Call reset(nullptr) in scoped_ptr's.

base/memory/scoped_ptr.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Scopers help you manage ownership of a pointer, helping you easily manage a
 // pointer within a scope, and automatically destroying the pointer at the end
 // of a scope.  There are two main classes you will use, which correspond to the
 // operators new/delete and new[]/delete[].
 //
 // Example usage (scoped_ptr<T>):
@@ skipping 198 matching lines @@
 
   template <typename U, typename V>
   void TakeState(scoped_ptr_impl<U, V>* other) {
     // See comment in templated constructor above regarding lack of support
     // for move-only deleters.
     reset(other->release());
     get_deleter() = other->get_deleter();
   }
 
   ~scoped_ptr_impl() {
-    if (data_.ptr != nullptr) {
-      // Not using get_deleter() saves one function call in non-optimized
-      // builds.
-      static_cast<D&>(data_)(data_.ptr);
-    }
+    // Match libc++, which calls reset() in its destructor.
+    // Use nullptr as the new value for three reasons:
+    // 1. libc++ does it.
+    // 2. Avoids infinitely recursing into destructors if two classes are owned
+    //    in a reference cycle (see ScopedPtrTest.ReferenceCycle).
+    // 3. If |this| is accessed in the future, in a use-after-free bug, attempts
+    //    to dereference |this|'s pointer should cause either a failure or a
+    //    segfault closer to the problem. If |this| wasn't reset to nullptr,
+    //    the access would cause the deleted memory to be read or written
+    //    leading to other more subtle issues.
+    reset(nullptr);
   }
 
   void reset(T* p) {
     // This is a self-reset, which is no longer allowed for default deleters:
     // https://crbug.com/162971
     assert(!ShouldAbortOnSelfReset<D>::value || p == nullptr || p != data_.ptr);
 
     // Match C++11's definition of unique_ptr::reset(), which requires changing
     // the pointer before invoking the deleter on the old pointer. This prevents
     // |this| from being accessed after the deleter is run, which may destroy
@@ skipping 338 matching lines @@
 scoped_ptr<T> make_scoped_ptr(T* ptr) {
   return scoped_ptr<T>(ptr);
 }
 
 template <typename T>
 std::ostream& operator<<(std::ostream& out, const scoped_ptr<T>& p) {
   return out << p.get();
 }
 
 #endif  // BASE_MEMORY_SCOPED_PTR_H_