Closed Bug 716636 Opened 13 years ago Closed 13 years ago

Assertion failure: PZ_InMonitor((ss)->firstHandshakeLock) || !ssl_HaveRecvBufLock(ss)

Categories

(Core :: Security: PSM, defect)

Product:
Core
Component:
Security: PSM
Version:
11 Branch
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla13
Tracking Flags:
Tracking Status
firefox9 --- unaffected
firefox10 --- unaffected
firefox11 + verified
firefox12 + verified

People

(Reporter: bc, Assigned: briansmith)

References

(
URL
)

Details

(Keywords: assertion, Whiteboard: [qa!])

Attachments

(3 files, 1 obsolete file)

crash report windows 7
55.76 KB, text/plain
Details
Part 1: Fix TLS toleraance lock reentrence bug
9.05 KB, patch
mayhemer
: review+
Details | Diff | Splinter Review
Part 2: Fix cert authentication lock reentrence bug
3.05 KB, patch
mayhemer
: review+
Details | Diff | Splinter Review
Attached file crash report windows 7 (obsolete) —
1. visit url with debug build of Firefox Nightly/12 or Aurora/11 on Linux, Mac, Windows. The url contains confidential information. I need guidance on how to share. 2. Assertion failure: PZ_InMonitor((ss)->firstHandshakeLock) || !ssl_HaveRecvBufLock(ss), at sslsock.c:779 security sensitive because I do not undertand the implications of this. Windows 7 and Linux have similar stacks. See crash report. The Mac crash has a very strange unrelated stack. Mac OS X 10.5q Assertion failure: PZ_InMonitor((ss)->firstHandshakeLock) || !ssl_HaveRecvBufLock(ss), at sslsock.c:779 Program received signal SIGABRT, Aborted. 0x9276c9a1 in CUIRenderer::DrawWindowFrameDark () (gdb) bt #0 0x9276c9a1 in CUIRenderer::DrawWindowFrameDark () #1 0x9278119e in CUIRenderer::Draw () #2 0x06a78f3b in nsNativeThemeCocoa::DrawUnifiedToolbar (this=0x1f2863a0, cgContext=0x22e63a60, inBoxRect=@0xbfff926c, aWindow=0x1b66f9c0) at /work/mozilla/builds/nightly/mozilla/widget/cocoa/nsNativeThemeCocoa.mm:1720 #3 0x06a7e38e in nsNativeThemeCocoa::DrawWidgetBackground (this=0x1f2863a0, aContext=0x23c4e080, aFrame=0xd49670, aWidgetType=12 '\f', aRect=@0xbfff9730, aDirtyRect=@0xbfff95e0) at /work/mozilla/builds/nightly/mozilla/widget/cocoa/nsNativeThemeCocoa.mm:1980 #4 0x058bd9b0 in nsCSSRendering::PaintBackgroundWithSC (aPresContext=0xb19000, aRenderingContext=@0x23c4e080, aForFrame=0xd49670, aDirtyRect=@0xebaa7c, aBorderArea=@0xbfff9730, aBackgroundSC=0xd2c298, aBorder=@0xe1b520, aFlags=4, aBGClipRect=0x0) at /work/mozilla/builds/nightly/mozilla/layout/base/nsCSSRendering.cpp:2312 #5 0x058be17f in nsCSSRendering::PaintBackground (aPresContext=0xb19000, aRenderingContext=@0x23c4e080, aForFrame=0xd49670, aDirtyRect=@0xebaa7c, aBorderArea=@0xbfff9730, aFlags=4, aBGClipRect=0x0) at /work/mozilla/builds/nightly/mozilla/layout/base/nsCSSRendering.cpp:1485
Attached file crash report windows 7 —
Attachment #587077 - Attachment is obsolete: true
https://www.dskdirect.bg/page/default.aspx works fine without any identifying information.
URL: https://www.dskdirect.bg/page/default...
Thanks for the bug report! This is caused by my patch to bug 674147. SSL_GetOption cannot be called from within a SSL callback function, but that is exactly what we are doing (indirectly, though rememberTolerantSite).
Assignee: nobody → nobody
Blocks: 674147
Component: Libraries → Security: PSM
Product: NSS → Core
QA Contact: libraries → psm
Target Milestone: --- → mozilla11
Version: 3.13.2 → 11 Branch
I have found another instance of this, where we call SetCertVerificationResult in SSLServerCertVerifiationJob::Dispatch().
Assignee: nobody → bsmith
Brian, this is not the first time I see this. Please, add to bugs you both analyze and create patches for some notes about what was the cause of the bug, for the record. The patch sometimes might not be enough to explain, and actually it makes reviewing harder. Thanks.
Comment on attachment 590537 [details] [diff] [review] Part 2: Fix cert authentication lock reentrence bug Review of attachment 590537 [details] [diff] [review]: ----------------------------------------------------------------- r=honzab, but see the comments ::: security/manager/ssl/src/SSLServerCertVerification.cpp @@ -603,5 @@ > if (!socketInfo || !serverCert) { > NS_ERROR("Invalid parameters for SSL server cert validation"); > - socketInfo->SetCertVerificationResult(PR_INVALID_STATE_ERROR, > - PlainErrorMessage); > - PR_SetError(PR_INVALID_STATE_ERROR, 0); This one removed is OK, and so obvious... @@ -621,5 @@ > if (NS_FAILED(nrv)) { > PRErrorCode error = nrv == NS_ERROR_OUT_OF_MEMORY > ? SEC_ERROR_NO_MEMORY > : PR_INVALID_STATE_ERROR; > - socketInfo->SetCertVerificationResult(error, PlainErrorMessage); But this one may bring the socket's state variable mCertVerificationState to an inconsistent state since you have called SetCertVerificationWaiting() on the socket... Since this is called only on the socket thread, and the result that informs and wakes the socket is a post to this thread too, you may freely call SetCertVerificationWaiting() after a successful dispatch. If you agree, then please add that comment explaining why that is OK.
Attachment #590537 - Flags: review?(honzab.moz) → review+
Comment on attachment 590536 [details] [diff] [review] Part 1: Fix TLS toleraance lock reentrence bug Review of attachment 590536 [details] [diff] [review]: ----------------------------------------------------------------- r=honzab
Attachment #590536 - Flags: review?(honzab.moz) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/90fbcfc9bfdc https://hg.mozilla.org/integration/mozilla-inbound/rev/2a702d94a24c > But this one may bring the socket's state variable mCertVerificationState to > an inconsistent state since you have called SetCertVerificationWaiting() on > the socket... > > Since this is called only on the socket thread, and the result that informs > and wakes the socket is a post to this thread too, you may freely call > SetCertVerificationWaiting() after a successful dispatch. > > If you agree, then please add that comment explaining why that is OK. Hmm...I misunderstood your comment and I already pushed the patch to inbound based on that misunderstanding. Now I understand that you are saying that you are saying we should call SetCertVerificationWaiting after the Dispatch, instead of before the Dispatch, and that it is safe to do so. Instead, because I misunderstood you, I added a comment explaining why the patch is correct--it doesn't matter if mCertVerificationState is inconsistent, because we already have to handle non-cert errors that might occur in that state (e.g. TLS intolerance, other errors that libssl returns, etc.). mCertVerificationState only needs to be consistent up to the point of the first error; once an error occurs, its value no longer matters.
Whiteboard: [inbound]
(In reply to Brian Smith (:bsmith) from comment #10) > Hmm...I misunderstood your comment and I already pushed the patch to inbound > based on that misunderstanding. Now I understand that you are saying that > you are saying we should call SetCertVerificationWaiting after the Dispatch, > instead of before the Dispatch, and that it is safe to do so. Instead, > because I misunderstood you, I added a comment explaining why the patch is > correct--it doesn't matter if mCertVerificationState is inconsistent, > because we already have to handle non-cert errors that might occur in that > state (e.g. TLS intolerance, other errors that libssl returns, etc.). > mCertVerificationState only needs to be consistent up to the point of the > first error; once an error occurs, its value no longer matters. Hmm.. :) Or I might really need to improve my English. It is OK to do this in a small followup. This may potentially fail as Dispatch is responsible for creating the actual thread here but it is not critical.
Target Milestone: mozilla11 → mozilla13
Target Milestone: mozilla13 → mozilla11
(This landed on mozilla13, so changing target milestone back to reflect the milestone of initial landing, since this is the convention typically used for this field. When this is backported, the status-firefox12/status-firefox11 flags can be set to fixed.) https://hg.mozilla.org/mozilla-central/rev/90fbcfc9bfdc https://hg.mozilla.org/mozilla-central/rev/2a702d94a24c
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Target Milestone: mozilla11 → mozilla13
Tracking for Firefox 11 and 12 given possible web incompatibilities. Please nominate with a risk/benefit evaluation as soon as possible.
tracking-firefox11: ? → +
tracking-firefox12: ? → +
(In reply to Honza Bambas (:mayhemer) from comment #11) > Hmm.. :) Or I might really need to improve my English. It is OK to do this > in a small followup. This may potentially fail as Dispatch is responsible > for creating the actual thread here but it is not critical. Honza, I don't quite get it. What could go wrong?
(In reply to Brian Smith (:bsmith) from comment #14) > (In reply to Honza Bambas (:mayhemer) from comment #11) > > Hmm.. :) Or I might really need to improve my English. It is OK to do this > > in a small followup. This may potentially fail as Dispatch is responsible > > for creating the actual thread here but it is not critical. > > Honza, I don't quite get it. What could go wrong? nsThreadPool::Dispatch() is a method that creates the actual thread to dispatch the given event to if there is no thread in an idle state to take it (and we are no at the thread number limit ; nsThreadPool it self, when created, doesn't do anything). So, there are things that can fail. There is more then 0 chance Dispatch can fail.
Whiteboard: [inbound]
Whiteboard: [qa+]
(In reply to Honza Bambas (:mayhemer) from comment #15) > nsThreadPool::Dispatch() is a method that creates the actual thread to > dispatch the given event to if there is no thread in an idle state to take > it (and we are no at the thread number limit ; nsThreadPool it self, when > created, doesn't do anything). > > So, there are things that can fail. There is more then 0 chance Dispatch > can fail. When nsThreadPool::Dispatch fails, we handle that case in the NS_FAILED(nrv) branch, calling PR_SetError() and returning SECFailure from SSLServerCertVerificationJob::Dispatch. The caller of SSLServerCertVerificationJob::Dispatch is AuthCertificateHook. It immediately returns the value of SSLServerCertVerificationJob::Dispatch: SECStatus rv = SSLServerCertVerificationJob::Dispatch( static_cast<const void *>(fd), socketInfo, serverCert); return rv; So, in this case, AuthCertificateHook will return SECFailure with the error code set correctly. This will cause libssl to see that certificate validation failed *synchronously*.
(In reply to Brian Smith (:bsmith) from comment #17) > When nsThreadPool::Dispatch fails, .... cause libssl to see that certificate > validation failed *synchronously*. Yes. But in case of Dispatch() failure you are leaving the state of socketInfo as set by SetCertVerificationWaiting(); You have to call SetCertVerificationResult(some-error-code) in that case or call SetCertVerificationWaiting() only after a successful dispatch. You can do that, it is thread safe.
(In reply to Honza Bambas (:mayhemer) from comment #18) > (In reply to Brian Smith (:bsmith) from comment #17) > Yes. But in case of Dispatch() failure you are leaving the state of > socketInfo as set by SetCertVerificationWaiting(); When we return SECFailure, the SSL send() or recv() method will return -1, and then we will call checkHandshake, which will (eventually, indirectly) call SetCanceled to set the error code on the socket. The socket will still be in the "waiting" state, but that doesn't cause any problems, AFAICT.
Could you please tell me how to test this fix ?
You will only notice it on debug builds. When you run a debug build from before the fix, you should get an assertion dialog box when you visit a HTTPS page like the one in the URL field of this bug. When you run a debug build from after the fix, there will be no assertion.
I've tested this on ftp://ftp.mozilla.org/pub/firefox/nightly/2012/02/2012-02-28-mozilla-beta-debug/ on Win 7/64. I don't see any assertion dialog, but Firefox still crashes, sometimes right after loading https://www.dskdirect.bg/page/default.aspx or when closing FF with the link opened. https://crash-stats.mozilla.com/report/index/bp-9af1d403-0860-457b-8af9-43bf32120229
I can't reproduce a crash either in automation with Beta/11, Aurora/12, Nightly/13 debug builds on Windows XP, Windows 7, Fedora 16 32 or 64 bit, or Mac OS X 10.6 or locally with local builds nor with the beta debug build from 2012-02-28 on win7 64bit. Paul, the crash reports for debug builds do not contain symbols so they aren't very helpful. The best way to test this is to start firefox from the command line and to set the following environment variables first set MOZ_NO_REMOTE=1 set NO_EM_RESTART=1 set XPCOM_DEBUG_BREAK=warn set MOZ_CRASHREPORTER_NO_REPORT=1 set MOZ_CRASHREPORTER_DISABLE=1 set MOZ_GDB_SLEEP=1 then start firefox and load the url. If an abort or fatal assertion occurs you will see a message in the console like Assertion failure: PZ_InMonitor((ss)->firstHandshakeLock) || !ssl_HaveRecvBufLock(ss), at ... If you can reproduce your crash, please tell us what debug abort or assertion is displayed.
Assertion failed at e:/builds/moz2_slave/m-beta-w32-dbg/build/gfx/cairo/cairo/sr c/cairo-hash.c:196: hash_table->live_entries == 0 Leaked URLs: resource://gre-resources/ua.css resource://gre-resources/html.css chrome://global/content/xul.css resource://gre-resources/quirk.css resource://gre-resources/full-screen-override.css chrome://global/skin/scrollbars.css resource://gre-resources/forms.css chrome://global/content/bindings/scrollbar.xml#scrollbar chrome://global/content/bindings/scrollbar.xml chrome://global/content/bindings/scrollbar.xml#scrollbar-base chrome://global/content/bindings/scrollbar.xml#scrollbar chrome://global/content/bindings/scrollbar.xml#thumb chrome://global/content/bindings/scrollbar.xml chrome://global/content/bindings/scrollbar.xml#scrollbar-base chrome://global/skin/scrollbar/slider.gif chrome://global/skin/arrow/arrow-lft.gif chrome://global/content/bindings/scrollbar.xml#thumb chrome://global/skin/arrow/arrow-rit.gif chrome://global/skin/arrow/arrow-up.gif chrome://global/skin/arrow/arrow-dn.gif chrome://global/content/bindings/resizer.xml#resizer chrome://global/content/bindings/resizer.xml chrome://global/content/bindings/resizer.xml#resizer chrome://global/content/bindings/resizer.xml chrome://global/skin/resizer.css chrome://global/skin/icons/resizer.png chrome://global/content/bindings/scrollbar.xml#scrollbar-base chrome://global/skin/arrow/arrow-rit-dis.gif chrome://global/skin/arrow/arrow-lft-dis.gif chrome://global/skin/arrow/arrow-dn-dis.gif chrome://global/skin/arrow/arrow-up-dis.gif chrome://global/content/bindings/general.xml#root-element chrome://global/content/bindings/general.xml chrome://global/content/bindings/general.xml#statusbar chrome://global/content/bindings/general.xml#iframe chrome://global/content/bindings/general.xml#statusbar chrome://global/content/bindings/general.xml#statusbar-drag chrome://global/content/bindings/general.xml#dropmarker chrome://global/content/bindings/general.xml#statusbarpanel chrome://global/content/bindings/general.xml#statusbarpanel-iconic chrome://global/content/bindings/general.xml#basecontrol chrome://global/content/bindings/general.xml#basetext chrome://global/content/bindings/general.xml#basecontrol chrome://global/content/bindings/general.xml chrome://global/content/bindings/general.xml#statusbarpanel chrome://global/content/bindings/general.xml#statusbarpanel-iconic-text chrome://global/content/bindings/general.xml#basetext chrome://global/content/bindings/general.xml#control-item chrome://global/content/bindings/general.xml#windowdragbox chrome://global/content/bindings/general.xml#root-element chrome://global/content/bindings/general.xml#deck chrome://global/content/bindings/general.xml#statusbarpanel chrome://global/content/bindings/general.xml#statusbarpanel chrome://global/content/bindings/general.xml#statusbarpanel-menu-iconic chrome://global/content/bindings/general.xml#image chrome://global/content/bindings/popup.xml#tooltip chrome://global/content/bindings/popup.xml chrome://global/content/bindings/popup.xml#panel chrome://global/content/bindings/popup.xml#arrowpanel chrome://global/content/bindings/popup.xml#popup-base chrome://global/content/bindings/popup.xml#popup chrome://global/content/bindings/popup.xml#popup-base chrome://global/content/bindings/popup.xml#panel chrome://global/content/bindings/popup.xml#popup-base chrome://global/content/bindings/popup.xml chrome://global/content/bindings/popup.xml#popup-base chrome://global/content/bindings/popup.xml#tooltip chrome://global/content/bindings/popup.xml#popup chrome://global/content/bindings/popup.xml#popup-scrollbars chrome://global/skin/popup.css chrome://global/content/bindings/stringbundle.xml#stringbundleset chrome://global/content/bindings/stringbundle.xml chrome://global/content/bindings/stringbundle.xml#stringbundleset chrome://global/content/bindings/stringbundle.xml chrome://global/content/bindings/stringbundle.xml#stringbundle chrome://global/content/bindings/general.xml#deck chrome://global/content/bindings/stringbundle.xml#stringbundle chrome://global/content/bindings/popup.xml#popup chrome://browser/content/urlbarBindings.xml chrome://browser/content/urlbarBindings.xml#promobox chrome://global/content/bindings/autocomplete.xml#autocomplete chrome://browser/content/urlbarBindings.xml#urlbar chrome://browser/content/urlbarBindings.xml chrome://global/content/bindings/menu.xml#menuitem chrome://browser/content/urlbarBindings.xml#menuitem-tooltip chrome://global/content/bindings/notification.xml#popup-notification chrome://browser/content/urlbarBindings.xml#addon-progress-notification chrome://global/content/bindings/notification.xml#popup-notification chrome://browser/content/urlbarBindings.xml#geolocation-notification chrome://global/content/bindings/autocomplete.xml#autocomplete-rich-result-pop up chrome://browser/content/urlbarBindings.xml#urlbar-rich-result-popup chrome://global/content/bindings/menu.xml#menuitem-iconic chrome://browser/content/urlbarBindings.xml#menuitem-iconic-tooltip chrome://browser/content/urlbarBindings.xml#splitmenu chrome://global/content/bindings/autocomplete.xml#autocomplete-result-popup chrome://browser/content/urlbarBindings.xml#browser-autocomplete-result-popup chrome://global/content/bindings/autocomplete.xml chrome://global/content/bindings/richlistbox.xml#richlistbox chrome://global/content/bindings/autocomplete.xml#autocomplete-richlistbox chrome://global/content/bindings/general.xml#dropmarker chrome://global/content/bindings/autocomplete.xml#history-dropmarker chrome://global/content/bindings/popup.xml#popup chrome://global/content/bindings/autocomplete.xml#autocomplete-base-popup chrome://global/content/bindings/textbox.xml#textbox chrome://global/content/bindings/autocomplete.xml#autocomplete chrome://global/content/bindings/autocomplete.xml chrome://global/content/bindings/richlistbox.xml#richlistitem chrome://global/content/bindings/autocomplete.xml#autocomplete-richlistitem chrome://global/content/bindings/tree.xml#tree chrome://global/content/bindings/autocomplete.xml#autocomplete-tree chrome://global/content/bindings/autocomplete.xml#autocomplete-base-popup chrome://global/content/bindings/autocomplete.xml#autocomplete-rich-result-pop up chrome://global/content/bindings/autocomplete.xml#autocomplete-base-popup chrome://global/content/bindings/autocomplete.xml#autocomplete-result-popup chrome://global/content/bindings/autocomplete.xml#autocomplete-treebody chrome://global/content/bindings/autocomplete.xml#autocomplete-treerows chrome://global/skin/tree.css chrome://global/skin/autocomplete.css chrome://global/content/bindings/popup.xml#arrowpanel chrome://global/content/bindings/popup.xml#panel chrome://global/content/bindings/button.xml#menu chrome://global/content/bindings/button.xml chrome://global/content/bindings/button.xml#menu-button-base chrome://global/content/bindings/button.xml#menu-button chrome://global/content/bindings/button.xml#button chrome://global/content/bindings/button.xml#button-image chrome://global/content/bindings/general.xml#basetext chrome://global/content/bindings/button.xml#button-base chrome://global/content/bindings/button.xml chrome://global/content/bindings/button.xml#button chrome://global/content/bindings/button.xml#menu chrome://global/content/bindings/button.xml#button-base chrome://global/content/bindings/button.xml#button chrome://global/content/bindings/button.xml#button-base chrome://global/content/bindings/button.xml#menu-button-base chrome://global/content/bindings/button.xml#button chrome://global/content/bindings/button.xml#button-repeat chrome://global/skin/button.css chrome://global/content/bindings/general.xml#dropmarker chrome://global/skin/dropmarker.css chrome://global/content/bindings/general.xml#image chrome://global/content/bindings/text.xml#text-label chrome://global/content/bindings/text.xml chrome://global/content/bindings/text.xml#text-base chrome://global/content/bindings/text.xml chrome://global/content/bindings/text.xml#text-label chrome://global/content/bindings/text.xml#text-link chrome://global/content/bindings/text.xml#text-label chrome://global/content/bindings/text.xml#label-control chrome://global/content/bindings/text.xml#text-base chrome://global/content/bindings/text.xml#text-label chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton chrome://global/content/bindings/toolbarbutton.xml chrome://global/content/bindings/button.xml#menu-button-base chrome://global/content/bindings/toolbarbutton.xml#menu-button chrome://global/content/bindings/button.xml#button-base chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton chrome://global/content/bindings/toolbarbutton.xml chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton chrome://global/content/bindings/toolbarbutton.xml#menu-vertical chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton chrome://global/content/bindings/toolbarbutton.xml#menu chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton-image chrome://global/skin/toolbarbutton.css chrome://global/content/bindings/toolbar.xml#toolbox chrome://global/content/bindings/toolbar.xml chrome://global/content/bindings/toolbar.xml#toolbar chrome://global/content/bindings/toolbar.xml#toolbar-drag chrome://global/content/bindings/toolbar.xml#toolbar-base chrome://global/content/bindings/toolbar.xml#menubar chrome://global/content/bindings/toolbar.xml#toolbar-base chrome://global/content/bindings/toolbar.xml#toolbar chrome://global/content/bindings/toolbar.xml#toolbar-base chrome://global/content/bindings/toolbar.xml chrome://global/content/bindings/toolbar.xml#toolbar chrome://global/content/bindings/toolbar.xml#toolbar-menubar-autohide chrome://global/content/bindings/toolbar.xml#toolbar-base chrome://global/content/bindings/toolbar.xml#toolbardecoration chrome://global/content/bindings/toolbar.xml#toolbarpaletteitem chrome://global/content/bindings/toolbar.xml#toolbarpaletteitem-palette chrome://global/content/bindings/toolbar.xml#toolbar-base chrome://global/content/bindings/toolbar.xml#toolbarpaletteitem chrome://global/content/bindings/toolbar.xml#toolbar-base chrome://global/content/bindings/toolbar.xml#toolbox chrome://global/skin/toolbar.css chrome://global/content/bindings/toolbar.xml#toolbar-menubar-autohide chrome://global/content/bindings/toolbar.xml#toolbar chrome://global/content/bindings/toolbar.xml#menubar chrome://global/content/bindings/menu.xml#menu-menubar chrome://global/content/bindings/menu.xml chrome://global/content/bindings/menu.xml#menuitem-base chrome://global/content/bindings/menu.xml#menuseparator chrome://global/content/bindings/menu.xml#menuitem-base chrome://global/content/bindings/menu.xml#menu-base chrome://global/content/bindings/menu.xml#menuitem-base chrome://global/content/bindings/menu.xml#menubutton-item chrome://global/content/bindings/general.xml#control-item chrome://global/content/bindings/menu.xml#menuitem-base chrome://global/content/bindings/menu.xml chrome://global/content/bindings/menu.xml#menu-base chrome://global/content/bindings/menu.xml#menu-iconic chrome://global/content/bindings/menu.xml#menu-base chrome://global/content/bindings/menu.xml#menu-menubar-iconic chrome://global/content/bindings/menu.xml#menuitem chrome://global/content/bindings/menu.xml#menuitem-iconic chrome://global/content/bindings/menu.xml#menuitem-base chrome://global/content/bindings/menu.xml#menuitem chrome://global/content/bindings/menu.xml#menu-base chrome://global/content/bindings/menu.xml#menu chrome://global/content/bindings/menu.xml#menu-base chrome://global/content/bindings/menu.xml#menu-menubar chrome://global/content/bindings/menu.xml#menuitem chrome://global/content/bindings/menu.xml#menuitem-iconic-desc-noaccel chrome://global/content/bindings/menu.xml#menuitem chrome://global/content/bindings/menu.xml#menuitem-iconic-noaccel chrome://global/skin/menu.css chrome://browser/content/places/menu.xml chrome://global/content/bindings/popup.xml#popup chrome://browser/content/places/menu.xml#places-popup-base chrome://browser/content/places/menu.xml chrome://global/content/bindings/textbox.xml chrome://global/content/bindings/textbox.xml#textbox chrome://global/content/bindings/textbox.xml#timed-textbox chrome://global/content/bindings/textbox.xml#input-box chrome://global/content/bindings/textbox.xml#input-box-spell chrome://global/content/bindings/textbox.xml#textbox chrome://global/content/bindings/textbox.xml chrome://global/content/bindings/textbox.xml#textbox chrome://global/content/bindings/textbox.xml#textarea chrome://global/content/bindings/textbox.xml#textbox chrome://global/content/bindings/textbox.xml#search-textbox chrome://global/content/bindings/textbox.xml#input-box chrome://global/content/textbox.css chrome://global/skin/textbox.css chrome://global/content/bindings/autocomplete.xml#history-dropmarker chrome://global/content/bindings/textbox.xml#input-box chrome://global/content/platformHTMLBindings.xml#inputFields chrome://global/content/platformHTMLBindings.xml chrome://global/content/platformHTMLBindings.xml#inputFields chrome://global/content/platformHTMLBindings.xml chrome://global/content/platformHTMLBindings.xml#browser chrome://global/content/platformHTMLBindings.xml#editor chrome://global/content/platformHTMLBindings.xml#textAreas chrome://browser/content/search/search.xml chrome://browser/content/search/search.xml#searchbar chrome://browser/content/search/search.xml chrome://global/content/bindings/autocomplete.xml#autocomplete chrome://browser/content/search/search.xml#searchbar-textbox chrome://browser/content/search/searchbarBindings.css chrome://browser/skin/searchbar.css chrome://browser/content/search/search.xml#searchbar-textbox chrome://global/skin/icons/folder-item.png chrome://browser/skin/mainwindow-dropdown-arrow.png chrome://global/skin/icons/Search-glass.png chrome://global/content/bindings/toolbarbutton.xml#menu chrome://global/skin/arrow/arrow-dn.gif chrome://global/content/bindings/scrollbox.xml#scrollbox chrome://global/content/bindings/scrollbox.xml chrome://global/content/bindings/general.xml#basecontrol chrome://global/content/bindings/scrollbox.xml#scrollbox-base chrome://global/content/bindings/scrollbox.xml chrome://global/content/bindings/scrollbox.xml#scrollbox-base chrome://global/content/bindings/scrollbox.xml#arrowscrollbox chrome://global/content/bindings/scrollbox.xml#scrollbox-base chrome://global/content/bindings/scrollbox.xml#scrollbox chrome://global/content/bindings/scrollbox.xml#scrollbox-base chrome://global/content/bindings/scrollbox.xml#autorepeatbutton chrome://global/content/bindings/scrollbox.xml#arrowscrollbox chrome://global/content/bindings/scrollbox.xml#arrowscrollbox-clicktoscroll chrome://global/skin/scrollbox.css chrome://browser/content/tabbrowser.xml chrome://global/content/bindings/tabbox.xml#tabbox chrome://browser/content/tabbrowser.xml#tabbrowser-tabbox chrome://browser/content/tabbrowser.xml#statuspanel chrome://global/content/bindings/scrollbox.xml#arrowscrollbox-clicktoscroll chrome://browser/content/tabbrowser.xml#tabbrowser-arrowscrollbox chrome://global/content/bindings/tabbox.xml#tabs chrome://browser/content/tabbrowser.xml#tabbrowser-tabs chrome://browser/content/tabbrowser.xml#tabbrowser chrome://browser/content/tabbrowser.xml chrome://global/content/bindings/tabbox.xml#tab chrome://browser/content/tabbrowser.xml#tabbrowser-tab chrome://global/content/bindings/popup.xml#popup chrome://browser/content/tabbrowser.xml#tabbrowser-alltabs-popup chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton-image chrome://browser/content/tabbrowser.xml#tabbrowser-close-tab-button chrome://browser/content/tabbrowser.css chrome://global/content/bindings/tabbox.xml chrome://global/content/bindings/general.xml#basecontrol chrome://global/content/bindings/tabbox.xml#tabs chrome://global/content/bindings/general.xml#control-item chrome://global/content/bindings/tabbox.xml#tab chrome://global/content/bindings/tabbox.xml#tab-base chrome://global/content/bindings/tabbox.xml#tabpanels chrome://global/content/bindings/tabbox.xml#tab-base chrome://global/content/bindings/tabbox.xml chrome://global/content/bindings/tabbox.xml#tab-base chrome://global/content/bindings/tabbox.xml#tabbox chrome://global/skin/tabbox.css chrome://browser/content/tabbrowser.xml#tabbrowser-arrowscrollbox chrome://browser/content/tabbrowser.xml#tabbrowser-close-tab-button chrome://global/content/bindings/splitter.xml#splitter chrome://global/content/bindings/splitter.xml chrome://global/content/bindings/splitter.xml#splitter chrome://global/content/bindings/splitter.xml chrome://global/content/bindings/splitter.xml#grippy chrome://global/skin/splitter.css chrome://browser/content/tabbrowser.xml#tabbrowser-tabbox chrome://global/content/bindings/tabbox.xml#tabpanels chrome://global/content/bindings/notification.xml#notificationbox chrome://global/content/bindings/notification.xml chrome://global/content/bindings/notification.xml#notificationbox chrome://global/content/bindings/notification.xml chrome://global/content/bindings/notification.xml#notification chrome://global/content/bindings/notification.xml#popup-notification chrome://global/content/bindings/browser.xml#browser chrome://global/content/bindings/browser.xml chrome://global/content/bindings/browser.xml#browser chrome://global/content/bindings/browser.xml chrome://global/content/bindings/general.xml#statusbar chrome://global/content/bindings/general.xml#statusbarpanel chrome://global/content/bindings/menu.xml#menuitem chrome://global/content/bindings/menu.xml#menuseparator chrome://global/content/bindings/toolbar.xml#toolbardecoration chrome://global/content/bindings/general.xml#statusbarpanel-iconic chrome://global/content/bindings/menu.xml#menu chrome://global/content/bindings/menu.xml#menuitem-iconic resource://gre-resources/loading-image.png resource://gre-resources/broken-image.png resource://gre-resources/loading-image.png resource://gre-resources/broken-image.png chrome://global/content/bindings/autocomplete.xml#autocomplete-richlistbox chrome://global/content/bindings/richlistbox.xml chrome://global/content/bindings/listbox.xml#listbox-base chrome://global/content/bindings/richlistbox.xml#richlistbox chrome://global/content/bindings/richlistbox.xml chrome://global/content/bindings/listbox.xml#listitem chrome://global/content/bindings/richlistbox.xml#richlistitem chrome://global/skin/richlistbox.css chrome://global/content/bindings/listbox.xml chrome://global/content/bindings/listbox.xml#listcell chrome://global/content/bindings/listbox.xml#listcell-checkbox chrome://global/content/bindings/listbox.xml#listhead chrome://global/content/bindings/general.xml#basecontrol chrome://global/content/bindings/listbox.xml#listcell chrome://global/content/bindings/listbox.xml#listbox-base chrome://global/content/bindings/listbox.xml#listbox chrome://global/content/bindings/listbox.xml#listitem chrome://global/content/bindings/listbox.xml#listitem-checkbox chrome://global/content/bindings/listbox.xml#listrows chrome://global/content/bindings/listbox.xml#listcell-checkbox chrome://global/content/bindings/listbox.xml#listcell-checkbox-iconic chrome://global/content/bindings/listbox.xml#listcell chrome://global/content/bindings/listbox.xml#listcell-iconic chrome://global/content/bindings/general.xml#basetext chrome://global/content/bindings/listbox.xml#listitem chrome://global/content/bindings/general.xml#basecontrol chrome://global/content/bindings/listbox.xml#listbox-base chrome://global/content/bindings/listbox.xml chrome://global/content/bindings/listbox.xml#listitem chrome://global/content/bindings/listbox.xml#listitem-iconic chrome://global/content/bindings/listbox.xml#listitem-checkbox chrome://global/content/bindings/listbox.xml#listitem-checkbox-iconic chrome://global/content/bindings/listbox.xml#listheader chrome://global/content/bindings/autocomplete.xml#autocomplete-richlistitem chrome://global/skin/listbox.css chrome://global/content/bindings/text.xml#text-base chrome://global/content/bindings/dialog.xml#dialog chrome://global/content/bindings/dialog.xml chrome://global/content/bindings/dialog.xml#dialogheader chrome://global/content/bindings/general.xml#root-element chrome://global/content/bindings/dialog.xml#dialog chrome://global/content/bindings/dialog.xml chrome://global/skin/dialog.css chrome://global/content/bindings/button.xml#button chrome://global/content/bindings/textbox.xml#textbox chrome://global/content/bindings/text.xml#label-control chrome://global/content/bindings/checkbox.xml#checkbox chrome://global/content/bindings/checkbox.xml chrome://global/content/bindings/checkbox.xml#checkbox chrome://global/content/bindings/checkbox.xml#checkbox-with-spacing chrome://global/content/bindings/general.xml#basetext chrome://global/content/bindings/checkbox.xml#checkbox-baseline chrome://global/content/bindings/checkbox.xml#checkbox-baseline chrome://global/content/bindings/checkbox.xml#checkbox chrome://global/content/bindings/checkbox.xml chrome://global/skin/checkbox.css chrome://global/skin/checkbox/cbox-check.gif nsStringStats => mAllocCount: 44133 => mReallocCount: 3301 => mFreeCount: 40810 -- LEAKED 3323 !!! => mShareCount: 58749 => mAdoptCount: 3352 => mAdoptFreeCount: 3350 -- LEAKED 2 !!!
(In reply to Paul Silaghi [QA] from comment #24) > Assertion failed at > e:/builds/moz2_slave/m-beta-w32-dbg/build/gfx/cairo/cairo/sr > c/cairo-hash.c:196: hash_table->live_entries == 0 This is the relevant part. This is either bug 460658 or bug 706883 and is not related to this bug. > Leaked URLs: This stuff is so long that it pollutes the bug and make it hard to read. If you need to include information like this put it in a file and attach it rather than putting it in a comment.
Sorry for too long log. Based on comment 25, marking the bug as verified fixed. No assertion dialog box displayed on 2012-02-28-mozilla-beta-debug build on Win 7/64, Ubuntu 11.10 and Mac OS X 10.7.3
status-firefox11: fixed → verified
Whiteboard: [qa+] → [qa+][qa!:11]
The assertion in comment 24 and comment 25 is not related to this bug. The message would be "Assertion failure: PZ_InMonitor((ss)->firstHandshakeLock) || !ssl_HaveRecvBufLock(ss)".
No assertion dialog box displayed on 2012-03-23-mozilla-beta-debug build on Win 7/64, Ubuntu 11.10 and Mac OS X 10.6.8. Verified fixed on FF 12.
Status: RESOLVED → VERIFIED
status-firefox12: fixed → verified
Whiteboard: [qa+][qa!:11] → [qa!]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: