Fix crasher in the pdf tear down code path.

The crash occurs because of a timer dereferencing a null engine pointer.
The crash appears to have occurred due to this patch https://codereview.chromium.org/427583003/

Fix is to cancel all timers when the pdf instance is being torn down before
destroying the engine.

BUG=403036

Review URL: https://codereview.chromium.org/462283002

Cr-Commit-Position: refs/heads/master@{#289218}
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@289218 0039d316-1c4b-4281-b951-d872f2087c98

pdf/instance.cc

@@ -307,6 +307,10 @@ Instance::Instance(PP_Instance instance)
 }
 
 Instance::~Instance() {
+  if (timer_pending_) {
+    timer_factory_.CancelAll();
+    timer_pending_ = false;
+  }
   // The engine may try to access this instance during its destruction.
   // Make sure this happens early while the instance is still intact.
   engine_.reset();