b=195574 SSL extremely flaky if Ask for Master Password is 'Every time'

r=darin sr=brendan

extensions/wallet/src/nsWalletService.cpp

@@ -309,7 +309,7 @@ ExpireMasterPasswordPrefChanged(const char * newpref, void * data) {
   }
   if (expireMasterPassword) {
       PRBool status;
-      WLLT_ExpirePassword(&status);
+      WLLT_ExpirePasswordOnly(&status);
   }
   return 0;
 }
@@ -495,7 +495,7 @@ nsWalletlibService::OnStateChange(nsIWebProgress* aWebProgress,
           }
           if (expireMasterPassword) {
             PRBool status;
-            WLLT_ExpirePassword(&status);
+            WLLT_ExpirePasswordOnly(&status);
           }
         }
     }

extensions/wallet/src/wallet.cpp

@@ -769,6 +769,15 @@ PRIVATE nsresult DecryptString (const char * crypt, char *& text) {
 
 PUBLIC void
 WLLT_ExpirePassword(PRBool* status) {
+  nsresult rv = wallet_CryptSetup();
+  if (NS_SUCCEEDED(rv)) {
+    rv = gSecretDecoderRing->LogoutAndTeardown();
+  }
+  *status = NS_SUCCEEDED(rv);
+}
+
+PUBLIC void
+WLLT_ExpirePasswordOnly(PRBool* status) {
   nsresult rv = wallet_CryptSetup();
   if (NS_SUCCEEDED(rv)) {
     rv = gSecretDecoderRing->Logout();

extensions/wallet/src/wallet.h

@@ -114,6 +114,9 @@ WLLT_FetchFromNetCenter();
 extern void
 WLLT_ExpirePassword(PRBool* status);
 
+extern void
+WLLT_ExpirePasswordOnly(PRBool* status);
+
 extern void
 WLLT_InitReencryptCallback(nsIDOMWindowInternal* window);
 

netwerk/base/public/nsISecretDecoderRing.idl

@@ -63,6 +63,10 @@ interface nsISecretDecoderRing: nsISupports {
 
   /* Logout of the security device that protects the SDR key */
   void logout();
+
+  /* Logout of the security device that protects the SDR key
+     and tear down authenticated objects. */
+  void logoutAndTeardown();
 };
 
 /*

security/manager/ssl/src/nsSDR.cpp

@@ -308,7 +308,7 @@ ChangePassword()
 }
 
 static NS_DEFINE_CID(kNSSComponentCID, NS_NSSCOMPONENT_CID);
-/* void logout(); */
+
 NS_IMETHODIMP nsSecretDecoderRing::
 Logout()
 {
@@ -322,6 +322,22 @@ Logout()
     PK11_LogoutAll();
   }
 
+  return NS_OK;
+}
+
+NS_IMETHODIMP nsSecretDecoderRing::
+LogoutAndTeardown()
+{
+  nsresult rv;
+  nsCOMPtr<nsINSSComponent> nssComponent(do_GetService(kNSSComponentCID, &rv));
+  if (NS_FAILED(rv))
+    return rv;
+
+  {
+    nsNSSShutDownPreventionLock locker;
+    PK11_LogoutAll();
+  }
+
   return nssComponent->LogoutAuthenticatedPK11();
 }