So I'm just not seeing how the NAT simulator could possibly take a call to DoCallbacks on one TCP socket and translate it to a call to DoCallbacks on another TCP socket. The only path there is via IPC callbacks. While it is conceivable that the call to close() might release a reference to the NrTcpSocket, the runnable calling OnClose should be holding onto a ref still. I wonder if it is possible that we're corrupting the refcount...
Bug 1717285 Comment 4 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
So I'm just not seeing how the NAT simulator could possibly take a call to DoCallbacks on one TCP socket and translate it to a call to DoCallbacks on another TCP socket. The only path there is via IPC callbacks. While it is conceivable that the call to close() might release a reference to the NrTcpSocket, the runnable calling OnClose should be holding onto a ref still. I wonder if it is possible that we're corrupting the refcount... This still wouldn't explain why we see DoCallbacks twice in the stack trace, though.