Fix use-after-free in base::Timer::StopAndAbandon()

base/timer/timer.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // OneShotTimer and RepeatingTimer provide a simple timer API.  As the names
 // suggest, OneShotTimer calls you back once after a time delay expires.
 // RepeatingTimer on the other hand calls you back periodically with the
 // prescribed time interval.
 //
 // OneShotTimer and RepeatingTimer both cancel the timer when they go out of
@@ skipping 144 matching lines @@
   scoped_refptr<SingleThreadTaskRunner> GetTaskRunner();
 
   // Disable scheduled_task_ and abandon it so that it no longer refers back to
   // this object.
   void AbandonScheduledTask();
 
   // Called by BaseTimerTaskInternal when the MessageLoop runs it.
   void RunScheduledTask();
 
   // Stop running task (if any) and abandon scheduled task (if any).
   void StopAndAbandon() {

[dominickn, 2017/01/12 03:27:17]

Note for base/timer owners: is it worth changing this to be called
AbandonAndStop()?

[gab, 2017/01/12 19:42:54]

No as I'm rewriting all of base::Timer in upcoming
https://codereview.chromium.org/2491613004/ which doesn't have this problem
(although I hadn't explicitly thought of that, it seems I luckily wrote it in a
way that doesn't have this issue I think) -- but thanks for the fix in the mean
time, the regression test will be most useful to make sure the new impl behaves
as expected.

+    AbandonScheduledTask();
+
     Stop();
-    AbandonScheduledTask();
+    // No more member accesses here: *this could be deleted at this point.

[gab, 2017/01/12 19:42:54]

s/*this/|this|/

   }
 
   // When non-NULL, the scheduled_task_ is waiting in the MessageLoop to call
   // RunScheduledTask() at scheduled_run_time_.
   BaseTimerTaskInternal* scheduled_task_;
 
   // The task runner on which the task should be scheduled. If it is null, the
   // task runner for the current thread should be used.
   scoped_refptr<SingleThreadTaskRunner> task_runner_;
 
@@ skipping 123 matching lines @@
 // to link in MSVC. But clang-plugin does not allow inline definitions of
 // virtual methods, so the inline definition lives in the header file here
 // to satisfy both.
 inline void DelayTimer::Reset() {
   Timer::Reset();
 }
 
 }  // namespace base
 
 #endif  // BASE_TIMER_TIMER_H_