Heap-use-after-free in WebCore::MutableStylePropertySet::setProperty

Source/core/css/StylePropertySet.cpp

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
  * Copyright (C) 2013 Intel Corporation. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 439 matching lines @@
             return true;
     }
     return false;
 }
 
 bool MutableStylePropertySet::removePropertiesInSet(const CSSPropertyID* set, unsigned length)
 {
     if (m_propertyVector.isEmpty())
         return false;
 
-    WillBeHeapVector<CSSProperty, 4> newProperties;
+    WillBeHeapVector<CSSProperty> newProperties;
     newProperties.reserveInitialCapacity(m_propertyVector.size());
 
     unsigned initialSize = m_propertyVector.size();
     const CSSProperty* properties = m_propertyVector.data();
     for (unsigned n = 0; n < initialSize; ++n) {
         const CSSProperty& property = properties[n];
         // Not quite sure if the isImportant test is needed but it matches the existing behavior.
         if (!property.isImportant() && containsId(set, length, property.id()))
             continue;
         newProperties.append(property);
     }
 
-    m_propertyVector.swap(newProperties);
+    m_propertyVector = newProperties;
     return initialSize != m_propertyVector.size();
 }
 
 CSSProperty* MutableStylePropertySet::findCSSPropertyWithID(CSSPropertyID propertyID)
 {
     int foundPropertyIndex = findPropertyIndex(propertyID);
     if (foundPropertyIndex == -1)
         return 0;
     return &m_propertyVector.at(foundPropertyIndex);
 }
@@ skipping 128 matching lines @@
     result.appendLiteral(": ");
     result.append(propertyValue()->cssText());
     if (isImportant())
         result.appendLiteral(" !important");
     result.append(';');
     return result.toString();
 }
 
 
 } // namespace WebCore