Fix use-after-free in base::Timer::StopAndAbandon()

base/timer/timer.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // OneShotTimer and RepeatingTimer provide a simple timer API.  As the names
 // suggest, OneShotTimer calls you back once after a time delay expires.
 // RepeatingTimer on the other hand calls you back periodically with the
 // prescribed time interval.
 //
 // OneShotTimer and RepeatingTimer both cancel the timer when they go out of
@@ skipping 145 matching lines @@
 
   // Disable scheduled_task_ and abandon it so that it no longer refers back to
   // this object.
   void AbandonScheduledTask();
 
   // Called by BaseTimerTaskInternal when the MessageLoop runs it.
   void RunScheduledTask();
 
   // Stop running task (if any) and abandon scheduled task (if any).
   void StopAndAbandon() {
+    AbandonScheduledTask();
+
     Stop();
-    AbandonScheduledTask();
+    // No more member accesses here: |this| could be deleted at this point.
   }
 
   // When non-NULL, the scheduled_task_ is waiting in the MessageLoop to call
   // RunScheduledTask() at scheduled_run_time_.
   BaseTimerTaskInternal* scheduled_task_;
 
   // The task runner on which the task should be scheduled. If it is null, the
   // task runner for the current thread should be used.
   scoped_refptr<SingleThreadTaskRunner> task_runner_;
 
@@ skipping 123 matching lines @@
 // to link in MSVC. But clang-plugin does not allow inline definitions of
 // virtual methods, so the inline definition lives in the header file here
 // to satisfy both.
 inline void DelayTimer::Reset() {
   Timer::Reset();
 }
 
 }  // namespace base
 
 #endif  // BASE_TIMER_TIMER_H_