Fix for bug 85231. Free nsTimer in PluginInstance to eliminate MLK and crash caused by it. r=av, peterl. sr=scc.

layout/generic/nsObjectFrame.cpp

@@ -1612,7 +1612,7 @@ nsPluginInstanceOwner::~nsPluginInstanceOwner()
 
   // shut off the timer.
   if (mPluginTimer != nsnull) {
-    mPluginTimer->Cancel();
+    CancelTimer();
   }
 
   if (nsnull != mInstance)
@@ -3099,6 +3099,7 @@ void nsPluginInstanceOwner::CancelTimer()
 {
     if (mPluginTimer) {
         mPluginTimer->Cancel();
+        mPluginTimer = nsnull;
     }
 }
 

layout/html/base/src/nsObjectFrame.cpp

@@ -1612,7 +1612,7 @@ nsPluginInstanceOwner::~nsPluginInstanceOwner()
 
   // shut off the timer.
   if (mPluginTimer != nsnull) {
-    mPluginTimer->Cancel();
+    CancelTimer();
   }
 
   if (nsnull != mInstance)
@@ -3099,6 +3099,7 @@ void nsPluginInstanceOwner::CancelTimer()
 {
     if (mPluginTimer) {
         mPluginTimer->Cancel();
+        mPluginTimer = nsnull;
     }
 }
 

modules/plugin/base/src/nsPluginViewer.cpp

@@ -915,7 +915,7 @@ pluginInstanceOwner :: ~pluginInstanceOwner()
 {
   // shut off the timer.
   if (mPluginTimer != nsnull) {
-    mPluginTimer->Cancel();
+    CancelTimer();
   }
 
   if (nsnull != mInstance)
@@ -1254,6 +1254,7 @@ void pluginInstanceOwner::CancelTimer()
 {
     if (mPluginTimer) {
         mPluginTimer->Cancel();
+        mPluginTimer = nsnull;
     }
 }
 

modules/plugin/nglsrc/nsPluginViewer.cpp

@@ -915,7 +915,7 @@ pluginInstanceOwner :: ~pluginInstanceOwner()
 {
   // shut off the timer.
   if (mPluginTimer != nsnull) {
-    mPluginTimer->Cancel();
+    CancelTimer();
   }
 
   if (nsnull != mInstance)
@@ -1254,6 +1254,7 @@ void pluginInstanceOwner::CancelTimer()
 {
     if (mPluginTimer) {
         mPluginTimer->Cancel();
+        mPluginTimer = nsnull;
     }
 }