Bug 1240985 - Fix cancel during timeout (r=dvander)

ipc/glue/MessageChannel.cpp

@@ -598,9 +598,21 @@ MessageChannel::MaybeInterceptSpecialIOMessage(const Message& aMsg)
             }
             return true;
         } else if (CANCEL_MESSAGE_TYPE == aMsg.type()) {
-            CancelCurrentTransactionInternal();
-            NotifyWorkerThread();
-            return true;
+            IPC_LOG("Cancel from message");
+
+            if (aMsg.transaction_id() == mTimedOutMessageSeqno) {
+                // An unusual case: We timed out a transaction which the other
+                // side then cancelled. In this case we just leave the timedout
+                // state and try to forget this ever happened.
+                mTimedOutMessageSeqno = 0;
+                return true;
+            } else {
+                MOZ_RELEASE_ASSERT(mCurrentTransaction == aMsg.transaction_id());
+                CancelCurrentTransactionInternal();
+                NotifyWorkerThread();
+                IPC_LOG("Notified");
+                return true;
+            }
         }
     }
     return false;