Found a bug in the BaseTimer (used by OneShotTimer).
If you have a OneShotTimer pending, and you destroy your
message loop, the cleanup of the timer will use memory
which was already freed by the MessageLoop. When the
MessageLoop shuts down, it deletes pending tasks.
BaseTimer did not provide a virtual destructor to cleanup
its "base". Thus, when the actual OneShotTimer cleaned
up, it would use deleted memory.
This manifested for me when I had accidentally had cleanup
of a oneshottimer occurring through the Singleton, which
occurs AtExit, after the messageloop is already gone.
Created a unit test for this, which does trip the assert due
to heap corruption.
Review URL: http://codereview.chromium.org/13023
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@6190 0039d316-1c4b-4281-b951-d872f2087c98
CrOS-Libchrome-Original-Commit: 2fefef1a5e1f86058e3b79d5b6e139440bec4251
2 files changed