[Nearby] Store callback in FastInitiationManager to fix crash.

FastInitiationManager causes a crash when StopAdvertising() is called
because we move the callback parameter twice. This fixes the issue by
storing the callback as an instance variable.

Bug: 1145850
Change-Id: I5d5f305b558e60e55d0df248305c6da03e15378e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2521837Reviewed-by: Ryan Hansberry <hansberry@chromium.org>
Commit-Queue: Michael Hansen <hansenmichael@google.com>
Cr-Commit-Position: refs/heads/master@{#824603}

chrome/browser/nearby_sharing/fast_initiation_manager.cc

@@ -133,29 +133,28 @@ void FastInitiationManager::OnRegisterAdvertisementError(
 
 void FastInitiationManager::UnregisterAdvertisement(
     base::OnceClosure callback) {
+  stop_callback_ = std::move(callback);
   advertisement_->RemoveObserver(this);
   advertisement_->Unregister(
       base::BindOnce(&FastInitiationManager::OnUnregisterAdvertisement,
-                     weak_ptr_factory_.GetWeakPtr(), std::move(callback)),
+                     weak_ptr_factory_.GetWeakPtr()),
       base::BindOnce(&FastInitiationManager::OnUnregisterAdvertisementError,
-                     weak_ptr_factory_.GetWeakPtr(), std::move(callback)));
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
-void FastInitiationManager::OnUnregisterAdvertisement(
-    base::OnceClosure callback) {
+void FastInitiationManager::OnUnregisterAdvertisement() {
   advertisement_.reset();
-  std::move(callback).Run();
+  std::move(stop_callback_).Run();
   // |this| might be destroyed here, do not access local fields.
 }
 
 void FastInitiationManager::OnUnregisterAdvertisementError(
-    base::OnceClosure callback,
     device::BluetoothAdvertisement::ErrorCode error_code) {
   NS_LOG(WARNING)
       << "FastInitiationManager::StopAdvertising() failed with error code = "
       << error_code;
   advertisement_.reset();
-  std::move(callback).Run();
+  std::move(stop_callback_).Run();
   // |this| might be destroyed here, do not access local fields.
 }
 

chrome/browser/nearby_sharing/fast_initiation_manager.h

@@ -72,9 +72,8 @@ class FastInitiationManager : public device::BluetoothAdvertisement::Observer {
       base::OnceClosure error_callback,
       device::BluetoothAdvertisement::ErrorCode error_code);
   void UnregisterAdvertisement(base::OnceClosure callback);
-  void OnUnregisterAdvertisement(base::OnceClosure callback);
+  void OnUnregisterAdvertisement();
   void OnUnregisterAdvertisementError(
-      base::OnceClosure callback,
       device::BluetoothAdvertisement::ErrorCode error_code);
 
   // Fast Init V1 metadata has 2 bytes, in format
@@ -84,6 +83,7 @@ class FastInitiationManager : public device::BluetoothAdvertisement::Observer {
 
   scoped_refptr<device::BluetoothAdapter> adapter_;
   scoped_refptr<device::BluetoothAdvertisement> advertisement_;
+  base::OnceClosure stop_callback_;
   base::WeakPtrFactory<FastInitiationManager> weak_ptr_factory_{this};
 };