Revert "Fix sandbox::PolicyBase leak"

sandbox/win/sandbox_poc/main_ui_window.cc

 // Copyright (c) 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sandbox/win/sandbox_poc/main_ui_window.h"
 
 #include <windows.h>
 #include <CommCtrl.h>
 #include <commdlg.h>
 #include <stdarg.h>
@@ skipping 482 matching lines @@
     return false;
   }
 
   wchar_t * arguments = new wchar_t[size_call];
   wnsprintf(arguments, static_cast<int>(size_call), L"%ls %ls \"%ls\" %ls",
             spawn_target_.c_str(), entry_point_.c_str(),
             dll_path_.c_str(), log_pipe);
 
   arguments[size_call - 1] = L'\0';
 
-  scoped_refptr<sandbox::TargetPolicy> policy = broker_->CreatePolicy();
+  sandbox::TargetPolicy* policy = broker_->CreatePolicy();
   policy->SetJobLevel(sandbox::JOB_LOCKDOWN, 0);
   policy->SetTokenLevel(sandbox::USER_RESTRICTED_SAME_ACCESS,
                         sandbox::USER_LOCKDOWN);
   policy->SetAlternateDesktop(true);
   policy->SetDelayedIntegrityLevel(sandbox::INTEGRITY_LEVEL_LOW);
 
   // Set the rule to allow the POC dll to be loaded by the target. Note that
   // the rule allows 'all access' to the DLL, which could mean that the target
   // could modify the DLL on disk.
   policy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
                   sandbox::TargetPolicy::FILES_ALLOW_ANY, dll_path_.c_str());
 
   sandbox::ResultCode warning_result = sandbox::SBOX_ALL_OK;
   DWORD last_error = ERROR_SUCCESS;
   sandbox::ResultCode result =
       broker_->SpawnTarget(spawn_target_.c_str(), arguments, policy,
                            &warning_result, &last_error, &target_);
 
+  policy->Release();
   policy = NULL;
 
   bool return_value = false;
   if (sandbox::SBOX_ALL_OK != result) {
     AddDebugMessage(
         L"Failed to spawn target %ls w/args (%ls), sandbox error code: %d",
         spawn_target_.c_str(), arguments, result);
     return_value = false;
   } else {
     DWORD thread_id;
@@ skipping 123 matching lines @@
   item.iItem = ListView_GetItemCount(list_view_);
   item.iSubItem = 0;
   item.mask = LVIF_TEXT | LVIF_PARAM;
   item.pszText = message_time;
   item.lParam = 0;
 
   ListView_InsertItem(list_view_, &item);
 
   delete[] message_time;
 }