rt is null because the timer that nsDocShell is checking is the one that's currently firing which now is nulled out by virtue of bug 330128.

I can't reproduce this by visiting the URL. Are there specific steps to reproduce?

OK, I can see this now, just have to wait for the delay.

I smelled this one coming... should have glared harder at the last patch, sorry. /be

Comment on attachment 286338 [details] [diff] [review] keep nsITimerCallbacks around in case someone wants it during ::Fire Looks reasonable

Comment on attachment 286338 [details] [diff] [review] keep nsITimerCallbacks around in case someone wants it during ::Fire >+ else if (mFiring && mTimerCallbackWhileFiring) Test just mTimerCallbackWhileFiring (could assert mFiring if mTimerCallbackWhileFiring, but it's vacuous enough in my book given the same source file and small-world/you-must-be-this-tall-to-hack problem space) and sr=me. /be

Comment on attachment 286366 [details] [diff] [review] address brendan's comments a=endgame drivers for landing for M9

Btw, a possibly simpler solution to this would be to keep an mResetCallback flag set to true when firing and false in Init*, and only reset the callback after firing if mResetCallback is still true. That way you won't have to hassle with keeping the callback alive during the fire call, or making sure that it's available when GetCallback is called.