636810 - crash [@ nsNSSSocketInfo::EnsureDocShellDependentStuffKnown] (also intermittently during tests/security/ssl/mixedcontent/test_bug383369.html)

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect)

Description

[Dave Miller [:justdave]]

This bug was filed from the Socorro interface and is 
report bp-f79786de-b80a-40b5-9d43-948842110225 .
============================================================= 

I was editing a mirror in the bouncer admin interface, and when I clicked Save, I got this crash.

Comment 1

[Benjamin Smedberg]

Also seen in a tinderbox run today during test_bug383369.html:
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1308337922.1308338375.15961.gz

CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x0

Thread 16 (crashed)
 0  xul.dll!CallGetInterface<nsIInterfaceRequestor,nsISecureBrowserUI>(nsIInterfaceRequestor *,nsISecureBrowserUI * *) [nsIInterfaceRequestorUtils.h:60182c83c925 : 55 + 0xc]
    eip = 0x659553e9   esp = 0x097ef3d8   ebp = 0x097ef3e0   ebx = 0x07d54108
    esi = 0x00000000   edi = 0x00000000   eax = 0x00000000   ecx = 0x00000000
    edx = 0x097ef464   efl = 0x00010246
    Found by: given as instruction pointer in context
 1  xul.dll!nsNSSSocketInfo::EnsureDocShellDependentStuffKnown() [nsNSSIOLayer.cpp:60182c83c925 : 385 + 0x11]
    eip = 0x6594ced2   esp = 0x097ef3e8   ebp = 0x097ef468
    Found by: call frame info
 2  xul.dll!nsNSSSocketInfo::GetPreviousCert(nsIX509Cert * *) [nsNSSIOLayer.cpp:60182c83c925 : 849 + 0x7]
    eip = 0x6594de70   esp = 0x097ef470   ebp = 0x097ef480
    Found by: call frame info
 3  xul.dll!HandshakeCallback(PRFileDesc *,void *) [nsNSSCallbacks.cpp:60182c83c925 : 922 + 0x28]
    eip = 0x6593e929   esp = 0x097ef488   ebp = 0x097ef798
    Found by: call frame info
 4  ssl3.dll!ssl3_HandleFinished [ssl3con.c:60182c83c925 : 8501 + 0x1a]
    eip = 0x70b94195   esp = 0x097ef7a0   ebp = 0x097ef7e0
    Found by: call frame info
 5  ssl3.dll!ssl3_HandleHandshakeMessage [ssl3con.c:60182c83c925 : 8657 + 0x14]
    eip = 0x70b8d638   esp = 0x097ef7e8   ebp = 0x097ef838
    Found by: call frame info
 6  ssl3.dll!ssl3_HandleHandshake [ssl3con.c:60182c83c925 : 8725 + 0x18]
    eip = 0x70b8ce28   esp = 0x097ef840   ebp = 0x097ef860
    Found by: call frame info
 7  ssl3.dll!ssl3_HandleRecord [ssl3con.c:60182c83c925 : 9064 + 0xc]
    eip = 0x70b8c21f   esp = 0x097ef868   ebp = 0x097ef8f8
    Found by: call frame info
 8  ssl3.dll!ssl3_GatherCompleteHandshake [ssl3gthr.c:60182c83c925 : 209 + 0x16]
    eip = 0x70b993c2   esp = 0x097ef900   ebp = 0x097ef924
    Found by: call frame info
 9  ssl3.dll!ssl_GatherRecord1stHandshake [sslcon.c:60182c83c925 : 1258 + 0xa]
    eip = 0x70b9a81b   esp = 0x097ef92c   ebp = 0x097ef938
    Found by: call frame info
10  ssl3.dll!ssl_Do1stHandshake [sslsecur.c:60182c83c925 : 151 + 0xe]
    eip = 0x70ba92fd   esp = 0x097ef940   ebp = 0x097ef94c
    Found by: call frame info
11  ssl3.dll!ssl_SecureSend [sslsecur.c:60182c83c925 : 1222 + 0x8]
    eip = 0x70bab2f2   esp = 0x097ef954   ebp = 0x097ef960
    Found by: call frame info
12  ssl3.dll!ssl_SecureWrite [sslsecur.c:60182c83c925 : 1267 + 0x12]
    eip = 0x70bab476   esp = 0x097ef968   ebp = 0x097ef978
    Found by: call frame info
13  ssl3.dll!ssl_Write [sslsock.c:60182c83c925 : 1654 + 0x16]
    eip = 0x70bb3623   esp = 0x097ef980   ebp = 0x097ef994
    Found by: call frame info
14  xul.dll!nsSSLThread::Run() [nsSSLThread.cpp:60182c83c925 : 1046 + 0x1b]
    eip = 0x65939c29   esp = 0x097ef99c   ebp = 0x097ef9f4
    Found by: call frame info

This looks related to bug 617381

Comment 2

[Tony Mechelynck [:tonymec]]

Soccorro suggested this bug while I was investigated if I could reproduce bug 678637 on Firefox (SeaMonkey crashes in libxul with SEGV at address zero on ChatZilla startup, and yes I could). I'm on Linux-x86_64.

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

nsNSSSocketInfo::EnsureDocShellDependentStuffKnown was removed as part of the SSL thread removal and XPCOM thread removal.