Description:
During the triggering of a callback for a ScaledRangeTimerManagerImpl timer, if another timer in the same queue is disabled such that the queue becomes empty, the queue will be deleted. This will result in a use-after-free error in the loop inside ScaledRangeTimerManagerImpl::onQueueTimerFired when checking !timers.empty().
This issue does not seem to be possible in mainline Envoy, since there are very few places that the scaled range timers are currently used; however, our internal modifications of Envoy have hit this issue and it is reproducible in a unit test.
Repro steps:
See chradcliffe@6666db7 for a minimal unit test that reproduces the issue when run under ASAN.