Heap-use-after-free in WebCore::MutableStylePropertySet::setProperty

Source/core/css/StylePropertySet.cpp

Index: Source/core/css/StylePropertySet.cpp
diff --git a/Source/core/css/StylePropertySet.cpp b/Source/core/css/StylePropertySet.cpp
index 93a86b94b5a0f1bd0bc84018391f16254f8d38af..b667894ef316328d0f51eb4dd99d54a19cf235b4 100644
--- a/Source/core/css/StylePropertySet.cpp
+++ b/Source/core/css/StylePropertySet.cpp
@@ -457,7 +457,7 @@ bool MutableStylePropertySet::removePropertiesInSet(const CSSPropertyID* set, un
     if (m_propertyVector.isEmpty())
         return false;
 
-    WillBeHeapVector<CSSProperty, 4> newProperties;
+    WillBeHeapVector<CSSProperty> newProperties;
     newProperties.reserveInitialCapacity(m_propertyVector.size());
 
     unsigned initialSize = m_propertyVector.size();
@@ -470,7 +470,7 @@ bool MutableStylePropertySet::removePropertiesInSet(const CSSPropertyID* set, un
         newProperties.append(property);
     }
 
-    m_propertyVector.swap(newProperties);
+    m_propertyVector = newProperties;
     return initialSize != m_propertyVector.size();
 }