[CacheStorage] Fix ownership of doomed cache as it's cleaned up

content/browser/cache_storage/cache_storage.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/cache_storage/cache_storage.h"
 
 #include <stddef.h>
 
 #include <set>
 #include <string>
@@ skipping 799 matching lines @@
   cache_map_.erase(map_iter);
 
   cache_loader_->NotifyCacheDoomed(std::move(cache_handle));
 
   callback.Run(true, CACHE_STORAGE_OK);
 }
 
 // Call this once the last handle to a doomed cache is gone. It's okay if this
 // doesn't get to complete before shutdown, the cache will be removed from disk
 // on next startup in that case.
-void CacheStorage::DeleteCacheFinalize(
-    std::unique_ptr<CacheStorageCache> doomed_cache) {
-  CacheStorageCache* cache = doomed_cache.get();
-  cache->Size(base::Bind(&CacheStorage::DeleteCacheDidGetSize,
-                         weak_factory_.GetWeakPtr(),
-                         base::Passed(std::move(doomed_cache))));
+void CacheStorage::DeleteCacheFinalize(CacheStorageCache* doomed_cache) {
+  doomed_cache->Size(base::Bind(&CacheStorage::DeleteCacheDidGetSize,
+                                weak_factory_.GetWeakPtr(), doomed_cache));
 }
 
-void CacheStorage::DeleteCacheDidGetSize(
-    std::unique_ptr<CacheStorageCache> cache,
-    int64_t cache_size) {
+void CacheStorage::DeleteCacheDidGetSize(CacheStorageCache* doomed_cache,
+                                         int64_t cache_size) {
   quota_manager_proxy_->NotifyStorageModified(
       storage::QuotaClient::kServiceWorkerCache, origin_,
       storage::kStorageTypeTemporary, -1 * cache_size);
 
-  cache_loader_->CleanUpDeletedCache(cache.get());
+  cache_loader_->CleanUpDeletedCache(doomed_cache);
+  auto doomed_caches_iter = doomed_caches_.find(doomed_cache);
+  DCHECK(doomed_caches_iter != doomed_caches_.end());
+  doomed_caches_.erase(doomed_caches_iter);
 }
 
 void CacheStorage::EnumerateCachesImpl(const StringsCallback& callback) {
   callback.Run(ordered_cache_names_);
 }
 
 void CacheStorage::MatchCacheImpl(
     const std::string& cache_name,
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& match_params,
@@ skipping 100 matching lines @@
   auto iter = cache_handle_counts_.find(cache);
   DCHECK(iter != cache_handle_counts_.end());
   DCHECK_GE(iter->second, 1U);
 
   iter->second -= 1;
   if (iter->second == 0) {
     cache_handle_counts_.erase(iter);
     auto doomed_caches_iter = doomed_caches_.find(cache);
     if (doomed_caches_iter != doomed_caches_.end()) {
       // The last reference to a doomed cache is gone, perform clean up.
-      DeleteCacheFinalize(std::move(doomed_caches_iter->second));
-      doomed_caches_.erase(doomed_caches_iter);
+      DeleteCacheFinalize(cache);
       return;
     }
 
     auto cache_map_iter = cache_map_.find(cache->cache_name());
     DCHECK(cache_map_iter != cache_map_.end());
 
     cache_map_iter->second.reset();
   }
 }
 
@@ skipping 65 matching lines @@
     std::unique_ptr<CacheStorageCacheHandle> cache_handle =
         GetLoadedCache(cache_name);
     CacheStorageCache* cache = cache_handle->value();
     cache->Size(base::Bind(&SizeRetrievedFromCache,
                            base::Passed(std::move(cache_handle)),
                            barrier_closure, accumulator_ptr));
   }
 }
 
 }  // namespace content