387613 - Crash [@ nsNSSCertificate::GetCert fb3ac2be] on click submit on chrome://pippki/content/editcacert.xul

Status: RESOLVED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[Carsten Book [:Tomcat]]

Steps to reproduce :

Load chrome://pippki/content/editcacert.xul into the browser. Check some boxes and click submit -> Crash.

Crash Trunk and 1.8.1.5 Build. The Talkback Stack is from a 1.8.1.5 Build since Breakpad doesn`t launch.

TB33742229Z
Stack Signature	 nsNSSCertificate::GetCert fb3ac2be
Product ID	Firefox2
Build ID	2007070403
Trigger Time	2007-07-04 21:06:30.0
Platform	Win32
Operating System	Windows NT 5.2 build 3790
Module	firefox.exe + (004849ea)
URL visited	crash while testing bug 379190
User Comments	
Since Last Crash	33494 sec
Total Uptime	33494 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/security/manager/ssl/src/nsNSSCertificate.cpp, line 882
Stack Trace 	
nsNSSCertificate::GetCert  [mozilla/security/manager/ssl/src/nsNSSCertificate.cpp, line 882]
nsNSSCertificateDB::SetCertTrust  [mozilla/security/manager/ssl/src/nsNSSCertificateDB.cpp, line 1002]
XPTC_InvokeByIndex  [mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp, line 102]
XPCWrappedNative::CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2169]
XPC_WN_CallMethod  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1455]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1375]
js_Interpret  [mozilla/js/src/jsinterp.c, line 3944]
js_Invoke  [mozilla/js/src/jsinterp.c, line 1394]
js_InternalInvoke  [mozilla/js/src/jsinterp.c, line 1469]
JS_CallFunctionValue  [mozilla/js/src/jsapi.c, line 4351]
nsJSContext::CallEventHandler  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1493]
nsJSEventListener::HandleEvent  [mozilla/dom/src/events/nsJSEventListener.cpp, line 195]
nsXBLPrototypeHandler::ExecuteHandler  [mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp, line 513]
nsXBLKeyEventHandler::HandleEvent  [mozilla/content/xbl/src/nsXBLEventHandler.cpp, line 151]
nsEventListenerManager::HandleEventSubType  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1655]
nsEventListenerManager::HandleEvent  [mozilla/content/events/src/nsEventListenerManager.cpp, line 1762]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2232]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2255]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2255]
nsXULElement::HandleDOMEvent  [mozilla/content/xul/content/src/nsXULElement.cpp, line 2255]
PresShell::HandleEventInternal  [mozilla/layout/base/nsPresShell.cpp, line 6485]
PresShell::HandleEvent  [mozilla/layout/base/nsPresShell.cpp, line 6268]
nsViewManager::HandleEvent  [mozilla/view/src/nsViewManager.cpp, line 2521]
nsViewManager::DispatchEvent  [mozilla/view/src/nsViewManager.cpp, line 2253]
HandleEvent  [mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 1319]
nsWindow::DispatchKeyEvent  [mozilla/widget/src/windows/nsWindow.cpp, line 3639]
nsWindow::OnKeyDown  [mozilla/widget/src/windows/nsWindow.cpp, line 3786]
nsWindow::ProcessMessage  [mozilla/widget/src/windows/nsWindow.cpp, line 4777]
nsWindow::WindowProc  [mozilla/widget/src/windows/nsWindow.cpp, line 1507]
USER32.dll + 0x172d8 (0x7d9472d8)
USER32.dll + 0x17568 (0x7d947568)
USER32.dll + 0x1778d (0x7d94778d)
USER32.dll + 0x177d0 (0x7d9477d0)
nsAppShell::Run  [mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 152]
main  [mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x27d2a (0x7d4e7d2a)

Comment 1

[Kai Engert [:KaiE:]]

Attachment: Patch v1 (for trunk)

Bob, can you please review?

The context is slightly different on 1.8 branch and 1.8.0 branch, but the fix is the same, so I think a single review is sufficient. I'll attach another patch for the branches, though.

Comment 2

[Kai Engert [:KaiE:]]

Attachment: Patch v1 (applies to 1.8 branch and 1.8.0 branch)

Comment 3

[Robert Relyea]

Comment on attachment 271931 [details] [diff] [review]
Patch v1 (for trunk)

r= relyea

Comment 4

[Kai Engert [:KaiE:]]

fixed on trunk

Comment 5

[Kai Engert [:KaiE:]]

Comment on attachment 271931 [details] [diff] [review]
Patch v1 (for trunk)

requesting branch approval for trivial crash fix

Comment 6

[Daniel Veditz [:dveditz]]

Not a blocker, but we'll look at the approval requests.

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 271932 [details] [diff] [review]
Patch v1 (applies to 1.8 branch and 1.8.0 branch)

approved for 1.8.1.7 and 1.8.0.13, a=dveditz for release-drivers

Comment 8

[Kai Engert [:KaiE:]]

fixed1.8.0.13, fixed1.8.1.7

Comment 9

[u279076]

TB 1.5.0.13 crashes when start page is set to chrome://pippki/content/editcacert.xul.

See talkback ID TB34939402K.

Comment 10

[u279076]

Sorry, wrong TB ID...TB ID is TB35153242Z

Comment 11

[Carsten Book [:Tomcat]]

(In reply to comment #10)
> Sorry, wrong TB ID...TB ID is TB35153242Z
> 

Thats Bug 392208 / see comment#12 from Bug 379190

Comment 12

[Al Billings [:abillings - ex-MoCo]]

Well, then it masks this bug's fix so we cannot verify it.

Comment 13

[timeless]

[e-mail]: please use dependencies when things are blocked.
[e-mail]: please use this syntax: see bug 379190 comment 12

Comment 14

[Carsten Book [:Tomcat]]

verified fixed 1.8.1.7 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.7pre) Gecko/20070903 BonEcho/2.0.0.7pre ID:2007090304 - no crash on steps to reproduce 

Adding verified keyword