Patch from Julie DeWandel.

This patch has solved the crashes observed during TPC-C runs on the
16-way box.  (I'm confident it will fix the other reported cases as
well.)

The race is the setting of timer->base to NULL, by del_timer() or
__run_timers().  If new_base == old_base in __mod_timer() then we do not
re-check timer->base after getting the lock.  (the only case where we do
not have to re-check the base is in the !old_base case, but the else
branch also includes the old_base==new_base case.)

The __run_timers() case made the lock_timer() patch not work fully - we
cannot use lock_timer() in __run_timers() due to lock ordering.