I dropped in newly built NSS 3.4 binaries into a web server 6 debug build. The server would not come up. The stack is : current thread: t@1 [1] _mutex_adaptive_lock(0xfe8d9944, 0x66666400, 0x4c00, 0x1, 0x4d58, 0xfffeffff), at 0xfe8aad80 [2] pthread_mutex_lock(0x76188, 0x1, 0x76188, 0x4, 0x0, 0x231ded), at 0xfe8ab774 =>[3] PR_Lock(lock = 0x76188), line 183 in "ptsynch.c" threads [4] nssListIterator_Start(iter = 0x89288), line 338 in "list.c" [5] nssTrust_GetCERTCertTrustForCert(c = 0x2317d8, cc = 0x238c80), line 395 in "pki3hack.c" [6] fill_CERTCertificateFields(c = 0x2317d8, cc = 0x238c80), line 471 in "pki3hack.c" [7] STAN_GetCERTCertificate(c = 0x2317d8), line 494 in "pki3hack.c" [8] convert_cert(c = 0x2317d8, arg = 0xffbedb6c), line 86 in "pk11cert.c" [9] retrieve_cert(t = 0x88f10, session = 0x88f40, h = 18U, arg = 0xffbedadc), line 519 in "devobject.c" [10] traverse_objects_by_template(tok = 0x88f10, sessionOpt = (nil), obj_template = 0xffbeda64, otsize = 1U, callback = 0xfe616b90 = &`libnss3.so`devobject.c`retrieve_cert(struct NSSTokenStr *t, struct nssSessionStr *session, CK_OBJECT_HANDLE h, void *arg), arg = 0xffbedadc), line 252 in "devobject.c" [11] nssToken_TraverseCertificates(token = 0x88f10, sessionOpt = (nil), search = 0xffbedadc), line 543 in "devobject.c" [12] NSSTrustDomain_TraverseCertificates(td = 0x88eb0, callback = 0xfe5a0228 = &`libnss3.so`pk11cert.c`convert_cert(struct NSSCertificateStr *c, void *arg), arg = 0xffbedb6c), line 905 in "trustdomain.c" [13] PK11_ListCerts(type = PK11CertListUser, pwarg = (nil)), line 2982 in "pk11cert.c" [14] SSLSocketConfiguration::FindServerCertFromNickname(this = 0x2313a0, name = 0x2315c8 "Server-Cert"), line 194 in "sslconf.cpp" [15] SSLSocketConfiguration::set_cert_and_key(this = 0x2313a0), line 234 in "sslconf.cpp" [16] SSLSocketConfiguration::validate(this = 0x2313a0, ignore = 0x230498 "SSLPARAMS"), line 588 in "sslconf.cpp" [17] ConfigurationObject::endElement(this = 0x2313a0, name = 0x230498 "SSLPARAMS"), line 993 in "configuration.cpp" [18] ConfigurationObject::endElement(this = 0x230a98, name = 0x230498 "SSLPARAMS"), line 990 in "configuration.cpp" [19] ConfigurationObject::endElement(this = 0x2300a0, name = 0x230498 "SSLPARAMS"), line 990 in "configuration.cpp" [20] ConfigurationObject::endElement(this = 0x22f570, name = 0x230498 "SSLPARAMS"), line 990 in "configuration.cpp" [21] ConfigurationObject::endElement(this = 0x1fcd30, name = 0x230498 "SSLPARAMS"), line 990 in "configuration.cpp" [22] Configuration::endElement(this = 0x1fcd20, name = 0x22eed0 "SSLPARAMS"), line 668 in "configuration.cpp" [23] SAXParser::startElement(this = 0xffbeea2c, elemDecl = CLASS, elemURLId = 0, elemPrefix = (nil), attrList = CLASS, attrCount = 8U, isEmpty = 1, isRoot = 0), line 709 in "SAXParser.cpp"

taking bug, it's a problem in the active token list

Have a fix checked in, but I'm leaving this bug open while I think of better solutions. Go ahead and try what's in now, though.

Ian, Your fix does work - the server comes up.

Marking fixed then.