Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3a) Gecko/20021130 I have seen this bug now for 3 days. Mozilla crashes on exit if it connects to a secure newsserver (e.g. secnews.netscape.com) anytime during the session. I can reproduce this everytime. Steps to reproduce: 1) open mail 2) have mozilla connect to secnews.netscape.com - make sure the "Use secure connection box is checked in the account manager (just refreshing the newsgroup list in the subscribe box is enough to get the crash) - as far as I can tell, ANY communications with the server will cause the crash 3) close mozilla You will see that Windows says that Mozilla has encoutered a problem and must be shutdown. Talkback also starts. Error message created by Windows (these errors alternate each time the crash happens): Faulting application mozilla.exe, version 1.3.0.0, faulting module nss3.dll, version 3.6.1.0, fault address 0x00032f34. Faulting application mozilla.exe, version 1.3.0.0, faulting module ntdll.dll, version 5.1.2600.1106, fault address 0x000255e9. Talkback IDs: TB14557730E TB14557720G TB14557650E

regression between linux trunk builds 2002112512 and 2002112622 this seems to be showing up in talkback as nssCertificate_Destroy (second frame in my linux stack)

.

There were no changes made to the NSS_CLIENT_TAG on 2002-11-25. On 2002-11-26, I changed NSS_CLIENT_TAG from NSS_3_6_BETA2 to NSS_3_6_BETA3. But these NSS changes should first appear in the 20021127 daily build. Kai, are there any PSM changes in that time frame?

Andrew said something about a regression of a linux build. However, I'm on Windows so I'm not sure if this is the same issue. The build you said (20021127) the change from beta2 to beta3 of NSS_Client was the first day that I noticed this problem. What changes between beta2 and beta3 were there that could cause this kind of a problem?

I have determined that this bug is introduced by Ian's patch for bug 177366. I can reproduce this crash using Netscape 7 with NSS 3.6.1 Beta3 DLLs (WIN954.0_DBG.OBJ). If I back out Ian's patch (attachment 104773 [details] [diff] [review]), the crash is gone. Ian, could you take a look at this? This regression will block the NSS 3.6.1 release, which we plan to ship on Wednesday, Dec. 4. Thanks.

This could be a PSM bug exposed by Ian's NSS patch. When this crash occurs, NSS has already been shut down. This means PSM is trying to destroy an NSS certificate object after NSS has been shut down. This used to work but with Ian's patch NSS certificates can't be destroyed after NSS has been shut down. Does this make sense?

I had a hunch that the problem was that CERT_DestroyCertificate was being called after NSS_Shutdown, and that hunch seems to be correct. I verified this by using printfs in an nss3.dll, in every case a printf in NSS_Shutdown is hit, followed by a printf in CERT_DestroyCertificate, then crash. For whatever reason, the changes in NSS 3.6 exposed this. Kai, I know you're already working on this. Perhaps you have the fix for PSM, it just isn't in Mozilla 1.2?

I was typing my comment as Wan-Teh was putting his in, that is why the last two comments say essentially the same thing.

I can reproduce the crash. I can confirm that NSS_Shutdown is called before the certificate is destroyed. The reason is: At the time PSM receives the "cleanup on shutdown or profile switch" announcement event, we must shut down NSS. But in this crash situation, some other component is still holding a reference to a PSM certificate wrapper object. I can't fix that problem. Yes, I have a patch. I can confirm, with my patch for bug 177260, the crash goes away, because we free the NSS resources, even if the PSM wrapper object gets destroyed at a later time. Problem is: The patch in bug 177260 adds complexity to PSM. There were concerns about that complexity. I think, this crash bug shows us another argument why we should accept the new complexity proposed in bug 177260.

This is also related to the fact that Necko does not yet make sure that all sockets are getting closed synchronously before the shutdown sequence is initiated (bug 181230). Maybe this bug will go away once bug 181230 is fixed, maybe avoiding the complexity of bug 177260, but I'm not sure.

Changed product to PSM. I think this bug should be fixed by fixing the Necko bug (bug 181230). There is a patch in that bug for HTTPS. That patch needs to be extended to handle other protocols over SSL.

Adding [@ nssCertificate_Destroy] to summary since Talkback is reporting similar crashes under that stack signature. Those crashes started showing up in Trunk builds on 11/27. Here's the latest from Talkback: Count Offset Real Signature [ 64 nssCertificate_Destroy 15cbf361 - nssCertificate_Destroy ] Crash date range: 2002-11-27 to 2002-12-03 Min/Max Seconds since last crash: 13 - 493840 Min/Max Runtime: 72 - 611962 Keyword List : crash(4), mail(5), Count Platform List 24 Windows 98 4.10 build 67766446 22 Windows NT 5.1 build 2600 9 Windows 98 4.10 build 67766222 8 Windows NT 5.0 build 2195 1 Windows NT 4.0 build 1381 Count Build Id List 21 2002112808 10 2002113004 10 2002112908 6 2002112708 5 2002120204 4 2002120308 3 2002120108 2 2002120208 2 2002112704 1 2002120304 No of Unique Users 23 Stack trace(Frame) nssCertificate_Destroy [certificate.c line 131] nsNSSCertificate::`scalar deleting destructor' nsCOMPtr_base::~nsCOMPtr_base [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65] nsSSLStatus::`scalar deleting destructor' nsSSLStatus::Release [c:/builds/seamonkey/mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp line 112] nsCOMPtr_base::~nsCOMPtr_base [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65] nsNSSSocketInfo::~nsNSSSocketInfo [c:/builds/seamonkey/mozilla/security/manager/ssl/src/nsNSSIOLayer.cpp line 173] nsNSSSocketInfo::`scalar deleting destructor' nsNSSSocketInfo::Release [c:/builds/seamonkey/mozilla/security/manager/ssl/src/nsNSSIOLayer.cpp line 173] nsCOMPtr_base::~nsCOMPtr_base [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65] nsSocketTransport::`scalar deleting destructor' nsSocketTransport::Release [c:/builds/seamonkey/mozilla/netwerk/base/src/nsSocketTransport.cpp line 1325] nsSocketRequest::~nsSocketRequest [c:/builds/seamonkey/mozilla/netwerk/base/src/nsSocketTransport.cpp line 2722] nsSocketReadRequest::`scalar deleting destructor' nsSocketRequest::Release [c:/builds/seamonkey/mozilla/netwerk/base/src/nsSocketTransport.cpp line 2706] nsCOMPtr_base::~nsCOMPtr_base [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65] nsOnStopRequestEvent::~nsOnStopRequestEvent [c:/builds/seamonkey/mozilla/netwerk/base/src/nsRequestObserverProxy.cpp line 295] nsOnStopRequestEvent::`scalar deleting destructor' nsARequestObserverEvent::DestroyPLEvent [c:/builds/seamonkey/mozilla/netwerk/base/src/nsRequestObserverProxy.cpp line 124] PL_DestroyEvent [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c line 682] PL_HandleEvent [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c line 657] PL_ProcessPendingEvents [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c line 578] nsEventQueueImpl::ProcessPendingEvents [c:/builds/seamonkey/mozilla/xpcom/threads/nsEventQueue.cpp line 392] (14694173) URL: ebay.com (14690205) Comments: Just closed moz when it crashed! (I had IE open at the same time. Could there have been a conflict?) (14677389) Comments: closing mail client of 1.3a nightly 20021203 (14675159) Comments: I was exiting after trying to install a new theme. Have hade a lot of GPF at exit with the latest 1.3.a nightly (14672665) Comments: closing down 1.3a 2002010204 (14666114) Comments: was exiting the mail client again. (14664738) Comments: shutting down 1.3a 2002120204 (14637007) Comments: 12-2 commercial trunk on xp had browser/mesgr up. was looking at the filter window. Don't remember if I closed filter window. But I did file/quit on messenger I believe and when it quit it then crashed. 2nd time this happened. (14625971) Comments: closing the mail component of 2002120204 (14625236) Comments: closed the mail... 2002120204 (14624701) Comments: closing mail and browser windows... 2002120204 (14624145) Comments: just closing the browser from Mozilla.org (14620290) Comments: Just closing mozilla. (14610795) Comments: was just closing news application (14605737) Comments: Crashed when I closed the program. (14605126) URL: robbiewillimas.com (14600231) Comments: MOZILLA caused an invalid page fault in module NSS3.DLL at 0167:61fc2f34. Registers: EAX=03030e30 CS=0167 EIP=61fc2f34 EFLGS=00010202 EBX=046b9308 SS=016f ESP=0064fbdc EBP=03030e30 ECX=046c08b0 DS=016f ESI=02fb9f18 FS=45c7 EDX=61aa04b8 ES=016f (14600231) Comments: EDI=0303dbf8 GS=0000 Bytes at CS:EIP: 8b 4f 14 51 e8 83 3d 00 00 eb 06 55 e8 6b 2c 00 Stack dump: 61df90a3 046c08b0 0064fbfc 61a89989 033064b8 046c08b8 046c08b0 046c08b0 60fd24e0 61a898e3 046c08b0 61a897ae 00000001 046c0014 046c0010 61df90af (14599735) URL: dephi forums.com to ebay.com (14594194) Comments: exiting mozilla. :( MOZILLA caused an invalid page fault in module NSS3.DLL at 0167:61fc2f34. Registers: EAX=013efce8 CS=0167 EIP=61fc2f34 EFLGS=00010202 EBX=0207e888 SS=016f ESP=0064fbdc EBP=013efce8 ECX=0209eac0 DS=016f ESI=02d62920 FS=4817 (14594194) Comments: EDX=61aa04b8 ES=016f EDI=02dd5ea8 GS=0000 Bytes at CS:EIP: 8b 4f 14 51 e8 83 3d 00 00 eb 06 55 e8 6b 2c 00 Stack dump: 61df90a3 0209eac0 0064fbfc 61a89989 03162938 0209eac8 0209eac0 0209eac0 60fd24e0 61a898e3 0209eac0 61a897ae 00000001 02099544 (14594194) Comments: 02099540 61df90af (14590476) Comments: closing mozilla (14585809) Comments: exiting the product (14561902) URL: dephi forums.com to ebay.com (14561902) Comments: shutting down 1.3a 2002113004 (14561204) URL: dephi forums.com to ebay.com (14561204) Comments: shutting down the 2002113004 (14532692) Comments: upon closing the application (14526681) URL: dephi forums.com to ebay.com (14515045) Comments: I had just finished downloading something and closed mozilla. Never used to crash before. :( (14509847) Comments: I'd just finished editing preferences (changed the theme removed bookmarks button from toolbar removed jpg and gif files from the system menu) and closed Moz in order for the changes to stick (14497841) Comments: Exiting. After installing nightly 11/28/02

Adding M121 to summary since this is also a topcrasher for Mozilla 1.2.1: nssCertificate_Destroy (9 crashes) BBID range: 14557650 - 14624145 Min/Max Seconds since last crash: 13 - 29315 Min/Max Runtime: 74 - 72469 Crash data range: 2002-11-30 to 2002-12-02 Build ID range: 2002113004 to 2002113004 Stack Trace: nssCertificate_Destroy [certificate.c line 131] nsNSSCertificate::`scalar deleting destructor' nsCOMPtr_base::~nsCOMPtr_base [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65] nsSSLStatus::`scalar deleting destructor' nsSSLStatus::Release [c:/builds/seamonkey/mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp line 112] nsCOMPtr_base::~nsCOMPtr_base [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65] nsNSSSocketInfo::~nsNSSSocketInfo [c:/builds/seamonkey/mozilla/security/manager/ssl/src/nsNSSIOLayer.cpp line 173] nsNSSSocketInfo::`scalar deleting destructor' nsNSSSocketInfo::Release [c:/builds/seamonkey/mozilla/security/manager/ssl/src/nsNSSIOLayer.cpp line 173] nsCOMPtr_base::~nsCOMPtr_base [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65] nsSocketTransport::`scalar deleting destructor' nsSocketTransport::Release [c:/builds/seamonkey/mozilla/netwerk/base/src/nsSocketTransport.cpp line 1325] nsSocketRequest::~nsSocketRequest [c:/builds/seamonkey/mozilla/netwerk/base/src/nsSocketTransport.cpp line 2722] nsSocketReadRequest::`scalar deleting destructor' nsSocketRequest::Release [c:/builds/seamonkey/mozilla/netwerk/base/src/nsSocketTransport.cpp line 2706] nsCOMPtr_base::~nsCOMPtr_base [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65] nsOnStopRequestEvent::~nsOnStopRequestEvent [c:/builds/seamonkey/mozilla/netwerk/base/src/nsRequestObserverProxy.cpp line 295] nsOnStopRequestEvent::`scalar deleting destructor' nsARequestObserverEvent::DestroyPLEvent [c:/builds/seamonkey/mozilla/netwerk/base/src/nsRequestObserverProxy.cpp line 124] PL_DestroyEvent [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c line 682] PL_HandleEvent [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c line 657] PL_ProcessPendingEvents [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c line 578] nsEventQueueImpl::ProcessPendingEvents [c:/builds/seamonkey/mozilla/xpcom/threads/nsEventQueue.cpp line 392] Source File : certificate.c line : 131 14624145 OS: Windows 98 4.10 build 67766446 Comments: just closing the browser from Mozilla.org Email: gilcarvr@netscape.net 14605737 OS: Windows NT 5.1 build 2600 Comments: Crashed when I closed the program. Email: Baffoni@aerovironment.com 14605126 OS: Windows 98 4.10 build 67766446 URL: robbiewillimas.com Email: gilcarvr@netscape.net 14599735 OS: Windows 98 4.10 build 67766446 URL: dephi forums.com to ebay.com Email: gilcarvr@netscape.net 14561902 OS: Windows 98 4.10 build 67766446 Comments: shutting down 1.3a 2002113004 URL: dephi forums.com to ebay.com Email: gilcarvr@netscape.net 14561204 OS: Windows 98 4.10 build 67766446 Comments: shutting down the 2002113004 URL: dephi forums.com to ebay.com Email: gilcarvr@netscape.net 14558077 OS: Windows NT 5.1 build 2600 14557730 OS: Windows NT 5.1 build 2600 14557650 OS: Windows NT 5.1 build 2600

Jay, The stack you showed in comment #14 is NOT a Mozilla 1.2.1 stack trace because line 131 of certificate.c in MOZILLA_1_2_1_RELEASE is a blank line between two functions. I think it is Mozilla 1.3a.

*** Bug 183760 has been marked as a duplicate of this bug. ***

*** Bug 183662 has been marked as a duplicate of this bug. ***

*** Bug 184016 has been marked as a duplicate of this bug. ***

build 2002120904 WinXP Talkback IDs : TB14934296W TB14934158Y TB14915266H

*** Bug 185081 has been marked as a duplicate of this bug. ***

*** Bug 185403 has been marked as a duplicate of this bug. ***

Blocking 1.3b. I see this on almost every single shutdown.

I have also confirmed that this crash occurs on secure web sites as well - HTTPS

I see crashes on trunk, I'm using SSL only for IMAPS. Both win32 and linux. 100% repro, on every shutdown. Please check if my stacktraces match the pattern: TB15207144Q TB15205517M If they do, the problem also concerns IMAPS connection - the bug's summary needs to be updated to be more general.

I also confirm that the crash occurs only when Mozilla engaged in some form of SSL communication during that session - SSL website (like https://www.altkom.com.pl) or SSL mail or news server.

I backed out kaie's checkin for bug #175320 and this problem went away. cvs update -j1.72 -j1.71 mozilla/extensions/cookie/nsCookieService.cpp cvs update -j1.380 -j1.379 mozilla/xpfe/bootstrap/nsAppRunner.cpp cvs update -j1.52 -j1.51 mozilla/profile/src/nsProfile.h cvs update -j1.275 -j1.274 mozilla/profile/src/nsProfile.cpp cvs update -j1.6 -j1.5 mozilla/profile/public/nsIProfileChangeStatus.idl I've had problems with cookies in the last two days as well. I'll bet that this is the cause of that as well. I say we back that out until this issue is resolved unless kaie shows a really fast turn around here.

I doubt backing out the patch from bug 175320 will fix all crashes. There was a time when this patch was not in, and we still had crash reports. I talked with blizzard. We agreed on temporarily disabling the call to NSS_Shutdown in nsNSSComponent.cpp, which masks the crash until bug 181230 gets fixed.

-> me

*** Bug 185844 has been marked as a duplicate of this bug. ***

Comment on attachment 109556 [details] [diff] [review] wordaround patch r=javi profile switching will be completely unuseable with this though. :(

Comment on attachment 109556 [details] [diff] [review] wordaround patch sr=darin

Setting Hardware to All per comment 30.

*** Bug 185739 has been marked as a duplicate of this bug. ***

Thought I'd add this to the mix, I got this with a cvs pull from earlier today.

Nearly missed this because of that little 'n' ;-)

nssTrustDomain_LockCertCache looks to be the same as well

Fixing Summary. (What's a servern?)

A "servern" is a rare typo-monster.

*** Bug 186010 has been marked as a duplicate of this bug. ***

Probably should remove the word "news" from the summary line, since there are also crash reports involving SSL IMAP and ordinary HTTPS. I posted a separate bug because I assumed this bug was only for the mail & news component.

Changing Summary per comments.

*** Bug 185994 has been marked as a duplicate of this bug. ***

WFM Win98SE today's latest 2002121908

I beat you by one build, Jay: WFM Win98SE yesterday's 2002121804

Sorry, make that: 2002121808

Adding yet another stack signature to the summary...there have also been crashes under NSSCertificate_WrapSymmetricKey. None since 12/17 MozillaTrunk builds though...so hopefully this "fix" worked for those crashes as well.

Here's the stack for the most recent stack signature added into the mix for future reference: NSSCertificate_WrapSymmetricKey() nsNSSCertificate::`scalar deleting destructor' nsCOMPtr_base::~nsCOMPtr_base [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65] nsSSLStatus::Release [c:/builds/seamonkey/mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp line 112] nsCOMPtr_base::~nsCOMPtr_base [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65] nsNSSSocketInfo::`scalar deleting destructor' nsNSSSocketInfo::Release [c:/builds/seamonkey/mozilla/security/manager/ssl/src/nsNSSIOLayer.cpp line 173] nsCOMPtr_base::~nsCOMPtr_base [c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp line 65] nsMemoryCacheDevice::Shutdown [c:/builds/seamonkey/mozilla/netwerk/cache/src/nsMemoryCacheDevice.cpp line 104] nsMemoryCacheDevice::~nsMemoryCacheDevice [c:/builds/seamonkey/mozilla/netwerk/cache/src/nsMemoryCacheDevice.cpp line 61] nsMemoryCacheDevice::`scalar deleting destructor' nsCacheService::Shutdown [c:/builds/seamonkey/mozilla/netwerk/cache/src/nsCacheService.cpp line 477] nsCacheProfilePrefObserver::Observe [c:/builds/seamonkey/mozilla/netwerk/cache/src/nsCacheService.cpp line 232] NECKO.DLL + 0x5b07c (0x6126b07c) nsMemoryCacheDevice::Init [c:/builds/seamonkey/mozilla/netwerk/cache/src/nsMemoryCacheDevice.cpp line 66] nsMemoryCacheDeviceInfo::QueryInterface [c:/builds/seamonkey/mozilla/netwerk/cache/src/nsMemoryCacheDevice.cpp line 420]

Something is wrong with that stack. NSSCertificate_WrapSymmetricKey is not implemented, and AFAIK, never called.

*** Bug 186152 has been marked as a duplicate of this bug. ***

*** Bug 187250 has been marked as a duplicate of this bug. ***

The patch has r= and sr=; was it ever checked in? Is this FIXED?

> The patch has r= and sr=; was it ever checked in? Is this FIXED? Indeed, I checked in the workaround patch on 18-Dec-02 but forgot to mention it in this bug. Setting to fixed.

The last instance of nssCertificate_Destroy in http://climate was build ID 2002121708. I do not crash after visitng a secure newsgroup. Marking verified.

I have filed bug 187501 to remind us removing the workaround once we are ready to do so.