Avoid using already destroyed timers in wxOSX

Check that the timer is still valid before using the associated object.

This is necessary because already queued timer events are still
delivered, even if wxTimer is destroyed.

Closes #25871.

src/osx/core/timer.cpp

@@ -24,11 +24,17 @@ struct wxOSXTimerInfo
     CFRunLoopTimerRef   m_timerRef;
 };
 
-void wxProcessTimer(CFRunLoopTimerRef WXUNUSED(theTimer), void *data)
+void wxProcessTimer(CFRunLoopTimerRef theTimer, void *data)
 {
     if ( data == nullptr )
         return;
 
+    // CFRunLoop can fire timer callbacks after CFRunLoopTimerInvalidate()
+    // has been called (e.g., if the callback was already queued when Stop() was called).
+    // Verify the timer is still valid before proceeding to avoid crashes.
+    if ( !CFRunLoopTimerIsValid(theTimer) )
+        return;
+
     wxOSXTimerImpl* timer = (wxOSXTimerImpl*)data;
 
     if ( timer->IsOneShot() )