From 9db4bb6bc0779337c6d64501ca2e28e67ed39689 Mon Sep 17 00:00:00 2001
From: Christopher Kohlhoff <chris@kohlhoff.com>
Date: Thu, 1 Nov 2007 22:42:26 +0000
Subject: [PATCH] Fix memory leak when an io_service is allowed to destruct
 with unfinished async_wait operations.

[SVN r40670]
---
 include/boost/asio/detail/timer_queue.hpp | 25 +++++++++++++++--------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/include/boost/asio/detail/timer_queue.hpp b/include/boost/asio/detail/timer_queue.hpp
index 1d126e9b..4a04a6b5 100644
--- a/include/boost/asio/detail/timer_queue.hpp
+++ b/include/boost/asio/detail/timer_queue.hpp
@@ -163,13 +163,7 @@ public:
   // Destroy timers that are waiting to be cleaned up.
   virtual void cleanup_timers()
   {
-    while (cleanup_timers_)
-    {
-      timer_base* next_timer = cleanup_timers_->next_;
-      cleanup_timers_->next_ = 0;
-      cleanup_timers_->destroy();
-      cleanup_timers_ = next_timer;
-    }
+    destroy_timer_list(cleanup_timers_);
   }
 
   // Destroy all timers.
@@ -182,11 +176,12 @@ public:
       timer_base* t = i->second;
       typename hash_map<void*, timer_base*>::iterator old_i = i++;
       timers_.erase(old_i);
-      t->destroy();
+      destroy_timer_list(t);
     }
     heap_.clear();
     timers_.clear();
-    cleanup_timers();
+    destroy_timer_list(cancelled_timers_);
+    destroy_timer_list(cleanup_timers_);
   }
 
 private:
@@ -368,6 +363,18 @@ private:
     }
   }
 
+  // Destroy all timers in a linked list.
+  void destroy_timer_list(timer_base*& t)
+  {
+    while (t)
+    {
+      timer_base* next = t->next_;
+      t->next_ = 0;
+      t->destroy();
+      t = next;
+    }
+  }
+
   // A hash of timer token to linked lists of timers.
   hash_map<void*, timer_base*> timers_;