Call reset(nullptr) in scoped_ptr's.

base/memory/scoped_ptr.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Scopers help you manage ownership of a pointer, helping you easily manage a
 // pointer within a scope, and automatically destroying the pointer at the end
 // of a scope.  There are two main classes you will use, which correspond to the
 // operators new/delete and new[]/delete[].
 //
 // Example usage (scoped_ptr<T>):
@@ skipping 199 matching lines @@
   template <typename U, typename V>
   void TakeState(scoped_ptr_impl<U, V>* other) {
     // See comment in templated constructor above regarding lack of support
     // for move-only deleters.
     reset(other->release());
     get_deleter() = other->get_deleter();
   }
 
   ~scoped_ptr_impl() {
     if (data_.ptr != nullptr) {
+      // Even though |this| should no longer be accessed after destruction,
+      // there may be use-after-free bugs. Setting |data_.ptr| to null should
+      // cause many attempts to dereference |this| to segfault closer to the
+      // source of the use-after-free. Of course, this may not catch issues if
+      // the memory is immediately re-allocated and altered.
+      // Set the value to nullptr before running the deleter in case the deleter
+      // references |this|. Unlike libc++, we can't call reset() because reset()
+      // references |this| after running the deleter.

[Peter Kasting, 2015/09/23 01:14:39]

It looks like reset() was changed to an intermediate state that should flush out
any bugs where code relied on the old ordering about 2.5 years ago.  So it ought
to be safe to go ahead and change reset()'s ordering to match libc++ now, close
bug 176091, and then have this use reset() like libc++ does.

[Anand Mistry (off Chromium), 2015/09/23 01:44:52]

Despite being small, I think that's a significant enough change to deserve it's
own CL.

[Peter Kasting, 2015/09/23 01:52:58]

That's fine; why not do that first and then make a change to this function so
you can move directly to that implementation?

[Anand Mistry (off Chromium), 2015/09/23 04:48:04]

Done.

+      T* old = data_.ptr;
+      data_.ptr = nullptr;
       // Not using get_deleter() saves one function call in non-optimized
       // builds.
-      static_cast<D&>(data_)(data_.ptr);
+      static_cast<D&>(data_)(old);
     }
   }
 
   void reset(T* p) {
     // This is a self-reset, which is no longer allowed for default deleters:
     // https://crbug.com/162971
     assert(!ShouldAbortOnSelfReset<D>::value || p == nullptr || p != data_.ptr);
 
     // Note that running data_.ptr = p can lead to undefined behavior if
     // get_deleter()(get()) deletes this. In order to prevent this, reset()
@@ skipping 350 matching lines @@
 scoped_ptr<T> make_scoped_ptr(T* ptr) {
   return scoped_ptr<T>(ptr);
 }
 
 template <typename T>
 std::ostream& operator<<(std::ostream& out, const scoped_ptr<T>& p) {
   return out << p.get();
 }
 
 #endif  // BASE_MEMORY_SCOPED_PTR_H_