This may be related to several crashes I'm seeing. TimerImpl::Init(nsITimerCallback*, PRUint32) increments the callback object's reference count, but never decrements it. TimerImpl::Fire() unceremoniously nulls out the reference to its callback object. The simplest fix is simply to NOT null out its reference, and let the destructor do its thing. On windows the reference isn't nulled out (nsTimer.cpp:line 310), and on UNIX it's not either.

I have a fix for this, here're the diffs: Index: nsTimerMac.cpp =================================================================== RCS file: /cvsroot/mozilla/base/src/mac/nsTimerMac.cpp,v retrieving revision 1.18 diff -r1.18 nsTimerMac.cpp 222,223c222 < if (mCallbackFunc != NULL) < { --- > if (mCallbackFunc != NULL) { 226,233c225,226 < else if (mCallbackObject != NULL) < { < nsITimerCallback* object = mCallbackObject; < mCallbackObject = nsnull; < // because the Notify call will release it. < // We will release again it in the destructor if < // it is not null when we go away! < object->Notify(this); // Fire the timer --- > else if (mCallbackObject != NULL) { > mCallbackObject->Notify(this); // Fire the timer

I'll look into this. I'm going to hold the change for a couple of days first to see if there are any probs.

adding Greg to CC list just as a matter of policy.

fixed.