Closed Bug 349649 Opened 19 years ago Closed 19 years ago

crashed [@ PL_DHashAllocTable()] by generating X.509 certificate

Categories

(Firefox :: General, defect)

Product:
Firefox
Component:
General
Version:
2.0 Branch
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: szimszon, Unassigned)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file, 1 obsolete file)

testcase
501 bytes, text/html
Details
User-Agent: Mozilla/5.0 (X11; U; Linux i686; hu; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6 Build Identifier: Firefox/2.0 beta If I try to request a certificate from Thawte, everything is fine before Firefox try to generate the key. After the generation ended Firefox hangs... Reproducible: Always Steps to Reproduce: 1. Request a X.509 Format Certificates 2. Select the "Mozilla Firefox/Thunderbird, Netscape Communicator/Messenger" 3. Certificate Bearers Name (Next) 4. Choose one email address (Next) 5. Strong Extranet Identities (Next) 6. Accept Default Extensions (Accept) 7. Public Key (Next) 8. Then it appears a window, that indicates the key is generating 9. Firefox hangs After that I can kill firefox only with "kill -9 ..." :(
Version: unspecified → 2.0 Branch
What is the url where you get this problem? (I can't find the X.509 Format Certificate place)
https://www.thawte.com/cgi/personal/cert/enroll.exe But I guess, any pages are able to kill firefox if the page request an X.509 "certificate request" from the browser. Only I don't know such a site other than thawte. If you could tell me an url, where the page ask the browser to make a request, and firefox crash, then I try to send data with the bugreport agent. But not from thawte. I don't know what sensitive data is in memory :( And it works fine with firefox 1.5... Sorry for my English :(
I don't think the talkback agent is sending security sensitive information, only symbols which a stacktrace can be derived from. There are way on Linux to get a stacktrace, other than talkback. http://kb.mozillazine.org/Talkback#Linux (although I don't know how, since I don't know Linux) do you get the hang also with this keygen example? http://www.wargers.org/mozilla/keygen.htm
After I push Submit, I got: Method Not Allowed The requested method POST is not allowed for the URL /mozilla/keygen.htm. :( About the talkback agent, I don't know how it works, and with thawte it's a web authentication for the service. And I'm a bit paranoid :)
Attached file testcase (obsolete) —
(In reply to comment #4) > After I push Submit, I got: > > Method Not Allowed > The requested method POST is not allowed for the URL /mozilla/keygen.htm. Sorry, apparently, it only works on a https site. Please try again with this example.
Hmm, no that's not working either.
Attached file testcase —
Ok, I hope you get to see the keygen dialog with this example, when you press the submit button.
Attachment #235235 - Attachment is obsolete: true
It works... ...until the keygen dialog appears I sent data with talkback agent... With description: [Bug 349649] crashed by generating X.509 certificate
Ok, thanks, I found it, it's http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=22454005 libc.so.6 + 0x730a1 (0xb74a00a1) libc.so.6 + 0x728fb (0xb749f8fb) libc.so.6 + 0x71c43 (0xb749ec43) PL_DHashAllocTable() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/build/pldhash.c, line 90] ChangeTable() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/build/pldhash.c, line 494] PL_DHashTableOperate() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/build/pldhash.c, line 581] ClassifyWrapper() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5240] PL_DHashTableEnumerate() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/xpcom/build/pldhash.c, line 684] nsDOMClassInfo::BeginGCMark() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5307] nsDOMClassInfo::MarkReachablePreservedWrappers() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5136] nsDOMGCParticipantSH::Mark() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 6912] XPC_WN_Helper_Mark() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1032] js_Mark() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsobj.c, line 4581] MarkGCThingChildren() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsgc.c, line 1800] js_MarkGCThing() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsgc.c, line 2144] gc_root_marker() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsgc.c, line 2208] JS_DHashTableEnumerate() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsdhash.c, line 675] js_GC() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsgc.c, line 2512] js_ForceGC() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsgc.c, line 2235] js_DestroyContext() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jscntxt.c, line 389] JS_DestroyContext() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/jsapi.c, line 953] XPCJSContextStack::~XPCJSContextStack() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/xpconnect/src/xpcthreadcontext.cpp, line 62] XPCPerThreadData::Cleanup() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/xpconnect/src/xpcthreadcontext.cpp, line 389] XPCPerThreadData::~XPCPerThreadData() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/xpconnect/src/xpcthreadcontext.cpp, line 397] xpc_ThreadDataDtorCB() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/js/src/xpconnect/src/xpcthreadcontext.cpp, line 429] _PR_DestroyThreadPrivate() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/nsprpub/pr/src/threads/prtpd.c, line 266] _pt_thread_death() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/nsprpub/pr/src/pthreads/ptthread.c, line 816] PR_JoinThread() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/nsprpub/pr/src/pthreads/ptthread.c, line 599] nsKeygenThread::Join() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/security/manager/ssl/src/nsKeygenThread.cpp, line 269] nsKeygenFormProcessor::GetPublicKey() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/security/manager/ssl/src/nsKeygenHandler.cpp, line 527] nsKeygenFormProcessor::ProcessValue() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/security/manager/ssl/src/nsKeygenHandler.cpp, line 659] nsFormSubmission::ProcessValue() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsFormSubmission.cpp, line 848] nsFSURLEncoded::AddNameValuePair() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsFormSubmission.cpp, line 351] nsHTMLSelectElement::SubmitNamesValues() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsHTMLSelectElement.cpp, line 62] nsHTMLFormElement::WalkFormElements() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsHTMLFormElement.cpp, line 848] nsHTMLFormElement::BuildSubmission() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsHTMLFormElement.cpp, line 842] nsHTMLFormElement::DoSubmit() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsHTMLFormElement.cpp, line 834] nsHTMLFormElement::DoSubmitOrReset() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsHTMLFormElement.cpp, line 782] nsHTMLFormElement::HandleDOMEvent() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsHTMLFormElement.cpp, line 738] PresShell::HandleDOMEventWithTarget() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/layout/base/nsPresShell.cpp, line 6474] nsHTMLInputElement::HandleDOMEvent() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/html/content/src/nsHTMLInputElement.cpp, line 253] PresShell::HandleEventInternal() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/layout/base/nsPresShell.cpp, line 848] PresShell::HandleEventWithTarget() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/layout/base/nsPresShell.cpp, line 6277] nsEventStateManager::CheckForAndDispatchClick() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 3097] nsEventStateManager::PostHandleEvent() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 1056] PresShell::HandleEventInternal() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/layout/base/nsPresShell.cpp, line 848] PresShell::HandleEvent() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/layout/base/nsPresShell.cpp, line 6214] nsViewManager::HandleEvent() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/view/src/nsViewManager.cpp, line 848] nsViewManager::DispatchEvent() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/view/src/nsViewManager.cpp, line 2246] HandleEvent() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/view/src/nsView.cpp, line 251] nsCommonWidget::DispatchEvent() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/widget/src/gtk2/nsCommonWidget.cpp, line 219] nsWindow::OnButtonReleaseEvent() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 1683] button_release_event_cb() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 3820] libgtk-x11-2.0.so.0 + 0x12299e (0xb7c0499e) libgobject-2.0.so.0 + 0x8736 (0xb79b7736) libgobject-2.0.so.0 + 0x19dcf (0xb79c8dcf) libgobject-2.0.so.0 + 0x18c8c (0xb79c7c8c) libgobject-2.0.so.0 + 0x19126 (0xb79c8126) libgtk-x11-2.0.so.0 + 0x211d87 (0xb7cf3d87) libgtk-x11-2.0.so.0 + 0x1214b2 (0xb7c034b2) libgtk-x11-2.0.so.0 + 0x120306 (0xb7c02306) libgdk-x11-2.0.so.0 + 0x3f825 (0xb7aa2825) libglib-2.0.so.0 + 0x24582 (0xb794f582) libglib-2.0.so.0 + 0x255f8 (0xb79505f8) libglib-2.0.so.0 + 0x25930 (0xb7950930) libglib-2.0.so.0 + 0x25ed3 (0xb7950ed3) libgtk-x11-2.0.so.0 + 0x11fbb3 (0xb7c01bb3) nsAppShell::Run() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 141] nsAppStartup::Run() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152] XRE_main() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 2378] main() [/builds/tinderbox/Fx-Mozilla1.8-release/Linux_2.4.21-27.0.4.EL_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 62] libc.so.6 + 0x15974 (0xb7442974) I can't reproduce it with the testcase on current 1.8.1 branch builds. Maybe Adam can reproduce this? Reporter, do you have any extensions installed that possibly could cause this?
Keywords: crash
Summary: crashed by generating X.509 certificate → crashed [@ PL_DHashAllocTable()] by generating X.509 certificate
Sorry, my name is Szabolcs Gyuris, I have installed - Popup ALT Attribute (1.3.2005092701) - Sage 1.3.6 - SessionSaver 0.2.1.031 - StumbleUpon 2.83 - TalkBack 2.0b1 I try to disable these, and try again...
Sorry I forgot: - ablock Plus 0.7.1.2 - Bookmark Sync and Sort 1.0.6 - DOM Inspector 1.8.1b1 - Download Statusbar 0.9.4.1
I got a crash after I have disabled all my addons... Is it a difference if I only disable the addons or completly remove it? Oh, yes, my system is Debian Sarge.
(In reply to comment #12) > Oh, yes, my system is Debian Sarge. You have an official build of Firefox, I hope? Not some self-baked build from Debian? You could alternatively try with a new, clean profile.
I can crash firefox with the new empty profile too. :( And yes, I have an official build (Mozilla/5.0 (X11; U; Linux i686; hu; rv:1.8.1b1) Gecko/20060710 Firefox/2.0b1)
I can reproduce this in the official Firefox 2 Beta 1 build (from early July), but I can't reproduce in a nightly branch build from the 21st. Szabolcs, can you test a build from here [0] and see if you still crash? [0] http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla1.8/
It seems that the bug is gone. I can't reproduce the problem. Tnx.
OK. So this got fixed sometime between beta 1's release and now. Marking WORKSFORME.
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago
Keywords: testcase
Resolution: --- → WORKSFORME
Crash Signature: [@ PL_DHashAllocTable()]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: