[PasswordManager] Fix for PasswordStoreX::UpdateMigrationPref()

In PasswordStoreX

migration_step_pref_ gets destroyed on the UI thread in
PasswordStoreX::ShutdownOnUIThread() but there could be already a
task posted in PasswordStoreX::UpdateMigrationToLoginDBStep() that
would actually consume the destroyed pref.

We should invalidate the weak pointer when destroying the
migration_step_pref_ to make sure any posted tasks are preempted!

Change-Id: I7af97af346c61d352e8a294ce4998e641c8f08f6
Bug: 988417
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1722841
Commit-Queue: Mohamed Amir Yosef <mamir@chromium.org>
Auto-Submit: Mohamed Amir Yosef <mamir@chromium.org>
Reviewed-by: Christos Froussios <cfroussios@chromium.org>
Reviewed-by: Vasilii Sukhanov <vasilii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#681781}

chrome/browser/password_manager/password_store_x.cc

@@ -529,6 +529,11 @@ void PasswordStoreX::UpdateMigrationPref(MigrationToLoginDBStep step) {
 
 void PasswordStoreX::ShutdownOnUIThread() {
   migration_step_pref_.Destroy();
+  // Invalidate the weak pointer to preempt any posted tasks in
+  // UpdateMigrationToLoginDBStep() because they cannot use the
+  // |migration_step_pref_| anymore. Both ShutdownOnUIThread() and
+  // UpdateMigrationToLoginDBStep() are only executed on the UI thread.
+  weak_ptr_factory_.InvalidateWeakPtrs();
   PasswordStoreDefault::ShutdownOnUIThread();
 }