Bug 605307 - nsGeolocation::ClearWatch crash. r=jst a=blocking-betaN

--HG--
extra : rebase_source : 57c426d4196d6951a3a59f806f37051b51904789

dom/src/geolocation/nsGeolocation.cpp

@@ -1074,7 +1074,7 @@ NS_IMETHODIMP
 nsGeolocation::ClearWatch(PRInt32 aWatchId)
 {
   PRUint32 count = mWatchingCallbacks.Length();
-  if (aWatchId < 0 || count == 0 || PRUint32(aWatchId) > count)
+  if (aWatchId < 0 || count == 0 || PRUint32(aWatchId) >= count)
     return NS_OK;
 
   mWatchingCallbacks[aWatchId]->MarkCleared();

dom/tests/mochitest/geolocation/test_clearWatch_invalid.html

@@ -19,6 +19,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=463039
 <pre id="test">
 <script class="testbody" type="text/javascript">
 
+resume_geolocationProvider();
+force_prompt(true);
+navigator.geolocation.watchPosition(function(){});
+
 // there are no watches, so this should always throw
 for (x=-10; x<10; x++) {
     navigator.geolocation.clearWatch(x);
@@ -28,6 +32,7 @@ for (x=-10; x<10; x++) {
 // lets try something huge
 navigator.geolocation.clearWatch(Number.MAX_VALUE);
 ok(1, "clearWatch should not throw");
+reset_prompt();
     
 </script>
 </pre>