--- a/xpcom/threads/nsTimerImpl.cpp
+++ b/xpcom/threads/nsTimerImpl.cpp
@@ -407,17 +407,18 @@ void nsTimerImpl::Fire()
                           NS_TIMER_CALLBACK_TOPIC,
                           nsnull);
       break;
     default:;
   }
 
   // If the callback didn't re-init the timer, and it's not a one-shot timer,
   // restore the callback state.
-  if (mCallbackType == CALLBACK_TYPE_UNKNOWN && callbackType != TYPE_ONE_SHOT) {
+  if (mCallbackType == CALLBACK_TYPE_UNKNOWN &&
+      mType != TYPE_ONE_SHOT && !mCanceled) {
     mCallback = callback;
     mCallbackType = callbackType;
   } else {
     // The timer was a one-shot, or the callback was reinitialized.
     if (callbackType == CALLBACK_TYPE_INTERFACE)
       NS_RELEASE(callback.i);
     else if (callbackType == CALLBACK_TYPE_OBSERVER)
       NS_RELEASE(callback.o);