Revert "Fix sandbox::PolicyBase leak"

sandbox/win/src/broker_services.cc

Index: sandbox/win/src/broker_services.cc
diff --git a/sandbox/win/src/broker_services.cc b/sandbox/win/src/broker_services.cc
index f48014a1afa946482c52377437823e89a4161d95..b33889dcd3f2f15ac52472f2a2c879ecb0e3dc8f 100644
--- a/sandbox/win/src/broker_services.cc
+++ b/sandbox/win/src/broker_services.cc
@@ -54,8 +54,7 @@ enum {
 // Helper structure that allows the Broker to associate a job notification
 // with a job object and with a policy.
 struct JobTracker {
-  JobTracker(base::win::ScopedHandle job,
-             scoped_refptr<sandbox::PolicyBase> policy)
+  JobTracker(base::win::ScopedHandle job, sandbox::PolicyBase* policy)
       : job(std::move(job)), policy(policy) {}
   ~JobTracker() {
     FreeResources();
@@ -66,7 +65,7 @@ struct JobTracker {
   void FreeResources();
 
   base::win::ScopedHandle job;
-  scoped_refptr<sandbox::PolicyBase> policy;
+  sandbox::PolicyBase* policy;
 };
 
 void JobTracker::FreeResources() {
@@ -80,7 +79,8 @@ void JobTracker::FreeResources() {
 
     // In OnJobEmpty() we don't actually use the job handle directly.
     policy->OnJobEmpty(stale_job_handle);
-    policy = nullptr;
+    policy->Release();
+    policy = NULL;
   }
 }
 
@@ -142,13 +142,10 @@ BrokerServicesBase::~BrokerServicesBase() {
   ::DeleteCriticalSection(&lock_);
 }
 
-scoped_refptr<TargetPolicy> BrokerServicesBase::CreatePolicy() {
+TargetPolicy* BrokerServicesBase::CreatePolicy() {
   // If you change the type of the object being created here you must also
   // change the downcast to it in SpawnTarget().
-  scoped_refptr<TargetPolicy> policy(new PolicyBase);
-  // PolicyBase starts with refcount 1.
-  policy->Release();
-  return policy;
+  return new PolicyBase;
 }
 
 // The worker thread stays in a loop waiting for asynchronous notifications
@@ -271,7 +268,7 @@ DWORD WINAPI BrokerServicesBase::TargetEventsThread(PVOID param) {
 // process inside the sandbox.
 ResultCode BrokerServicesBase::SpawnTarget(const wchar_t* exe_path,
                                            const wchar_t* command_line,
-                                           scoped_refptr<TargetPolicy> policy,
+                                           TargetPolicy* policy,
                                            ResultCode* last_warning,
                                            DWORD* last_error,
                                            PROCESS_INFORMATION* target_info) {
@@ -292,7 +289,7 @@ ResultCode BrokerServicesBase::SpawnTarget(const wchar_t* exe_path,
   AutoLock lock(&lock_);
 
   // This downcast is safe as long as we control CreatePolicy()
-  scoped_refptr<PolicyBase> policy_base(static_cast<PolicyBase*>(policy.get()));
+  PolicyBase* policy_base = static_cast<PolicyBase*>(policy);
 
   // Construct the tokens and the job object that we are going to associate
   // with the soon to be created target process.
@@ -444,6 +441,7 @@ ResultCode BrokerServicesBase::SpawnTarget(const wchar_t* exe_path,
 
   // We are going to keep a pointer to the policy because we'll call it when
   // the job object generates notifications using the completion port.
+  policy_base->AddRef();
   if (job.IsValid()) {
     std::unique_ptr<JobTracker> tracker(
         new JobTracker(std::move(job), policy_base));