--- a/xpcom/threads/nsTimerImpl.cpp
+++ b/xpcom/threads/nsTimerImpl.cpp
@@ -307,16 +307,21 @@ nsTimerImpl::Init(nsIObserver* aObserver
   NS_ADDREF(mCallback.o);
 
   return InitCommon(aDelay, aType);
 }
 
 NS_IMETHODIMP
 nsTimerImpl::Cancel()
 {
+  // mCallbackType is never written by the TimerThread. We assume everyone
+  // else plays nice wrt threadsafety.
+  if (mCallbackType == CallbackType::Unknown) {
+    return NS_OK;
+  }
 
   if (gThread) {
     gThread->RemoveTimer(this);
   }
 
   ReleaseCallback();
 
   return NS_OK;