[netwerk] Make socket transport hold a reference to TLSServerConnectionInfo.

netwerk/base/TLSServerSocket.cpp

@@ -92,10 +92,11 @@ TLSServerSocket::CreateClientTransport(PRFileDesc* aClientFD,
   SSL_AuthCertificateHook(aClientFD, AuthCertificateHook, nullptr);
   // Once the TLS handshake has completed, the server consumer is notified and
   // has access to various TLS state details.
-  // It's safe to pass info here because the socket transport holds it as
-  // |mSecInfo| which keeps it alive for the lifetime of the socket.
+  trans->mFDDetachCallback = [aliveRef = RefPtr{info}](PRFileDesc* fd) {
+    SSL_HandshakeCallback(fd, nullptr, nullptr);
+  };
   SSL_HandshakeCallback(aClientFD, TLSServerConnectionInfo::HandshakeCallback,
-                        info);
+                        info.get());
 
   // Notify the consumer of the new client so it can manage the streams.
   // Security details aren't known yet.  The security observer will be notified
@@ -436,9 +437,11 @@ TLSServerConnectionInfo::GetMacLength(uint32_t* aMacLength)
 void
 TLSServerConnectionInfo::HandshakeCallback(PRFileDesc* aFD, void* aArg)
 {
+  // aArg is a raw pointer kept alive by the ref captured in
+  // the transport's mFDDetachCallback (set in CreateClientTransport).
   RefPtr<TLSServerConnectionInfo> info =
     static_cast<TLSServerConnectionInfo*>(aArg);
-  nsISocketTransport* transport = info->mTransport;
+  RefPtr<nsISocketTransport> transport = info->mTransport;
   // No longer needed outside this function, so clear the weak ref
   info->mTransport = nullptr;
   nsresult rv = info->HandshakeCallback(aFD);

netwerk/base/nsSocketTransport2.cpp

@@ -2077,6 +2077,10 @@ nsSocketTransport::OnSocketDetached(PRFileDesc *fd)
     {
         MutexAutoLock lock(mLock);
         if (mFD.IsInitialized()) {
+            auto callback = std::move(mFDDetachCallback);
+            if (callback) {
+                callback(mFD);
+            }
             ReleaseFD_Locked(mFD);
             // flag mFD as unusable; this prevents other consumers from 
             // acquiring a reference to mFD.

netwerk/base/nsSocketTransport2.h

@@ -9,6 +9,8 @@
 #define ENABLE_SOCKET_TRACING
 #endif
 
+#include <functional> // for std::function
+
 #include "mozilla/Atomics.h"
 #include "mozilla/Mutex.h"
 #include "nsSocketTransportService2.h"
@@ -386,11 +388,17 @@ private:
     nsCOMPtr<nsITransportEventSink> mEventSink;
     nsCOMPtr<nsISupports>           mSecInfo;
 
+    // Called just before the fd is closed in OnSocketDetached. Used by
+    // TLSServerSocket to clear NSS handshake callbacks and release refs
+    // that would otherwise leak if the handshake never completed.
+    std::function<void(PRFileDesc*)> mFDDetachCallback;
+
     nsSocketInputStream  mInput;
     nsSocketOutputStream mOutput;
 
     friend class nsSocketInputStream;
     friend class nsSocketOutputStream;
+    friend class TLSServerSocket;
 
     // socket timeouts are not protected by any lock.
     uint16_t mTimeouts[2];