diff --git a/netwerk/base/src/nsSocketTransport2.cpp b/netwerk/base/src/nsSocketTransport2.cpp
index 2959a7fe4645..741ab239dffd 100644
--- a/netwerk/base/src/nsSocketTransport2.cpp
+++ b/netwerk/base/src/nsSocketTransport2.cpp
@@ -1529,6 +1529,13 @@ nsSocketTransport::OnSocketDetached(PRFileDesc *fd)
         mOutput.OnSocketReady(mCondition);
     }
 
+    // break any potential reference cycle between the security info object
+    // and ourselves by resetting its notification callbacks object.  see
+    // bug 285991 for details.
+    nsCOMPtr<nsISSLSocketControl> secCtrl = do_QueryInterface(mSecInfo);
+    if (secCtrl)
+        secCtrl->SetNotificationCallbacks(nsnull);
+
     // finally, release our reference to the socket (must do this within
     // the transport lock) possibly closing the socket.
     {
diff --git a/security/manager/ssl/src/nsNSSIOLayer.cpp b/security/manager/ssl/src/nsNSSIOLayer.cpp
index df06c28a20c9..89ceef584aff 100644
--- a/security/manager/ssl/src/nsNSSIOLayer.cpp
+++ b/security/manager/ssl/src/nsNSSIOLayer.cpp
@@ -257,6 +257,11 @@ nsNSSSocketInfo::GetNotificationCallbacks(nsIInterfaceRequestor** aCallbacks)
 NS_IMETHODIMP
 nsNSSSocketInfo::SetNotificationCallbacks(nsIInterfaceRequestor* aCallbacks)
 {
+  if (!aCallbacks) {
+    mCallbacks = nsnull;
+    return NS_OK;
+  }
+
   nsCOMPtr<nsIProxyObjectManager> proxyman(do_GetService(NS_XPCOMPROXY_CONTRACTID));
   if (!proxyman) 
     return NS_ERROR_FAILURE;