetAllChangeTracking();
 }
 
 }  // namespace cc