Bug 378241, Changes from bug 107491 lead to tons of thread-safety asserts

r=rrelyea, r=wtc, sr=benjamin, blocking1.9=benjamin

netwerk/base/public/nsINSSErrorsService.idl

@@ -71,4 +71,16 @@ interface nsINSSErrorsService : nsISupports
 
     const unsigned long ERROR_CLASS_SSL_PROTOCOL = 1;
     const unsigned long ERROR_CLASS_BAD_CERT     = 2;
+
+    /**
+     *  The following values define the range of NSPR error codes used by NSS.
+     *  NSS remains the authorative source for these numbers, as a result,
+     *  the values might change in the future.
+     *  The security module will perform a runtime check and assertion
+     *  to ensure the values are in synch with NSS.
+     */
+    const long NSS_SEC_ERROR_BASE  = (-0x2000);
+    const long NSS_SEC_ERROR_LIMIT = (NSS_SEC_ERROR_BASE + 1000);
+    const long NSS_SSL_ERROR_BASE  = (-0x3000);
+    const long NSS_SSL_ERROR_LIMIT = (NSS_SSL_ERROR_BASE + 1000);
 };

netwerk/base/src/nsSocketTransport2.cpp

@@ -148,6 +148,26 @@ static PRErrorCode RandomizeConnectError(PRErrorCode code)
 
 //-----------------------------------------------------------------------------
 
+static PRBool
+IsNSSErrorCode(PRErrorCode code)
+{
+  return 
+    ((code >= nsINSSErrorsService::NSS_SEC_ERROR_BASE) && 
+      (code < nsINSSErrorsService::NSS_SEC_ERROR_LIMIT))
+    ||
+    ((code >= nsINSSErrorsService::NSS_SSL_ERROR_BASE) && 
+      (code < nsINSSErrorsService::NSS_SSL_ERROR_LIMIT));
+}
+
+// this logic is duplicated from the implementation of
+// nsINSSErrorsService::getXPCOMFromNSSError
+// It might have been better to implement that interface here...
+static nsresult
+GetXPCOMFromNSSError(PRErrorCode code)
+{
+    return NS_ERROR_GENERATE_FAILURE(NS_ERROR_MODULE_SECURITY, -1 * code);
+}
+
 static nsresult
 ErrorAccordingToNSPR(PRErrorCode errorCode)
 {
@@ -178,18 +198,9 @@ ErrorAccordingToNSPR(PRErrorCode errorCode)
         rv = NS_ERROR_NET_TIMEOUT;
         break;
     default:
-        {
-            nsCOMPtr<nsINSSErrorsService> nsserr =
-                do_GetService(NS_NSS_ERRORS_SERVICE_CONTRACTID);
-            if (nsserr) {
-                nsresult nssXPCOMCode;
-                nsresult conversionStatus =
-                  nsserr->GetXPCOMFromNSSError(errorCode, &nssXPCOMCode);
-
-                if (NS_SUCCEEDED(conversionStatus))
-                    rv = nssXPCOMCode;
-            }
-        }
+        if (IsNSSErrorCode(errorCode))
+            rv = GetXPCOMFromNSSError(errorCode);
+        break;
     }
     LOG(("ErrorAccordingToNSPR [in=%d out=%x]\n", errorCode, rv));
     return rv;

security/manager/ssl/src/nsNSSComponent.cpp

@@ -1445,6 +1445,13 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox)
 
   PR_LOG(gPIPNSSLog, PR_LOG_DEBUG, ("nsNSSComponent::InitializeNSS\n"));
 
+  // If we ever run into this assertion, we must update the values
+  // in nsINSSErrorsService.idl
+  PR_STATIC_ASSERT(nsINSSErrorsService::NSS_SEC_ERROR_BASE == SEC_ERROR_BASE
+                   && nsINSSErrorsService::NSS_SEC_ERROR_LIMIT == SEC_ERROR_LIMIT
+                   && nsINSSErrorsService::NSS_SSL_ERROR_BASE == SSL_ERROR_BASE
+                   && nsINSSErrorsService::NSS_SSL_ERROR_LIMIT == SSL_ERROR_LIMIT);
+
   // variables used for flow control within this function
 
   enum { problem_none, problem_no_rw, problem_no_security_at_all }