[Nearby] Clean up payload listeners

NearbyConnectionsManagerImpl holds a raw ptr to the PayloadTracker and
it was not being cleaned up in all cases when the PayloadTracker was
destroyed.

Fixed: 1145726
Change-Id: I62321c6f9316b4af504d2db01dfa55c871d4c0fe
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2523917
Auto-Submit: James Vecore <vecore@google.com>
Reviewed-by: Ryan Hansberry <hansberry@chromium.org>
Commit-Queue: Ryan Hansberry <hansberry@chromium.org>
Cr-Commit-Position: refs/heads/master@{#825413}

chrome/browser/nearby_sharing/nearby_connections_manager_impl.cc

@@ -341,8 +341,14 @@ void NearbyConnectionsManagerImpl::Cancel(int64_t payload_id) {
 
 void NearbyConnectionsManagerImpl::ClearIncomingPayloads() {
   std::vector<PayloadPtr> payloads;
-  for (auto& it : incoming_payloads_)
+  for (auto& it : incoming_payloads_) {
     payloads.push_back(std::move(it.second));
+    // Make sure to clean up the raw pointer to the payload listener.
+    auto listener_it = payload_status_listeners_.find(it.first);
+    if (listener_it != payload_status_listeners_.end()) {
+      payload_status_listeners_.erase(listener_it);
+    }
+  }
 
   file_handler_.ReleaseFilePayloads(std::move(payloads));
   incoming_payloads_.clear();

chrome/browser/nearby_sharing/nearby_sharing_service_impl.cc

@@ -3362,9 +3362,10 @@ void NearbySharingServiceImpl::UnregisterShareTarget(
         last_incoming_metadata_->first.id == share_target.id) {
       last_incoming_metadata_.reset();
     }
-    incoming_share_target_info_map_.erase(share_target.id);
-    // Clear legacy incoming payloads to release resource
+
+    // Clear legacy incoming payloads to release resource.
     nearby_connections_manager_->ClearIncomingPayloads();
+    incoming_share_target_info_map_.erase(share_target.id);
   } else {
     if (last_outgoing_metadata_ &&
         last_outgoing_metadata_->first.id == share_target.id) {