fixing tomorrow's blocker today (115527). r=ben sr=mscott

xpcom/threads/TimerThread.cpp

@@ -127,7 +127,7 @@ NS_IMETHODIMP TimerThread::Run()
   mProcessing = PR_TRUE;
 
   while (mProcessing) {
-    nsCOMPtr<nsTimerImpl> theTimer;
+    nsTimerImpl *theTimer = nsnull;
 
     if (mTimers.Count() > 0) {
       nsAutoLock lock(mLock);
@@ -141,6 +141,7 @@ NS_IMETHODIMP TimerThread::Run()
 #endif
         RemoveTimerInternal(timer);
         theTimer = timer;
+        NS_ADDREF(theTimer);
       }
     }
 
@@ -151,7 +152,12 @@ NS_IMETHODIMP TimerThread::Run()
         ((now > theTimer->mTimeout) ? PR_IntervalToMilliseconds(now - theTimer->mTimeout) :
                                       -(PRInt32)PR_IntervalToMilliseconds(theTimer->mTimeout - now))));
 #endif
+
+      // We are going to let the call to Fire here handle the release of the timer so that
+      // we don't end up releasing the timer on the TimerThread
       theTimer->Fire();
+
+      theTimer = nsnull;
     }
 
     nsAutoLock lock(mLock);

xpcom/threads/nsTimerImpl.cpp

@@ -89,7 +89,8 @@ PR_STATIC_CALLBACK(PRStatus) InitThread(void)
 nsTimerImpl::nsTimerImpl() :
   mClosure(nsnull),
   mCallbackType(CALLBACK_TYPE_UNKNOWN),
-  mFiring(PR_FALSE)
+  mFiring(PR_FALSE),
+  mCancelled(PR_FALSE)
 {
   NS_INIT_REFCNT();
   nsIThread::GetCurrent(getter_AddRefs(mCallingThread));
@@ -107,9 +108,8 @@ nsTimerImpl::nsTimerImpl() :
 
 nsTimerImpl::~nsTimerImpl()
 {
-  mClosure = nsnull;
+  if (mCallbackType == CALLBACK_TYPE_INTERFACE)
-  mCallback.c = nsnull;
+    NS_RELEASE(mCallback.i);
-  mCallbackType = CALLBACK_TYPE_UNKNOWN;
 
   gThread->RemoveTimer(this);
 }
@@ -163,6 +163,7 @@ NS_IMETHODIMP nsTimerImpl::Init(nsITimerCallback *aCallback,
   SetDelayInternal(aDelay);
 
   mCallback.i = aCallback;
+  NS_ADDREF(mCallback.i);
   mCallbackType = CALLBACK_TYPE_INTERFACE;
 
   mPriority = (PRUint8)aPriority;
@@ -175,9 +176,8 @@ NS_IMETHODIMP nsTimerImpl::Init(nsITimerCallback *aCallback,
 
 NS_IMETHODIMP_(void) nsTimerImpl::Cancel()
 {
+  mCancelled = PR_TRUE;
   mClosure = nsnull;
-  mCallback.c = nsnull;
-  mCallbackType = CALLBACK_TYPE_UNKNOWN;
 
   gThread->RemoveTimer(this);
 }
@@ -205,6 +205,9 @@ NS_IMETHODIMP_(void) nsTimerImpl::SetType(PRUint32 aType)
 
 void nsTimerImpl::Process()
 {
+  if (mCancelled)
+    return;
+
 #ifdef DEBUG_TIMERS
   PRIntervalTime now = PR_IntervalNow();
   PRIntervalTime a = now - mStart; // actual delay in intervals
@@ -289,7 +292,9 @@ void nsTimerImpl::Fire()
 			         (PLHandleEventProc)handleMyEvent,
 			         (PLDestroyEventProc)destroyMyEvent);
 
-  NS_ADDREF(this);
+  // Since TimerThread addref'd 'this' for us, we don't need to addref here.  We will release
+  // in destroyMyEvent.
+
 #ifdef DEBUG_TIMERS
   event->mInit = PR_IntervalNow();
 #endif

xpcom/threads/nsTimerImpl.h

@@ -135,6 +135,8 @@ private:
   PRUint8              mType;
   PRUint8              mFiring;
 
+  PRBool               mCancelled;
+
   PRUint32             mDelay;
   PRIntervalTime       mTimeout;