Bug 401137. Silence ASSERTION: RefreshURIList timer callbacks should only be RefreshTimer objects. Docshell expects to be able to getCallback during a Timer fire. r=bzbarsky, sr=brendan, a=mconnor

xpcom/threads/nsTimerImpl.cpp

@@ -338,6 +338,8 @@ NS_IMETHODIMP nsTimerImpl::GetCallback(nsITimerCallback **aCallback)
 {
   if (mCallbackType == CALLBACK_TYPE_INTERFACE)
     NS_IF_ADDREF(*aCallback = mCallback.i);
+  else if (mTimerCallbackWhileFiring)
+    NS_ADDREF(*aCallback = mTimerCallbackWhileFiring);
   else
     *aCallback = nsnull;
 
@@ -379,6 +381,8 @@ void nsTimerImpl::Fire()
   if (gThread)
     gThread->UpdateFilter(mDelay, timeout, now);
 
+  if (mCallbackType == CALLBACK_TYPE_INTERFACE)
+    mTimerCallbackWhileFiring = mCallback.i;
   mFiring = PR_TRUE;
   
   // Handle callbacks that re-init the timer, but avoid leaking.
@@ -420,6 +424,7 @@ void nsTimerImpl::Fire()
   }
 
   mFiring = PR_FALSE;
+  mTimerCallbackWhileFiring = nsnull;
 
 #ifdef DEBUG_TIMERS
   if (PR_LOG_TEST(gTimerLog, PR_LOG_DEBUG)) {

xpcom/threads/nsTimerImpl.h

@@ -127,6 +127,10 @@ private:
     nsIObserver *       o;
   } mCallback;
 
+  // Some callers expect to be able to access the callback while the
+  // timer is firing.
+  nsCOMPtr<nsITimerCallback> mTimerCallbackWhileFiring;
+
   // These members are set by Init (called from NS_NewTimer) and never reset.
   PRUint8               mCallbackType;