From 1212ca52eafeee4fc8f219cbd43e9645632d9e56 Mon Sep 17 00:00:00 2001
From: Ben Turner <bent.mozilla@gmail.com>
Date: Wed, 7 May 2014 16:09:37 -0700
Subject: [PATCH] Bug 1007320 - Release canceled fd callbacks earlier,
 r=jduell.

---
 dom/ipc/TabChild.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 84429f56eafb..f3a0ed4b1a93 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -1339,9 +1339,10 @@ TabChild::DestroyWindow()
             mCachedFileDescriptorInfos[index];
 
         MOZ_ASSERT(!info->mCallback);
-        MOZ_ASSERT(!info->mCanceled);
 
         if (info->mFileDescriptor.IsValid()) {
+            MOZ_ASSERT(!info->mCanceled);
+
             nsRefPtr<CloseFileRunnable> runnable =
                 new CloseFileRunnable(info->mFileDescriptor);
             runnable->Dispatch();
@@ -1579,6 +1580,9 @@ TabChild::CancelCachedFileDescriptorCallback(
     MOZ_ASSERT(info->mCallback == aCallback);
     MOZ_ASSERT(!info->mCanceled);
 
+    // No need to hold the callback any longer.
+    info->mCallback = nullptr;
+
     // Set this flag so that we will close the file descriptor when it arrives.
     info->mCanceled = true;
 }