Bug 1007320 - Release canceled fd callbacks earlier, r=jduell.

dom/ipc/TabChild.cpp

@@ -1339,9 +1339,10 @@ TabChild::DestroyWindow()
             mCachedFileDescriptorInfos[index];
 
         MOZ_ASSERT(!info->mCallback);
-        MOZ_ASSERT(!info->mCanceled);
 
         if (info->mFileDescriptor.IsValid()) {
+            MOZ_ASSERT(!info->mCanceled);
+
             nsRefPtr<CloseFileRunnable> runnable =
                 new CloseFileRunnable(info->mFileDescriptor);
             runnable->Dispatch();
@@ -1579,6 +1580,9 @@ TabChild::CancelCachedFileDescriptorCallback(
     MOZ_ASSERT(info->mCallback == aCallback);
     MOZ_ASSERT(!info->mCanceled);
 
+    // No need to hold the callback any longer.
+    info->mCallback = nullptr;
+
     // Set this flag so that we will close the file descriptor when it arrives.
     info->mCanceled = true;
 }