Fixes a crashing Geolocation bug when a watch is cleared from certain callbacks.

BUG: http://b/2297475

This will be upstreamed to webkit.org in https://bugs.webkit.org/show_bug.cgi?id=32111

Change-Id: I70c3076b1a85c89bc4c587ea9fedaa84bd7b0575

1 files changed, 7 insertions, 3 deletions

diff --git a/WebCore/page/Geolocation.cpp b/WebCore/page/Geolocation.cpp
index e0352dd..978a1b0 100644
--- a/WebCore/page/Geolocation.cpp
+++ b/WebCore/page/Geolocation.cpp
@@ -87,17 +87,21 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
 {
     m_timer.stop();
 
+    // Cache our pointer to the Geolocation object, as this object could be
+    // deleted by a call to clearWatch in a callback.
+    Geolocation* geolocation = m_geolocation;
+
     if (m_fatalError) {
         if (m_errorCallback)
             m_errorCallback->handleEvent(m_fatalError.get());
         // This will cause this notifier to be deleted.
-        m_geolocation->fatalErrorOccurred(this);
+        geolocation->fatalErrorOccurred(this);
         return;
     }
 
     if (m_cachedPosition) {
         m_successCallback->handleEvent(m_cachedPosition.get());
-        m_geolocation->requestReturnedCachedPosition(this);
+        geolocation->requestReturnedCachedPosition(this);
         return;
     }
 
@@ -105,7 +109,7 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
         RefPtr<PositionError> error = PositionError::create(PositionError::TIMEOUT, "Timeout expired");
         m_errorCallback->handleEvent(error.get());
     }
-    m_geolocation->requestTimedOut(this);
+    geolocation->requestTimedOut(this);
 }
 
 void Geolocation::Watchers::set(int id, PassRefPtr<GeoNotifier> notifier)