ServiceWorker: Fix registration refcount handling in the renderer

- ServiceWorkerRegistrationHandleReference::Create() should increment registration refcount
- ServiceWorkerMessageFilter::OnStaleSetVersionAttributes shouldn’t decrement registration refcount

TEST=n/a
BUG=452403

Review URL: https://codereview.chromium.org/868483008

Cr-Commit-Position: refs/heads/master@{#313497}

content/child/service_worker/service_worker_message_filter.cc

@@ -104,8 +104,8 @@ void ServiceWorkerMessageFilter::OnStaleSetVersionAttributes(
                                    attrs.waiting.handle_id);
   SendServiceWorkerObjectDestroyed(thread_safe_sender_.get(),
                                    attrs.active.handle_id);
-  SendRegistrationObjectDestroyed(thread_safe_sender_.get(),
-                                  registration_handle_id);
+  // Don't have to decrement registration refcount because the sender of the
+  // SetVersionAttributes message doesn't increment it.
 }
 
 void ServiceWorkerMessageFilter::OnStaleSetControllerServiceWorker(

content/child/service_worker/service_worker_registration_handle_reference.cc

@@ -34,7 +34,7 @@ ServiceWorkerRegistrationHandleReference(
       sender_(sender) {
   DCHECK_NE(kInvalidServiceWorkerRegistrationHandleId, info_.handle_id);
   DCHECK(sender_.get());
-  if (increment_ref_in_ctor)
+  if (!increment_ref_in_ctor)
     return;
   sender_->Send(
       new ServiceWorkerHostMsg_IncrementRegistrationRefCount(info_.handle_id));