Found a bug in the BaseTimer (used by OneShotTimer)....

Found a bug in the BaseTimer (used by OneShotTimer).

If you have a OneShotTimer pending, and you destroy your
message loop, the cleanup of the timer will use memory
which was already freed by the MessageLoop.  When the
MessageLoop shuts down, it deletes pending tasks.
BaseTimer did not provide a virtual destructor to cleanup
its "base".  Thus, when the actual OneShotTimer cleaned
up, it would use deleted memory.

This manifested for me when I had accidentally had cleanup
of a oneshottimer occurring through the Singleton, which 
occurs AtExit, after the messageloop is already gone.

Created a unit test for this, which does trip the assert due
to heap corruption. 


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=6190

[Mike Belshe, 2008-12-01 22:24:58]

Add Jar/Nicolas to the reviewer list while Darin is out

[Nicolas Sylvain, 2008-12-01 22:53:39]

LGTM

[jar (doing other things), 2008-12-02 00:34:22]

LGTM

[darin (slow to review), 2008-12-02 01:37:22]

LGTM

http://codereview.chromium.org/13023/diff/1/3
File base/timer.h (right):

http://codereview.chromium.org/13023/diff/1/3#newcode139
Line 139: virtual ~TimerTask() {
It is nice that delayed Tasks have the guarantee of being destroyed if not Run. 
We should work to make the same thing be true for non-delayed Tasks.

It would be good to add a comment about the significance of this ClearBaseTimer
call w.r.t. MessageLoop destruction.