Assertion failure: PZ_InMonitor((ss)->firstHandshakeLock) || !ssl_HaveRecvBufLock(ss)

VERIFIED FIXED in Firefox 11

Status

()

Core
Security: PSM
VERIFIED FIXED
6 years ago
6 years ago

People

(Reporter: bc, Assigned: briansmith)

Tracking

(Blocks: 1 bug, {assertion})

11 Branch
mozilla13
x86
All
assertion
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox9 unaffected, firefox10 unaffected, firefox11+ verified, firefox12+ verified)

Details

(Whiteboard: [qa!], URL)

Attachments

(3 attachments, 1 obsolete attachment)

(Reporter)

Description

6 years ago
Created attachment 587077 [details]
crash report windows 7

1. visit url with debug build of Firefox Nightly/12 or Aurora/11 on Linux, Mac, Windows. The url contains confidential information. I need guidance on how to share.

2. Assertion failure: PZ_InMonitor((ss)->firstHandshakeLock) || !ssl_HaveRecvBufLock(ss), at sslsock.c:779

security sensitive because I do not undertand the implications of this.

Windows 7 and Linux have similar stacks. See crash report. The Mac crash has a very strange unrelated stack.

Mac OS X 10.5q
Assertion failure: PZ_InMonitor((ss)->firstHandshakeLock) || !ssl_HaveRecvBufLock(ss), at sslsock.c:779

Program received signal SIGABRT, Aborted.
0x9276c9a1 in CUIRenderer::DrawWindowFrameDark ()
(gdb) bt  
#0  0x9276c9a1 in CUIRenderer::DrawWindowFrameDark ()
#1  0x9278119e in CUIRenderer::Draw ()
#2  0x06a78f3b in nsNativeThemeCocoa::DrawUnifiedToolbar (this=0x1f2863a0, cgContext=0x22e63a60, inBoxRect=@0xbfff926c, aWindow=0x1b66f9c0) at /work/mozilla/builds/nightly/mozilla/widget/cocoa/nsNativeThemeCocoa.mm:1720
#3  0x06a7e38e in nsNativeThemeCocoa::DrawWidgetBackground (this=0x1f2863a0, aContext=0x23c4e080, aFrame=0xd49670, aWidgetType=12 '\f', aRect=@0xbfff9730, aDirtyRect=@0xbfff95e0) at /work/mozilla/builds/nightly/mozilla/widget/cocoa/nsNativeThemeCocoa.mm:1980
#4  0x058bd9b0 in nsCSSRendering::PaintBackgroundWithSC (aPresContext=0xb19000, aRenderingContext=@0x23c4e080, aForFrame=0xd49670, aDirtyRect=@0xebaa7c, aBorderArea=@0xbfff9730, aBackgroundSC=0xd2c298, aBorder=@0xe1b520, aFlags=4, aBGClipRect=0x0) at /work/mozilla/builds/nightly/mozilla/layout/base/nsCSSRendering.cpp:2312
#5  0x058be17f in nsCSSRendering::PaintBackground (aPresContext=0xb19000, aRenderingContext=@0x23c4e080, aForFrame=0xd49670, aDirtyRect=@0xebaa7c, aBorderArea=@0xbfff9730, aFlags=4, aBGClipRect=0x0) at /work/mozilla/builds/nightly/mozilla/layout/base/nsCSSRendering.cpp:1485
(Reporter)

Comment 1

6 years ago
Created attachment 587082 [details]
crash report windows 7
Attachment #587077 - Attachment is obsolete: true
(Reporter)

Comment 2

6 years ago
https://www.dskdirect.bg/page/default.aspx works fine without any identifying information.
Thanks for the bug report! This is caused by my patch to bug 674147. SSL_GetOption cannot be called from within a SSL callback function, but that is exactly what we are doing (indirectly, though rememberTolerantSite).
Assignee: nobody → nobody
Blocks: 674147
Component: Libraries → Security: PSM
Product: NSS → Core
QA Contact: libraries → psm
Target Milestone: --- → mozilla11
Version: 3.13.2 → 11 Branch
Group: core-security
status-firefox10: --- → unaffected
status-firefox11: --- → affected
status-firefox12: --- → affected
status-firefox9: --- → unaffected
tracking-firefox11: --- → ?
tracking-firefox12: --- → ?
I have found another instance of this, where we call SetCertVerificationResult in SSLServerCertVerifiationJob::Dispatch().
Assignee: nobody → bsmith
Created attachment 590536 [details] [diff] [review]
Part 1: Fix TLS toleraance lock reentrence bug
Attachment #590536 - Flags: review?(honzab.moz)
Created attachment 590537 [details] [diff] [review]
Part 2: Fix cert authentication lock reentrence bug
Attachment #590537 - Flags: review?(honzab.moz)
Brian, this is not the first time I see this.  Please, add to bugs you both analyze and create patches for some notes about what was the cause of the bug, for the record.  The patch sometimes might not be enough to explain, and actually it makes reviewing harder.  Thanks.
Comment on attachment 590537 [details] [diff] [review]
Part 2: Fix cert authentication lock reentrence bug

Review of attachment 590537 [details] [diff] [review]:
-----------------------------------------------------------------

r=honzab, but see the comments

::: security/manager/ssl/src/SSLServerCertVerification.cpp
@@ -603,5 @@
>    if (!socketInfo || !serverCert) {
>      NS_ERROR("Invalid parameters for SSL server cert validation");
> -    socketInfo->SetCertVerificationResult(PR_INVALID_STATE_ERROR,
> -                                          PlainErrorMessage);
> -    PR_SetError(PR_INVALID_STATE_ERROR, 0);

This one removed is OK, and so obvious...

@@ -621,5 @@
>    if (NS_FAILED(nrv)) {
>      PRErrorCode error = nrv == NS_ERROR_OUT_OF_MEMORY
>                        ? SEC_ERROR_NO_MEMORY
>                        : PR_INVALID_STATE_ERROR;
> -    socketInfo->SetCertVerificationResult(error, PlainErrorMessage);

But this one may bring the socket's state variable mCertVerificationState to an inconsistent state since you have called SetCertVerificationWaiting() on the socket...

Since this is called only on the socket thread, and the result that informs and wakes the socket is a post to this thread too, you may freely call SetCertVerificationWaiting() after a successful dispatch.

If you agree, then please add that comment explaining why that is OK.
Attachment #590537 - Flags: review?(honzab.moz) → review+
Comment on attachment 590536 [details] [diff] [review]
Part 1: Fix TLS toleraance lock reentrence bug

Review of attachment 590536 [details] [diff] [review]:
-----------------------------------------------------------------

r=honzab
Attachment #590536 - Flags: review?(honzab.moz) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/90fbcfc9bfdc
https://hg.mozilla.org/integration/mozilla-inbound/rev/2a702d94a24c

> But this one may bring the socket's state variable mCertVerificationState to
> an inconsistent state since you have called SetCertVerificationWaiting() on
> the socket...
> 
> Since this is called only on the socket thread, and the result that informs
> and wakes the socket is a post to this thread too, you may freely call
> SetCertVerificationWaiting() after a successful dispatch.
> 
> If you agree, then please add that comment explaining why that is OK.

Hmm...I misunderstood your comment and I already pushed the patch to inbound based on that misunderstanding. Now I understand that you are saying that you are saying we should call SetCertVerificationWaiting after the Dispatch, instead of before the Dispatch, and that it is safe to do so. Instead, because I misunderstood you, I added a comment explaining why the patch is correct--it doesn't matter if mCertVerificationState is inconsistent, because we already have to handle non-cert errors that might occur in that state (e.g. TLS intolerance, other errors that libssl returns, etc.). mCertVerificationState only needs to be consistent up to the point of the first error; once an error occurs, its value no longer matters.
Whiteboard: [inbound]
(In reply to Brian Smith (:bsmith) from comment #10)
> Hmm...I misunderstood your comment and I already pushed the patch to inbound
> based on that misunderstanding. Now I understand that you are saying that
> you are saying we should call SetCertVerificationWaiting after the Dispatch,
> instead of before the Dispatch, and that it is safe to do so. Instead,
> because I misunderstood you, I added a comment explaining why the patch is
> correct--it doesn't matter if mCertVerificationState is inconsistent,
> because we already have to handle non-cert errors that might occur in that
> state (e.g. TLS intolerance, other errors that libssl returns, etc.).
> mCertVerificationState only needs to be consistent up to the point of the
> first error; once an error occurs, its value no longer matters.

Hmm.. :) Or I might really need to improve my English.  It is OK to do this in a small followup.  This may potentially fail as Dispatch is responsible for creating the actual thread here but it is not critical.

Updated

6 years ago
Target Milestone: mozilla11 → mozilla13
Target Milestone: mozilla13 → mozilla11
(This landed on mozilla13, so changing target milestone back to reflect the milestone of initial landing, since this is the convention typically used for this field. When this is backported, the status-firefox12/status-firefox11 flags can be set to fixed.)

https://hg.mozilla.org/mozilla-central/rev/90fbcfc9bfdc
https://hg.mozilla.org/mozilla-central/rev/2a702d94a24c
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: mozilla11 → mozilla13
Tracking for Firefox 11 and 12 given possible web incompatibilities. Please nominate with a risk/benefit evaluation as soon as possible.
tracking-firefox11: ? → +
tracking-firefox12: ? → +
(In reply to Honza Bambas (:mayhemer) from comment #11)
> Hmm.. :) Or I might really need to improve my English.  It is OK to do this
> in a small followup.  This may potentially fail as Dispatch is responsible
> for creating the actual thread here but it is not critical.

Honza, I don't quite get it. What could go wrong?
(In reply to Brian Smith (:bsmith) from comment #14)
> (In reply to Honza Bambas (:mayhemer) from comment #11)
> > Hmm.. :) Or I might really need to improve my English.  It is OK to do this
> > in a small followup.  This may potentially fail as Dispatch is responsible
> > for creating the actual thread here but it is not critical.
> 
> Honza, I don't quite get it. What could go wrong?

nsThreadPool::Dispatch() is a method that creates the actual thread to dispatch the given event to if there is no thread in an idle state to take it (and we are no at the thread number limit ; nsThreadPool it self, when created, doesn't do anything).

So, there are things that can fail.  There is more then 0 chance Dispatch can fail.
https://hg.mozilla.org/releases/mozilla-aurora/rev/51acf7d3322c
https://hg.mozilla.org/releases/mozilla-aurora/rev/9748196d1c17

https://hg.mozilla.org/releases/mozilla-beta/rev/21169b2a8934
https://hg.mozilla.org/releases/mozilla-beta/rev/6e6457092954
status-firefox11: affected → fixed
status-firefox12: affected → fixed
Whiteboard: [inbound]
Whiteboard: [qa+]
(In reply to Honza Bambas (:mayhemer) from comment #15)
> nsThreadPool::Dispatch() is a method that creates the actual thread to
> dispatch the given event to if there is no thread in an idle state to take
> it (and we are no at the thread number limit ; nsThreadPool it self, when
> created, doesn't do anything).
> 
> So, there are things that can fail.  There is more then 0 chance Dispatch
> can fail.

When nsThreadPool::Dispatch fails, we handle that case in the NS_FAILED(nrv) branch, calling PR_SetError() and returning SECFailure from SSLServerCertVerificationJob::Dispatch.

The caller of SSLServerCertVerificationJob::Dispatch is AuthCertificateHook. It immediately returns the value of SSLServerCertVerificationJob::Dispatch:

    SECStatus rv = SSLServerCertVerificationJob::Dispatch(
                        static_cast<const void *>(fd), socketInfo, serverCert);
    return rv;

So, in this case, AuthCertificateHook will return SECFailure with the error code set correctly. This will cause libssl to see that certificate validation failed *synchronously*.
(In reply to Brian Smith (:bsmith) from comment #17)
> When nsThreadPool::Dispatch fails, .... cause libssl to see that certificate
> validation failed *synchronously*.

Yes.  But in case of Dispatch() failure you are leaving the state of socketInfo as set by SetCertVerificationWaiting();  You have to call SetCertVerificationResult(some-error-code) in that case or call SetCertVerificationWaiting() only after a successful dispatch.  You can do that, it is thread safe.
(In reply to Honza Bambas (:mayhemer) from comment #18)
> (In reply to Brian Smith (:bsmith) from comment #17)
> Yes.  But in case of Dispatch() failure you are leaving the state of
> socketInfo as set by SetCertVerificationWaiting();

When we return SECFailure, the SSL send() or recv() method will return -1, and then we will call checkHandshake, which will (eventually, indirectly) call SetCanceled to set the error code on the socket. The socket will still be in the "waiting" state, but that doesn't cause any problems, AFAICT.
Could you please tell me how to test this fix ?
You will only notice it on debug builds. When you run a debug build from before the fix, you should get an assertion dialog box when you visit a HTTPS page like the one in the URL field of this bug. When you run a debug build from after the fix, there will be no assertion.
I've tested this on ftp://ftp.mozilla.org/pub/firefox/nightly/2012/02/2012-02-28-mozilla-beta-debug/ on Win 7/64.
I don't see any assertion dialog, but Firefox still crashes, sometimes right after loading https://www.dskdirect.bg/page/default.aspx or when closing FF with the link opened.

https://crash-stats.mozilla.com/report/index/bp-9af1d403-0860-457b-8af9-43bf32120229
(Reporter)

Comment 23

6 years ago
I can't reproduce a crash either in automation with Beta/11, Aurora/12, Nightly/13 debug builds on Windows XP, Windows 7, Fedora 16 32 or 64 bit, or Mac OS X 10.6 or locally with local builds nor with the beta debug build from 2012-02-28 on win7 64bit.

Paul, the crash reports for debug builds do not contain symbols so they aren't very helpful. The best way to test this is to start firefox from the command line and to set the following environment variables first

set MOZ_NO_REMOTE=1
set NO_EM_RESTART=1
set XPCOM_DEBUG_BREAK=warn
set MOZ_CRASHREPORTER_NO_REPORT=1
set MOZ_CRASHREPORTER_DISABLE=1
set MOZ_GDB_SLEEP=1

then start firefox and load the url. If an abort or fatal assertion occurs you will see a message in the console like

Assertion failure: PZ_InMonitor((ss)->firstHandshakeLock) || !ssl_HaveRecvBufLock(ss), at ...

If you can reproduce your crash, please tell us what debug abort or assertion is displayed.
Assertion failed at e:/builds/moz2_slave/m-beta-w32-dbg/build/gfx/cairo/cairo/sr
c/cairo-hash.c:196: hash_table->live_entries == 0
Leaked URLs:
  resource://gre-resources/ua.css
  resource://gre-resources/html.css
  chrome://global/content/xul.css
  resource://gre-resources/quirk.css
  resource://gre-resources/full-screen-override.css
  chrome://global/skin/scrollbars.css
  resource://gre-resources/forms.css
  chrome://global/content/bindings/scrollbar.xml#scrollbar
  chrome://global/content/bindings/scrollbar.xml
  chrome://global/content/bindings/scrollbar.xml#scrollbar-base
  chrome://global/content/bindings/scrollbar.xml#scrollbar
  chrome://global/content/bindings/scrollbar.xml#thumb
  chrome://global/content/bindings/scrollbar.xml
  chrome://global/content/bindings/scrollbar.xml#scrollbar-base
  chrome://global/skin/scrollbar/slider.gif
  chrome://global/skin/arrow/arrow-lft.gif
  chrome://global/content/bindings/scrollbar.xml#thumb
  chrome://global/skin/arrow/arrow-rit.gif
  chrome://global/skin/arrow/arrow-up.gif
  chrome://global/skin/arrow/arrow-dn.gif
  chrome://global/content/bindings/resizer.xml#resizer
  chrome://global/content/bindings/resizer.xml
  chrome://global/content/bindings/resizer.xml#resizer
  chrome://global/content/bindings/resizer.xml
  chrome://global/skin/resizer.css
  chrome://global/skin/icons/resizer.png
  chrome://global/content/bindings/scrollbar.xml#scrollbar-base
  chrome://global/skin/arrow/arrow-rit-dis.gif
  chrome://global/skin/arrow/arrow-lft-dis.gif
  chrome://global/skin/arrow/arrow-dn-dis.gif
  chrome://global/skin/arrow/arrow-up-dis.gif
  chrome://global/content/bindings/general.xml#root-element
  chrome://global/content/bindings/general.xml
  chrome://global/content/bindings/general.xml#statusbar
  chrome://global/content/bindings/general.xml#iframe
  chrome://global/content/bindings/general.xml#statusbar
  chrome://global/content/bindings/general.xml#statusbar-drag
  chrome://global/content/bindings/general.xml#dropmarker
  chrome://global/content/bindings/general.xml#statusbarpanel
  chrome://global/content/bindings/general.xml#statusbarpanel-iconic
  chrome://global/content/bindings/general.xml#basecontrol
  chrome://global/content/bindings/general.xml#basetext
  chrome://global/content/bindings/general.xml#basecontrol
  chrome://global/content/bindings/general.xml
  chrome://global/content/bindings/general.xml#statusbarpanel
  chrome://global/content/bindings/general.xml#statusbarpanel-iconic-text
  chrome://global/content/bindings/general.xml#basetext
  chrome://global/content/bindings/general.xml#control-item
  chrome://global/content/bindings/general.xml#windowdragbox
  chrome://global/content/bindings/general.xml#root-element
  chrome://global/content/bindings/general.xml#deck
  chrome://global/content/bindings/general.xml#statusbarpanel
  chrome://global/content/bindings/general.xml#statusbarpanel
  chrome://global/content/bindings/general.xml#statusbarpanel-menu-iconic
  chrome://global/content/bindings/general.xml#image
  chrome://global/content/bindings/popup.xml#tooltip
  chrome://global/content/bindings/popup.xml
  chrome://global/content/bindings/popup.xml#panel
  chrome://global/content/bindings/popup.xml#arrowpanel
  chrome://global/content/bindings/popup.xml#popup-base
  chrome://global/content/bindings/popup.xml#popup
  chrome://global/content/bindings/popup.xml#popup-base
  chrome://global/content/bindings/popup.xml#panel
  chrome://global/content/bindings/popup.xml#popup-base
  chrome://global/content/bindings/popup.xml
  chrome://global/content/bindings/popup.xml#popup-base
  chrome://global/content/bindings/popup.xml#tooltip
  chrome://global/content/bindings/popup.xml#popup
  chrome://global/content/bindings/popup.xml#popup-scrollbars
  chrome://global/skin/popup.css
  chrome://global/content/bindings/stringbundle.xml#stringbundleset
  chrome://global/content/bindings/stringbundle.xml
  chrome://global/content/bindings/stringbundle.xml#stringbundleset
  chrome://global/content/bindings/stringbundle.xml
  chrome://global/content/bindings/stringbundle.xml#stringbundle
  chrome://global/content/bindings/general.xml#deck
  chrome://global/content/bindings/stringbundle.xml#stringbundle
  chrome://global/content/bindings/popup.xml#popup
  chrome://browser/content/urlbarBindings.xml
  chrome://browser/content/urlbarBindings.xml#promobox
  chrome://global/content/bindings/autocomplete.xml#autocomplete
  chrome://browser/content/urlbarBindings.xml#urlbar
  chrome://browser/content/urlbarBindings.xml
  chrome://global/content/bindings/menu.xml#menuitem
  chrome://browser/content/urlbarBindings.xml#menuitem-tooltip
  chrome://global/content/bindings/notification.xml#popup-notification
  chrome://browser/content/urlbarBindings.xml#addon-progress-notification
  chrome://global/content/bindings/notification.xml#popup-notification
  chrome://browser/content/urlbarBindings.xml#geolocation-notification
  chrome://global/content/bindings/autocomplete.xml#autocomplete-rich-result-pop
up
  chrome://browser/content/urlbarBindings.xml#urlbar-rich-result-popup
  chrome://global/content/bindings/menu.xml#menuitem-iconic
  chrome://browser/content/urlbarBindings.xml#menuitem-iconic-tooltip
  chrome://browser/content/urlbarBindings.xml#splitmenu
  chrome://global/content/bindings/autocomplete.xml#autocomplete-result-popup
  chrome://browser/content/urlbarBindings.xml#browser-autocomplete-result-popup
  chrome://global/content/bindings/autocomplete.xml
  chrome://global/content/bindings/richlistbox.xml#richlistbox
  chrome://global/content/bindings/autocomplete.xml#autocomplete-richlistbox
  chrome://global/content/bindings/general.xml#dropmarker
  chrome://global/content/bindings/autocomplete.xml#history-dropmarker
  chrome://global/content/bindings/popup.xml#popup
  chrome://global/content/bindings/autocomplete.xml#autocomplete-base-popup
  chrome://global/content/bindings/textbox.xml#textbox
  chrome://global/content/bindings/autocomplete.xml#autocomplete
  chrome://global/content/bindings/autocomplete.xml
  chrome://global/content/bindings/richlistbox.xml#richlistitem
  chrome://global/content/bindings/autocomplete.xml#autocomplete-richlistitem
  chrome://global/content/bindings/tree.xml#tree
  chrome://global/content/bindings/autocomplete.xml#autocomplete-tree
  chrome://global/content/bindings/autocomplete.xml#autocomplete-base-popup
  chrome://global/content/bindings/autocomplete.xml#autocomplete-rich-result-pop
up
  chrome://global/content/bindings/autocomplete.xml#autocomplete-base-popup
  chrome://global/content/bindings/autocomplete.xml#autocomplete-result-popup
  chrome://global/content/bindings/autocomplete.xml#autocomplete-treebody
  chrome://global/content/bindings/autocomplete.xml#autocomplete-treerows
  chrome://global/skin/tree.css
  chrome://global/skin/autocomplete.css
  chrome://global/content/bindings/popup.xml#arrowpanel
  chrome://global/content/bindings/popup.xml#panel
  chrome://global/content/bindings/button.xml#menu
  chrome://global/content/bindings/button.xml
  chrome://global/content/bindings/button.xml#menu-button-base
  chrome://global/content/bindings/button.xml#menu-button
  chrome://global/content/bindings/button.xml#button
  chrome://global/content/bindings/button.xml#button-image
  chrome://global/content/bindings/general.xml#basetext
  chrome://global/content/bindings/button.xml#button-base
  chrome://global/content/bindings/button.xml
  chrome://global/content/bindings/button.xml#button
  chrome://global/content/bindings/button.xml#menu
  chrome://global/content/bindings/button.xml#button-base
  chrome://global/content/bindings/button.xml#button
  chrome://global/content/bindings/button.xml#button-base
  chrome://global/content/bindings/button.xml#menu-button-base
  chrome://global/content/bindings/button.xml#button
  chrome://global/content/bindings/button.xml#button-repeat
  chrome://global/skin/button.css
  chrome://global/content/bindings/general.xml#dropmarker
  chrome://global/skin/dropmarker.css
  chrome://global/content/bindings/general.xml#image
  chrome://global/content/bindings/text.xml#text-label
  chrome://global/content/bindings/text.xml
  chrome://global/content/bindings/text.xml#text-base
  chrome://global/content/bindings/text.xml
  chrome://global/content/bindings/text.xml#text-label
  chrome://global/content/bindings/text.xml#text-link
  chrome://global/content/bindings/text.xml#text-label
  chrome://global/content/bindings/text.xml#label-control
  chrome://global/content/bindings/text.xml#text-base
  chrome://global/content/bindings/text.xml#text-label
  chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton
  chrome://global/content/bindings/toolbarbutton.xml
  chrome://global/content/bindings/button.xml#menu-button-base
  chrome://global/content/bindings/toolbarbutton.xml#menu-button
  chrome://global/content/bindings/button.xml#button-base
  chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton
  chrome://global/content/bindings/toolbarbutton.xml
  chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton
  chrome://global/content/bindings/toolbarbutton.xml#menu-vertical
  chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton
  chrome://global/content/bindings/toolbarbutton.xml#menu
  chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton
  chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton-image
  chrome://global/skin/toolbarbutton.css
  chrome://global/content/bindings/toolbar.xml#toolbox
  chrome://global/content/bindings/toolbar.xml
  chrome://global/content/bindings/toolbar.xml#toolbar
  chrome://global/content/bindings/toolbar.xml#toolbar-drag
  chrome://global/content/bindings/toolbar.xml#toolbar-base
  chrome://global/content/bindings/toolbar.xml#menubar
  chrome://global/content/bindings/toolbar.xml#toolbar-base
  chrome://global/content/bindings/toolbar.xml#toolbar
  chrome://global/content/bindings/toolbar.xml#toolbar-base
  chrome://global/content/bindings/toolbar.xml
  chrome://global/content/bindings/toolbar.xml#toolbar
  chrome://global/content/bindings/toolbar.xml#toolbar-menubar-autohide
  chrome://global/content/bindings/toolbar.xml#toolbar-base
  chrome://global/content/bindings/toolbar.xml#toolbardecoration
  chrome://global/content/bindings/toolbar.xml#toolbarpaletteitem
  chrome://global/content/bindings/toolbar.xml#toolbarpaletteitem-palette
  chrome://global/content/bindings/toolbar.xml#toolbar-base
  chrome://global/content/bindings/toolbar.xml#toolbarpaletteitem
  chrome://global/content/bindings/toolbar.xml#toolbar-base
  chrome://global/content/bindings/toolbar.xml#toolbox
  chrome://global/skin/toolbar.css
  chrome://global/content/bindings/toolbar.xml#toolbar-menubar-autohide
  chrome://global/content/bindings/toolbar.xml#toolbar
  chrome://global/content/bindings/toolbar.xml#menubar
  chrome://global/content/bindings/menu.xml#menu-menubar
  chrome://global/content/bindings/menu.xml
  chrome://global/content/bindings/menu.xml#menuitem-base
  chrome://global/content/bindings/menu.xml#menuseparator
  chrome://global/content/bindings/menu.xml#menuitem-base
  chrome://global/content/bindings/menu.xml#menu-base
  chrome://global/content/bindings/menu.xml#menuitem-base
  chrome://global/content/bindings/menu.xml#menubutton-item
  chrome://global/content/bindings/general.xml#control-item
  chrome://global/content/bindings/menu.xml#menuitem-base
  chrome://global/content/bindings/menu.xml
  chrome://global/content/bindings/menu.xml#menu-base
  chrome://global/content/bindings/menu.xml#menu-iconic
  chrome://global/content/bindings/menu.xml#menu-base
  chrome://global/content/bindings/menu.xml#menu-menubar-iconic
  chrome://global/content/bindings/menu.xml#menuitem
  chrome://global/content/bindings/menu.xml#menuitem-iconic
  chrome://global/content/bindings/menu.xml#menuitem-base
  chrome://global/content/bindings/menu.xml#menuitem
  chrome://global/content/bindings/menu.xml#menu-base
  chrome://global/content/bindings/menu.xml#menu
  chrome://global/content/bindings/menu.xml#menu-base
  chrome://global/content/bindings/menu.xml#menu-menubar
  chrome://global/content/bindings/menu.xml#menuitem
  chrome://global/content/bindings/menu.xml#menuitem-iconic-desc-noaccel
  chrome://global/content/bindings/menu.xml#menuitem
  chrome://global/content/bindings/menu.xml#menuitem-iconic-noaccel
  chrome://global/skin/menu.css
  chrome://browser/content/places/menu.xml
  chrome://global/content/bindings/popup.xml#popup
  chrome://browser/content/places/menu.xml#places-popup-base
  chrome://browser/content/places/menu.xml
  chrome://global/content/bindings/textbox.xml
  chrome://global/content/bindings/textbox.xml#textbox
  chrome://global/content/bindings/textbox.xml#timed-textbox
  chrome://global/content/bindings/textbox.xml#input-box
  chrome://global/content/bindings/textbox.xml#input-box-spell
  chrome://global/content/bindings/textbox.xml#textbox
  chrome://global/content/bindings/textbox.xml
  chrome://global/content/bindings/textbox.xml#textbox
  chrome://global/content/bindings/textbox.xml#textarea
  chrome://global/content/bindings/textbox.xml#textbox
  chrome://global/content/bindings/textbox.xml#search-textbox
  chrome://global/content/bindings/textbox.xml#input-box
  chrome://global/content/textbox.css
  chrome://global/skin/textbox.css
  chrome://global/content/bindings/autocomplete.xml#history-dropmarker
  chrome://global/content/bindings/textbox.xml#input-box
  chrome://global/content/platformHTMLBindings.xml#inputFields
  chrome://global/content/platformHTMLBindings.xml
  chrome://global/content/platformHTMLBindings.xml#inputFields
  chrome://global/content/platformHTMLBindings.xml
  chrome://global/content/platformHTMLBindings.xml#browser
  chrome://global/content/platformHTMLBindings.xml#editor
  chrome://global/content/platformHTMLBindings.xml#textAreas
  chrome://browser/content/search/search.xml
  chrome://browser/content/search/search.xml#searchbar
  chrome://browser/content/search/search.xml
  chrome://global/content/bindings/autocomplete.xml#autocomplete
  chrome://browser/content/search/search.xml#searchbar-textbox
  chrome://browser/content/search/searchbarBindings.css
  chrome://browser/skin/searchbar.css
  chrome://browser/content/search/search.xml#searchbar-textbox
  chrome://global/skin/icons/folder-item.png
  chrome://browser/skin/mainwindow-dropdown-arrow.png
  chrome://global/skin/icons/Search-glass.png
  chrome://global/content/bindings/toolbarbutton.xml#menu
  chrome://global/skin/arrow/arrow-dn.gif
  chrome://global/content/bindings/scrollbox.xml#scrollbox
  chrome://global/content/bindings/scrollbox.xml
  chrome://global/content/bindings/general.xml#basecontrol
  chrome://global/content/bindings/scrollbox.xml#scrollbox-base
  chrome://global/content/bindings/scrollbox.xml
  chrome://global/content/bindings/scrollbox.xml#scrollbox-base
  chrome://global/content/bindings/scrollbox.xml#arrowscrollbox
  chrome://global/content/bindings/scrollbox.xml#scrollbox-base
  chrome://global/content/bindings/scrollbox.xml#scrollbox
  chrome://global/content/bindings/scrollbox.xml#scrollbox-base
  chrome://global/content/bindings/scrollbox.xml#autorepeatbutton
  chrome://global/content/bindings/scrollbox.xml#arrowscrollbox
  chrome://global/content/bindings/scrollbox.xml#arrowscrollbox-clicktoscroll
  chrome://global/skin/scrollbox.css
  chrome://browser/content/tabbrowser.xml
  chrome://global/content/bindings/tabbox.xml#tabbox
  chrome://browser/content/tabbrowser.xml#tabbrowser-tabbox
  chrome://browser/content/tabbrowser.xml#statuspanel
  chrome://global/content/bindings/scrollbox.xml#arrowscrollbox-clicktoscroll
  chrome://browser/content/tabbrowser.xml#tabbrowser-arrowscrollbox
  chrome://global/content/bindings/tabbox.xml#tabs
  chrome://browser/content/tabbrowser.xml#tabbrowser-tabs
  chrome://browser/content/tabbrowser.xml#tabbrowser
  chrome://browser/content/tabbrowser.xml
  chrome://global/content/bindings/tabbox.xml#tab
  chrome://browser/content/tabbrowser.xml#tabbrowser-tab
  chrome://global/content/bindings/popup.xml#popup
  chrome://browser/content/tabbrowser.xml#tabbrowser-alltabs-popup
  chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton-image
  chrome://browser/content/tabbrowser.xml#tabbrowser-close-tab-button
  chrome://browser/content/tabbrowser.css
  chrome://global/content/bindings/tabbox.xml
  chrome://global/content/bindings/general.xml#basecontrol
  chrome://global/content/bindings/tabbox.xml#tabs
  chrome://global/content/bindings/general.xml#control-item
  chrome://global/content/bindings/tabbox.xml#tab
  chrome://global/content/bindings/tabbox.xml#tab-base
  chrome://global/content/bindings/tabbox.xml#tabpanels
  chrome://global/content/bindings/tabbox.xml#tab-base
  chrome://global/content/bindings/tabbox.xml
  chrome://global/content/bindings/tabbox.xml#tab-base
  chrome://global/content/bindings/tabbox.xml#tabbox
  chrome://global/skin/tabbox.css
  chrome://browser/content/tabbrowser.xml#tabbrowser-arrowscrollbox
  chrome://browser/content/tabbrowser.xml#tabbrowser-close-tab-button
  chrome://global/content/bindings/splitter.xml#splitter
  chrome://global/content/bindings/splitter.xml
  chrome://global/content/bindings/splitter.xml#splitter
  chrome://global/content/bindings/splitter.xml
  chrome://global/content/bindings/splitter.xml#grippy
  chrome://global/skin/splitter.css
  chrome://browser/content/tabbrowser.xml#tabbrowser-tabbox
  chrome://global/content/bindings/tabbox.xml#tabpanels
  chrome://global/content/bindings/notification.xml#notificationbox
  chrome://global/content/bindings/notification.xml
  chrome://global/content/bindings/notification.xml#notificationbox
  chrome://global/content/bindings/notification.xml
  chrome://global/content/bindings/notification.xml#notification
  chrome://global/content/bindings/notification.xml#popup-notification
  chrome://global/content/bindings/browser.xml#browser
  chrome://global/content/bindings/browser.xml
  chrome://global/content/bindings/browser.xml#browser
  chrome://global/content/bindings/browser.xml
  chrome://global/content/bindings/general.xml#statusbar
  chrome://global/content/bindings/general.xml#statusbarpanel
  chrome://global/content/bindings/menu.xml#menuitem
  chrome://global/content/bindings/menu.xml#menuseparator
  chrome://global/content/bindings/toolbar.xml#toolbardecoration
  chrome://global/content/bindings/general.xml#statusbarpanel-iconic
  chrome://global/content/bindings/menu.xml#menu
  chrome://global/content/bindings/menu.xml#menuitem-iconic
  resource://gre-resources/loading-image.png
  resource://gre-resources/broken-image.png
  resource://gre-resources/loading-image.png
  resource://gre-resources/broken-image.png
  chrome://global/content/bindings/autocomplete.xml#autocomplete-richlistbox
  chrome://global/content/bindings/richlistbox.xml
  chrome://global/content/bindings/listbox.xml#listbox-base
  chrome://global/content/bindings/richlistbox.xml#richlistbox
  chrome://global/content/bindings/richlistbox.xml
  chrome://global/content/bindings/listbox.xml#listitem
  chrome://global/content/bindings/richlistbox.xml#richlistitem
  chrome://global/skin/richlistbox.css
  chrome://global/content/bindings/listbox.xml
  chrome://global/content/bindings/listbox.xml#listcell
  chrome://global/content/bindings/listbox.xml#listcell-checkbox
  chrome://global/content/bindings/listbox.xml#listhead
  chrome://global/content/bindings/general.xml#basecontrol
  chrome://global/content/bindings/listbox.xml#listcell
  chrome://global/content/bindings/listbox.xml#listbox-base
  chrome://global/content/bindings/listbox.xml#listbox
  chrome://global/content/bindings/listbox.xml#listitem
  chrome://global/content/bindings/listbox.xml#listitem-checkbox
  chrome://global/content/bindings/listbox.xml#listrows
  chrome://global/content/bindings/listbox.xml#listcell-checkbox
  chrome://global/content/bindings/listbox.xml#listcell-checkbox-iconic
  chrome://global/content/bindings/listbox.xml#listcell
  chrome://global/content/bindings/listbox.xml#listcell-iconic
  chrome://global/content/bindings/general.xml#basetext
  chrome://global/content/bindings/listbox.xml#listitem
  chrome://global/content/bindings/general.xml#basecontrol
  chrome://global/content/bindings/listbox.xml#listbox-base
  chrome://global/content/bindings/listbox.xml
  chrome://global/content/bindings/listbox.xml#listitem
  chrome://global/content/bindings/listbox.xml#listitem-iconic
  chrome://global/content/bindings/listbox.xml#listitem-checkbox
  chrome://global/content/bindings/listbox.xml#listitem-checkbox-iconic
  chrome://global/content/bindings/listbox.xml#listheader
  chrome://global/content/bindings/autocomplete.xml#autocomplete-richlistitem
  chrome://global/skin/listbox.css
  chrome://global/content/bindings/text.xml#text-base
  chrome://global/content/bindings/dialog.xml#dialog
  chrome://global/content/bindings/dialog.xml
  chrome://global/content/bindings/dialog.xml#dialogheader
  chrome://global/content/bindings/general.xml#root-element
  chrome://global/content/bindings/dialog.xml#dialog
  chrome://global/content/bindings/dialog.xml
  chrome://global/skin/dialog.css
  chrome://global/content/bindings/button.xml#button
  chrome://global/content/bindings/textbox.xml#textbox
  chrome://global/content/bindings/text.xml#label-control
  chrome://global/content/bindings/checkbox.xml#checkbox
  chrome://global/content/bindings/checkbox.xml
  chrome://global/content/bindings/checkbox.xml#checkbox
  chrome://global/content/bindings/checkbox.xml#checkbox-with-spacing
  chrome://global/content/bindings/general.xml#basetext
  chrome://global/content/bindings/checkbox.xml#checkbox-baseline
  chrome://global/content/bindings/checkbox.xml#checkbox-baseline
  chrome://global/content/bindings/checkbox.xml#checkbox
  chrome://global/content/bindings/checkbox.xml
  chrome://global/skin/checkbox.css
  chrome://global/skin/checkbox/cbox-check.gif
nsStringStats
 => mAllocCount:          44133
 => mReallocCount:         3301
 => mFreeCount:           40810  --  LEAKED 3323 !!!
 => mShareCount:          58749
 => mAdoptCount:           3352
 => mAdoptFreeCount:       3350  --  LEAKED 2 !!!
(Reporter)

Comment 25

6 years ago
(In reply to Paul Silaghi [QA] from comment #24)
> Assertion failed at
> e:/builds/moz2_slave/m-beta-w32-dbg/build/gfx/cairo/cairo/sr
> c/cairo-hash.c:196: hash_table->live_entries == 0

This is the relevant part. This is either bug 460658 or bug 706883 and is not related to this bug.


> Leaked URLs:

This stuff is so long that it pollutes the bug and make it hard to read. If you need to include information like this put it in a file and attach it rather than putting it in a comment.
Sorry for too long log.
Based on comment 25, marking the bug as verified fixed.
No assertion dialog box displayed on 2012-02-28-mozilla-beta-debug build on Win 7/64, Ubuntu 11.10 and Mac OS X 10.7.3
status-firefox11: fixed → verified
Whiteboard: [qa+] → [qa+][qa!:11]
The assertion in comment 24 and comment 25 is not related to this bug. The message would be "Assertion failure: PZ_InMonitor((ss)->firstHandshakeLock) || !ssl_HaveRecvBufLock(ss)".
No assertion dialog box displayed on 2012-03-23-mozilla-beta-debug build on Win 7/64, Ubuntu 11.10 and Mac OS X 10.6.8. Verified fixed on FF 12.
Status: RESOLVED → VERIFIED
status-firefox12: fixed → verified
Whiteboard: [qa+][qa!:11] → [qa!]
You need to log in before you can comment on or make changes to this bug.