When using NSS, only schedule transport socket reads when the transport buffer is empty.

net/base/nss_memio.c

Index: net/base/nss_memio.c
diff --git a/net/base/nss_memio.c b/net/base/nss_memio.c
index c1a89c3b2af9903699a9052b064b9a79de33a573..e6f0f39b80b95cd6a900e76b5bb1f9aa5b0e070d 100644
--- a/net/base/nss_memio.c
+++ b/net/base/nss_memio.c
@@ -55,6 +55,10 @@ struct PRFilePrivate {
 
     /* if set, empty I/O returns EOF instead of EWOULDBLOCK */
     int eof;
+
+    /* if set, the number of bytes requested from readbuf that were not
+     * fulfilled (due to readbuf being empty) */
+    int read_requested;
 };
 
 /*--------------- private memio_buffer functions ---------------------*/
@@ -223,11 +227,14 @@ static int PR_CALLBACK memio_Recv(PRFileDesc *fd, void *buf, PRInt32 len,
     PR_ASSERT(mb->bufsize);
     rv = memio_buffer_get(mb, buf, len);
     if (rv == 0 && !secret->eof) {
+        secret->read_requested = len;
         if (mb->last_err)
             PR_SetError(mb->last_err, 0);
         else
             PR_SetError(PR_WOULD_BLOCK_ERROR, 0);

[wtc, 2012/12/20 02:41:22]

Perhaps only this code path (when a read request of a higher
layer fails with PR_WOULD_BLOCK_ERROR) should result in
secret->read_requested being set to 'len'. But what we set
secret->read_requested to when mb->last_err is nonzero
probably doesn't matter in practice.

         return -1;
+    } else {

[wtc, 2012/12/20 02:41:22]

Don't add "else" here. Just do

         return -1;
     }

+    secret->read_requested = 0;
     return rv;
 }

+        secret->read_requested = 0;
     }
 
     return rv;
@@ -382,6 +389,11 @@ memio_Private *memio_GetSecret(PRFileDesc *fd)
     return (memio_Private *)secret;
 }
 
+int memio_GetReadRequest(memio_Private *secret)
+{
+    return ((PRFilePrivate *)secret)->read_requested;
+}
+
 int memio_GetReadParams(memio_Private *secret, char **buf)
 {
     struct memio_buffer* mb = &((PRFilePrivate *)secret)->readbuf;