b=417115, animated image causes recursion during shutdown ; r=stuart

xpcom/threads/nsTimerImpl.h

@@ -110,11 +110,16 @@ private:
 
   void ReleaseCallback()
   {
-    if (mCallbackType == CALLBACK_TYPE_INTERFACE)
+    // if we're the last owner of the callback object, make
+    // sure that we don't recurse into ReleaseCallback in case
+    // the callback's destructor calls Cancel() or similar.
+    PRUint8 cbType = mCallbackType;
+    mCallbackType = CALLBACK_TYPE_UNKNOWN; 
+
+    if (cbType == CALLBACK_TYPE_INTERFACE)
       NS_RELEASE(mCallback.i);
-    else if (mCallbackType == CALLBACK_TYPE_OBSERVER)
+    else if (cbType == CALLBACK_TYPE_OBSERVER)
       NS_RELEASE(mCallback.o);
-    mCallbackType = CALLBACK_TYPE_UNKNOWN;
   }
 
   nsCOMPtr<nsIThread>   mCallingThread;