fix lock inversion in dns service resolver

src/core/lib/event_engine/cf_engine/dns_service_resolver.cc

@@ -221,8 +221,12 @@ void DNSServiceResolverImpl::Shutdown() {
   dispatch_async_f(queue_, Ref().release(), [](void* thatPtr) {
     grpc_core::RefCountedPtr<DNSServiceResolverImpl> that{
         static_cast<DNSServiceResolverImpl*>(thatPtr)};
-    grpc_core::MutexLock lock(&that->request_mu_);
-    for (auto& kv : that->requests_) {
+
+    grpc_core::ReleasableMutexLock lock(&that->request_mu_);
+    auto requests = std::exchange(that->requests_, {});
+    lock.Release();
+
+    for (auto& kv : requests) {
       auto& sdRef = kv.first;
       auto& request = kv.second;
       GRPC_TRACE_LOG(event_engine_dns, INFO)
@@ -232,7 +236,6 @@ void DNSServiceResolverImpl::Shutdown() {
           absl::CancelledError("DNSServiceResolverImpl::Shutdown"));
       DNSServiceRefDeallocate(static_cast<DNSServiceRef>(sdRef));
     }
-    that->requests_.clear();
   });
 }
 

test/core/event_engine/cf/cf_engine_test.cc

@@ -300,6 +300,23 @@ TEST(CFEventEngineTest, TestResolveAgainInCallback) {
   resolve_signal.WaitForNotification();
 }
 
+TEST(CFEventEngineTest, TestLockOrder) {
+  auto cf_engine = std::make_shared<CFEventEngine>();
+  auto dns_resolver = std::move(cf_engine->GetDNSResolver({})).value();
+  grpc_core::Mutex mutex;
+
+  {
+    grpc_core::MutexLock lock(&mutex);
+    dns_resolver->LookupHostname(
+        [&mutex](auto result) { grpc_core::MutexLock lock2(&mutex); },
+        "google.com", "80");
+  }
+
+  dns_resolver.reset();
+
+  sleep(1);
+}
+
 TEST(CFEventEngineTest, TestResolveMany) {
   std::atomic<int> times{10};
   grpc_core::Notification resolve_signal;