Heap-use-after-free in WebCore::MutableStylePropertySet::setProperty

Heap-use-after-free in WebCore::MutableStylePropertySet::setProperty

This patch fixes heap-use-after-free error (regression caused by r171246)
in the 'MutableStylePropertySet::setProperty' method. This error turned
up as the 'setProperty' method argument contained a pointer from the vector
buffer which had been previously freed (as we started to use 'Vector::swap'
instead of assignment operator).

BUG=362310
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=171466

[Mikhail, 2014-04-11 09:58:39]

PTAL

[eseidel, 2014-04-11 15:16:26]

lgtm

[commit-bot: I haz the power, 2014-04-11 15:16:29]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/mikhail.pozdnyakov@intel.com/234823004/1

[eseidel, 2014-04-11 15:17:09]

Because of the inline capacity?  Why would freeing the stack buffer cause the
other buffer's storage to free if they swapped?

[commit-bot: I haz the power, 2014-04-11 15:18:17]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-04-11 15:18:18]

Try jobs failed on following builders:
  tryserver.blink on linux_blink_dbg

[Mikhail, 2014-04-14 07:40:38]

On 2014/04/11 15:17:09, eseidel wrote:
> Because of the inline capacity?  Why would freeing the stack buffer cause the
> other buffer's storage to free if they swapped?

The actual buffer is not inlined when the problem occurs (because the actual
count of the elements is more than '4')

[Mikhail, 2014-04-14 10:24:28]

On 2014/04/14 07:40:38, mikhail.pozdnyakov wrote:
> On 2014/04/11 15:17:09, eseidel wrote:
> > Because of the inline capacity?  Why would freeing the stack buffer cause
the
> > other buffer's storage to free if they swapped?
> 
> The actual buffer is not inlined when the problem occurs (because the actual
> count of the elements is more than '4')

Can I commit the patch (as I understand the bug is in priority)?

[eseidel, 2014-04-14 14:49:58]

lgtm

It's still not clear to me why swap doesn't work, but ok.

[commit-bot: I haz the power, 2014-04-14 14:50:09]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/mikhail.pozdnyakov@intel.com/234823004/1

[commit-bot: I haz the power, 2014-04-14 14:50:36]

Change committed as 171466