Redo fix from yesterday....

base/timer.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // OneShotTimer and RepeatingTimer provide a simple timer API.  As the names
 // suggest, OneShotTimer calls you back once after a time delay expires.
 // RepeatingTimer on the other hand calls you back periodically with the
 // prescribed time interval.
 //
 // OneShotTimer and RepeatingTimer both cancel the timer when they go out of
@@ skipping 64 matching lines @@
 
  protected:
   BaseTimer_Helper() : delayed_task_(NULL) {}
 
   // We have access to the timer_ member so we can orphan this task.
   class TimerTask : public Task {
    public:
     TimerTask(TimeDelta delay) : delay_(delay) {
       // timer_ is set in InitiateDelayedTask.
     }
+    virtual ~TimerTask() {}
     BaseTimer_Helper* timer_;
     TimeDelta delay_;
   };
 
   // Used to orphan delayed_task_ so that when it runs it does nothing.
   void OrphanDelayedTask();
   
   // Used to initiated a new delayed task.  This has the side-effect of
   // orphaning delayed_task_ if it is non-null.
   void InitiateDelayedTask(TimerTask* timer_task);
@@ skipping 33 matching lines @@
  private:
   typedef BaseTimer<Receiver, kIsRepeating> SelfType;
   
   class TimerTask : public BaseTimer_Helper::TimerTask {
    public:
     TimerTask(TimeDelta delay, Receiver* receiver, ReceiverMethod method)
         : BaseTimer_Helper::TimerTask(delay),
           receiver_(receiver),
           method_(method) {
     }
+
+    virtual ~TimerTask() {
+      // This task may be getting cleared because the MessageLoop has been
+      // destructed.  If so, don't leave the Timer with a dangling pointer
+      // to this now-defunct task.
+      ClearBaseTimer();
+    }
+
     virtual void Run() {
       if (!timer_)  // timer_ is null if we were orphaned.
         return;
-      SelfType* self = static_cast<SelfType*>(timer_);
-      if (kIsRepeating) {
-        self->Reset();
-      } else {
-        self->delayed_task_ = NULL;
-      }
+      if (kIsRepeating)
+        ResetBaseTimer();
+      else
+        ClearBaseTimer();
       DispatchToMethod(receiver_, method_, Tuple0());
     }
+
     TimerTask* Clone() const {
       return new TimerTask(delay_, receiver_, method_);
     }
+
    private:
+    // Inform the Base that the timer is no longer active.
+    void ClearBaseTimer() {
+      if (timer_) {
+        SelfType* self = static_cast<SelfType*>(timer_);
+        // It is possible that the Timer has already been reset, and that this
+        // Task is old.  So, if the Timer points to a different task, assume
+        // that the Timer has already taken care of properly setting the task.
+        if (self->delayed_task_ == this)
+          self->delayed_task_ = NULL;
+      }
+    }
+
+    // Inform the Base that we're resetting the timer.
+    void ResetBaseTimer() {
+      DCHECK(timer_);
+      DCHECK(kIsRepeating);
+      SelfType* self = static_cast<SelfType*>(timer_);
+      self->Reset();
+    }
+
     Receiver* receiver_;
     ReceiverMethod method_;
   };
 };
 
 //-----------------------------------------------------------------------------
 // A simple, one-shot timer.  See usage notes at the top of the file.
 template <class Receiver>
 class OneShotTimer : public BaseTimer<Receiver, false> {};
 
 //-----------------------------------------------------------------------------
 // A simple, repeating timer.  See usage notes at the top of the file.
 template <class Receiver>
 class RepeatingTimer : public BaseTimer<Receiver, true> {};
 
 }  // namespace base
 
 #endif  // BASE_TIMER_H_