389194 - crash [@ PL_DHashTableOperate] at first launch after first reboot, using FF 2.0.0.5

Status: RESOLVED INCOMPLETE

(Core :: Security: PSM, defect)

Description

[Ray Kiddy]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.5) Gecko/20070713 Firefox/2.0.0.5

Mac OS X 10.4.9 on 2.16 GHz Intel Core Duo with 2 GB RAM

I downloaded FF 2.0.0.5 yesterday and used it with no problems. Last night, I powered down my laptop. I started up and launched FF 2.0.0.5. It immediately crashed. I was able to re-launch and it is working fine.

Thread 1 Crashed:
0   libxpcom_core.dylib         0x00e06ee3 PL_DHashTableOperate + 15
1   libxpcom_core.dylib         0x00e0f9e1 nsCStringHashSetSuper::GetEntry(nsACString_internal const&) + 19
2   org.mozilla.firefox         0x00350eec nsSSLIOLayerHelpers::isKnownAsIntolerantSite(nsCString const&) + 42
3   org.mozilla.firefox         0x00351a0b nsSSLIOLayerAddToSocket(int, char const*, int, char const*, int, PRFileDesc*, nsISupports**, int) + 945
4   org.mozilla.firefox         0x00351ba1 nsSSLIOLayerNewSocket(int, char const*, int, char const*, int, PRFileDesc**, nsISupports**, int) + 79
5   org.mozilla.firefox         0x00059149 nsSSLSocketProvider::~nsSSLSocketProvider [in-charge deleting]() + 159
6   org.mozilla.firefox         0x005b0f98 nsSocketTransport::BuildSocket(PRFileDesc*&, int&, int&) + 366
7   org.mozilla.firefox         0x005b1437 nsSocketTransport::InitiateSocket() + 303
8   org.mozilla.firefox         0x005b2256 nsSocketTransport::OnSocketEvent(unsigned, unsigned, nsISupports*) + 272
9   org.mozilla.firefox         0x00870457 nsSocketEvent::HandleEvent(PLEvent*) + 41
10  libxpcom_core.dylib         0x00e44551 PL_HandleEvent + 21
11  org.mozilla.firefox         0x0033c382 nsSocketTransportService::ServiceEventQ() + 108
12  org.mozilla.firefox         0x0033c809 nsSocketTransportService::ServiceEventQ() + 1267
13  libxpcom_core.dylib         0x00e46fe3 nsThread::Main(void*) + 41
14  libnspr4.dylib              0x00edaffd PR_Select + 813
15  libSystem.B.dylib           0x90024987 _pthread_body + 84

Comment 1

[Ray Kiddy]

Attachment: crash log

Comment 2

[Martijn Wargers (dead)]

This bug has the same stacktrace as bug 342646.
That bug was fixed, but bugs like bug 345904 were made duplicate of that bug.
I guess it isn't totally fixed yet.

Comment 3

[timeless]

Comment on attachment 273336 [details]
crash log

>Thread 1 Crashed:
>0   libxpcom_core.dylib      	0x00e06ee3 PL_DHashTableOperate + 15
>1   libxpcom_core.dylib      	0x00e0f9e1 nsCStringHashSetSuper::GetEntry(nsACString_internal const&) + 19
>2   org.mozilla.firefox      	0x00350eec nsSSLIOLayerHelpers::isKnownAsIntolerantSite(nsCString const&) + 42
>3   org.mozilla.firefox      	0x00351a0b nsSSLIOLayerAddToSocket(int, char const*, int, char const*, int, PRFileDesc*, nsISupports**, int) + 945
>4   org.mozilla.firefox      	0x00351ba1 nsSSLIOLayerNewSocket(int, char const*, int, char const*, int, PRFileDesc**, nsISupports**, int) + 79
>5   org.mozilla.firefox      	0x00059149 nsSSLSocketProvider::~nsSSLSocketProvider [in-charge deleting]() + 159
>6   org.mozilla.firefox      	0x005b0f98 nsSocketTransport::BuildSocket(PRFileDesc*&, int&, int&) + 366
>7   org.mozilla.firefox      	0x005b1437 nsSocketTransport::InitiateSocket() + 303
>8   org.mozilla.firefox      	0x005b2256 nsSocketTransport::OnSocketEvent(unsigned, unsigned, nsISupports*) + 272
>9   org.mozilla.firefox      	0x00870457 nsSocketEvent::HandleEvent(PLEvent*) + 41
>10  libxpcom_core.dylib      	0x00e44551 PL_HandleEvent + 21
>11  org.mozilla.firefox      	0x0033c382 nsSocketTransportService::ServiceEventQ() + 108
>12  org.mozilla.firefox      	0x0033c809 nsSocketTransportService::ServiceEventQ() + 1267
>13  libxpcom_core.dylib      	0x00e46fe3 nsThread::Main(void*) + 41
>14  libnspr4.dylib           	0x00edaffd PR_Select + 813
>15  libSystem.B.dylib        	0x90024987 _pthread_body + 84

http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpcom/ds/nsDoubleHashtable.h&rev=3.17&mark=99,103-104,330#99
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/security/manager/ssl/src/nsNSSIOLayer.cpp&rev=1.131&mark=1301#1297

psm isn't checking the rv from Init here, that's a bug. (but it's unlikely to be the cause of this crash...)

frame 5 is some confusion involving pick_two(compiler, optimizer, debugger, stackwalker). It should really be nsTLSSocketProvider::NewSocket or nsSSLSocketProvider::NewSocket

I was having trouble following infoObject, I've decided the standard path is this:
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/security/manager/ssl/src/nsNSSIOLayer.cpp&rev=1.131&mark=2524,2566,812
the NS_RELEASE_THIS is of course gross.

I believe the proper path would be SSL_RevealPinArg since then one could at least follow the maze of twisty passages (although a comment mentioning |SSL_RevealPinArg| is being avoided because we know it's pointing to ourselves would also work.)

Comment 4

[timeless]

Bug 505682 submitted for the first part. the second part well... meh.

Comment 5

[Jesse Ruderman]

If *timeless* thinks it's meh, it's meh.