Fix use-after-free in base::Timer::StopAndAbandon()

base/timer/timer.h

Index: base/timer/timer.h
diff --git a/base/timer/timer.h b/base/timer/timer.h
index 50aedbd4cec28e97c408b2acd8b896c70526732c..dae04356e8bdcb0c755e9e6a622dd11caa34c974 100644
--- a/base/timer/timer.h
+++ b/base/timer/timer.h
@@ -163,8 +163,10 @@ class BASE_EXPORT Timer {
 
   // Stop running task (if any) and abandon scheduled task (if any).
   void StopAndAbandon() {

[dominickn, 2017/01/12 03:27:17]

Note for base/timer owners: is it worth changing this to be called
AbandonAndStop()?

[gab, 2017/01/12 19:42:54]

No as I'm rewriting all of base::Timer in upcoming
https://codereview.chromium.org/2491613004/ which doesn't have this problem
(although I hadn't explicitly thought of that, it seems I luckily wrote it in a
way that doesn't have this issue I think) -- but thanks for the fix in the mean
time, the regression test will be most useful to make sure the new impl behaves
as expected.

-    Stop();
     AbandonScheduledTask();
+
+    Stop();
+    // No more member accesses here: *this could be deleted at this point.

[gab, 2017/01/12 19:42:54]

s/*this/|this|/

   }
 
   // When non-NULL, the scheduled_task_ is waiting in the MessageLoop to call