[Extensions] Use a WeakPtr in ManagedValueStoreCache

When posting a task, use a WeakPtr instead of base::Unretained().

Bug: 1304545
Change-Id: I5b2a1e48366a9d0dfaae9f4414f4336cdd5b4a2f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3523211
Reviewed-by: David Bertoni <dbertoni@chromium.org>
Commit-Queue: Devlin Cronin <rdevlin.cronin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#981406}

chrome/browser/extensions/api/storage/managed_value_store_cache.cc

@@ -13,7 +13,6 @@
 #include "base/check_op.h"
 #include "base/files/file_util.h"
 #include "base/memory/raw_ptr.h"
-#include "base/memory/weak_ptr.h"
 #include "base/one_shot_event.h"
 #include "base/scoped_observation.h"
 #include "build/chromeos_buildflags.h"
@@ -317,10 +316,14 @@ void ManagedValueStoreCache::OnPolicyUpdated(const policy::PolicyNamespace& ns,
     return;
   }
 
+  // This WeakPtr usage *should* be safe. Even though we are "vending" WeakPtrs
+  // from the UI thread, they are only ever dereferenced or invalidated from
+  // the background sequence, since this object is destroyed on the
+  // background sequence.
   GetBackendTaskRunner()->PostTask(
-      FROM_HERE,
-      base::BindOnce(&ManagedValueStoreCache::UpdatePolicyOnBackend,
-                     base::Unretained(this), ns.component_id, current.Clone()));
+      FROM_HERE, base::BindOnce(&ManagedValueStoreCache::UpdatePolicyOnBackend,
+                                weak_ptr_factory_.GetWeakPtr(), ns.component_id,
+                                current.Clone()));
 }
 
 // static

chrome/browser/extensions/api/storage/managed_value_store_cache.h

@@ -11,6 +11,7 @@
 
 #include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
+#include "base/memory/weak_ptr.h"
 #include "components/policy/core/common/policy_namespace.h"
 #include "components/policy/core/common/policy_service.h"
 #include "extensions/browser/api/storage/settings_observer.h"
@@ -105,6 +106,8 @@ class ManagedValueStoreCache : public ValueStoreCache,
   // All the PolicyValueStores live on the FILE thread, and |store_map_| can be
   // accessed only on the FILE thread as well.
   std::map<std::string, std::unique_ptr<PolicyValueStore>> store_map_;
+
+  base::WeakPtrFactory<ManagedValueStoreCache> weak_ptr_factory_{this};
 };
 
 }  // namespace extensions