[IndexedDB] Fixed possible refcount race

content/browser/indexed_db/indexed_db_context_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_context_impl.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 449 matching lines @@
   QueryDiskAndUpdateQuotaUsage(origin);
 }
 
 void IndexedDBContextImpl::DatabaseDeleted(const Origin& origin) {
   AddToOriginSet(origin);
   QueryDiskAndUpdateQuotaUsage(origin);
 }
 
 IndexedDBContextImpl::~IndexedDBContextImpl() {
   if (factory_.get()) {
-    TaskRunner()->PostTask(
-        FROM_HERE, base::Bind(&IndexedDBFactory::ContextDestroyed, factory_));
-    factory_ = NULL;

[pwnall, 2017/05/19 00:16:32]

why not nullptr?

+    TaskRunner()->PostTask(FROM_HERE,
+                           base::Bind(&IndexedDBFactory::ContextDestroyed,
+                                      base::Passed(&factory_)));
   }
 
   if (data_path_.empty())
     return;
 
   if (force_keep_session_state_)
     return;
 
   bool has_session_only_databases =
       special_storage_policy_.get() &&
@@ skipping 80 matching lines @@
 void IndexedDBContextImpl::ResetCaches() {
   origin_set_.reset();
   origin_size_map_.clear();
 }
 
 base::SequencedTaskRunner* IndexedDBContextImpl::TaskRunner() const {
   return task_runner_.get();
 }
 
 }  // namespace content