Bug 614958 - Don't release the socket transport's event sink while we're holding a lock, since it can result in retrying to obtain the same lock again, which causes a deadlock; r=biesi,bsmedberg a=blocking-beta8+ landed on a CLOSED TREE

netwerk/base/src/nsSocketTransport2.cpp

@@ -1612,6 +1612,12 @@ nsSocketTransport::OnSocketDetached(PRFileDesc *fd)
     // finally, release our reference to the socket (must do this within
     // the transport lock) possibly closing the socket. Also release our
     // listeners to break potential refcount cycles.
+
+    // We should be careful not to release mEventSink while we're locked,
+    // because releasing it might require acquiring the lock again, so
+    // we just null out mEventSink while we're holding the lock, and let
+    // ourEventSink's destuctor take care of destroying it if needed.
+    nsCOMPtr<nsITransportEventSink> ourEventSink;
     {
         nsAutoLock lock(mLock);
         if (mFD) {
@@ -1627,7 +1633,7 @@ nsSocketTransport::OnSocketDetached(PRFileDesc *fd)
         // round. That would lead e.g. to a broken certificate exception page.
         if (NS_FAILED(mCondition)) {
             mCallbacks = nsnull;
-            mEventSink = nsnull;
+            mEventSink.swap(ourEventSink);
         }
     }
 }