Update NSPR to 4.12 and NSS to 3.23 on iOS

nss/lib/pk11wrap/pk11util.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * Initialize the PCKS 11 subsystem
  */
 #include "seccomon.h"
 #include "secmod.h"
 #include "nssilock.h"
 #include "secmodi.h"
@@ skipping 66 matching lines @@
         SECMOD_DestroyModuleList(modulesUnload);
         modulesUnload = NULL;
     }
 
     /* make all the slots and the lists go away */
     PK11_DestroySlotLists();
 
     nss_DumpModuleLog();
 
 #ifdef DEBUG
-    if (PR_GetEnv("NSS_STRICT_SHUTDOWN")) {
+    if (PR_GetEnvSecure("NSS_STRICT_SHUTDOWN")) {
         PORT_Assert(secmod_PrivateModuleCount == 0);
     }
 #endif
     if (secmod_PrivateModuleCount) {
         PORT_SetError(SEC_ERROR_BUSY);
         return SECFailure;
     }
     return SECSuccess;
 }
 
@@ skipping 535 matching lines @@
                 for (s = 0; s < module->slotCount; s++) {
                     slot = (module->slots)[s];
                     /* for each possible mechanism */
                     for (i=0; i < num_pk11_default_mechanisms; i++) {
                         /* we are told to turn it on by default ? */
                         PRBool add = 
                          (PK11_DefaultArray[i].flag & defaultMechanismFlags) ?
                                                 PR_TRUE: PR_FALSE;
                         result = PK11_UpdateSlotAttribute(slot, 
                                         &(PK11_DefaultArray[i]),  add);
+                        if (result != SECSuccess) {
+                            SECMOD_ReleaseReadLock(moduleLock);
+                            SECMOD_DestroyModule(module);
+                            return result;
+                        }
                     } /* for each mechanism */
                     /* disable each slot if the defaultFlags say so */
                     if (defaultMechanismFlags & PK11_DISABLE_FLAG) {
                         PK11_UserDisableSlot(slot);
                     }
                 } /* for each slot of this module */
                 SECMOD_ReleaseReadLock(moduleLock);
 
                 /* delete and re-add module in order to save changes 
                  * to the module */
@@ skipping 923 matching lines @@
      * on multiple failures, we are only returning the lastError. The caller
      * can determine which slots are bad by calling PK11_IsDisabled().
      */
     if (rrv != SECSuccess) {
         /* restore the last error code */
         PORT_SetError(lastError);
     }
 
     return rrv;
 }