Use mutex in PACResolver when accessing mRequest from multiple threads.

netwerk/base/ProxyAutoConfig.cpp

@@ -271,6 +271,7 @@ public:
 
   PACResolver()
     : mStatus(NS_ERROR_FAILURE)
+    , mMutex("PACResolver::Mutex")
   {
   }
 
@@ -279,9 +280,15 @@ public:
                               nsIDNSRecord *record,
                               nsresult status) override
   {
-    if (mTimer) {
+    nsCOMPtr<nsITimer> timer;
-      mTimer->Cancel();
+    {
-      mTimer = nullptr;
+      MutexAutoLock lock(mMutex);
+      timer.swap(mTimer);
+      mRequest = nullptr;
+    }
+    
+    if (timer) {
+      timer->Cancel();
     }
 
     mRequest = nullptr;
@@ -293,9 +300,15 @@ public:
   // nsITimerCallback
   NS_IMETHOD Notify(nsITimer *timer) override
   {
-    if (mRequest)
+    nsCOMPtr<nsICancelable> request;
-      mRequest->Cancel(NS_ERROR_NET_TIMEOUT);
+    {
-    mTimer = nullptr;
+      MutexAutoLock lock(mMutex);
+      request.swap(mRequest);
+      mTimer = nullptr;
+    }
+    if (request) {
+      request->Cancel(NS_ERROR_NET_TIMEOUT);
+    }
     return NS_OK;
   }
 
@@ -303,6 +316,7 @@ public:
   nsCOMPtr<nsICancelable> mRequest;
   nsCOMPtr<nsIDNSRecord>  mResponse;
   nsCOMPtr<nsITimer>      mTimer;
+  Mutex                   mMutex;
 
 private:
   ~PACResolver() {}