Index: channels/chan_sip.c
===================================================================
--- channels/chan_sip.c	(revision 308720)
+++ channels/chan_sip.c	(working copy)
@@ -28102,12 +28102,10 @@
 		return 0;
 	}
 
-	ast_channel_lock(chan);
 	sip_pvt_lock(p);
 	if (p->alreadygone) {
 		/* If we're destroyed, don't bother */
 		sip_pvt_unlock(p);
-		ast_channel_unlock(chan);
 		return 0;
 	}
 
@@ -28116,10 +28114,11 @@
 	*/
 	if (nat_active && !ast_test_flag(&p->flags[0], SIP_DIRECT_MEDIA_NAT)) {
 		sip_pvt_unlock(p);
-		ast_channel_unlock(chan);
 		return 0;
 	}
 
+	dialog_ref(p, "in sip_set_rtp_peer: Inc refs so pvt doesn't accidentally become dead before we are done");
+
 	if (instance) {
 		changed |= ast_rtp_instance_get_and_cmp_remote_address(instance, &p->redirip);
 	} else if (!ast_sockaddr_isnull(&p->redirip)) {
@@ -28149,7 +28148,9 @@
 			ast_debug(1, "Early remote bridge setting SIP '%s' - Sending media to %s\n", p->callid, ast_sockaddr_stringify(instance ? &p->redirip : &p->ourip));
 		} else if (!p->pendinginvite) {	 /* We are up, and have no outstanding invite */
 			ast_debug(3, "Sending reinvite on SIP '%s' - It's audio soon redirected to IP %s\n", p->callid, ast_sockaddr_stringify(instance ? &p->redirip : &p->ourip));
+			sip_pvt_unlock(p);
 			transmit_reinvite_with_sdp(p, FALSE, FALSE);
+			sip_pvt_lock(p);
 		} else if (!ast_test_flag(&p->flags[0], SIP_PENDINGBYE)) {
 			ast_debug(3, "Deferring reinvite on SIP '%s' - It's audio will be redirected to IP %s\n", p->callid, ast_sockaddr_stringify(instance ? &p->redirip : &p->ourip));
 			/* We have a pending Invite. Send re-invite when we're done with the invite */
@@ -28159,7 +28160,7 @@
 	/* Reset lastrtprx timer */
 	p->lastrtprx = p->lastrtptx = time(NULL);
 	sip_pvt_unlock(p);
-	ast_channel_unlock(chan);
+	dialog_unref(p, "in sip_set_rtp_peer: Dec ref count so pvt can become dead");
 	return 0;
 }