Update to NSS 3.16.2 Beta 3.

nss/lib/pk11wrap/pk11cert.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * This file manages PKCS #11 instances of certificates.
  */
 
 #include "secport.h"
 #include "seccomon.h"
 #include "secmod.h"
@@ skipping 963 matching lines @@
         nssCertificateStore_Unlock(cc->certStore, &lockTrace, &unlockTrace);
         c->object.cryptoContext = NULL;
         cert->istemp = PR_FALSE;
         cert->isperm = PR_TRUE;
     }
 
     /* add the new instance to the cert, force an update of the
      * CERTCertificate, and finish
      */
     nssPKIObject_AddInstance(&c->object, certobj);
+    /* nssTrustDomain_AddCertsToCache may release a reference to 'c' and
+     * replace 'c' by a different value. So we add a reference to 'c' to
+     * prevent 'c' from being destroyed. */
+    nssCertificate_AddRef(c);

[Ryan Sleevi, 2014/06/05 00:22:30]

I wonder if this is responsible for the crashes we've been seeing

[wtc, 2014/06/05 03:00:10]

Yes, this is the best lead I have. I found PK11_ImportCert calls
in the Chromium source tree, e.g., in net/cert/cert_database_nss.cc.

     nssTrustDomain_AddCertsToCache(STAN_GetDefaultTrustDomain(), &c, 1);
+    /* XXX should we pass the original value of 'c' to
+     * STAN_ForceCERTCertificateUpdate? */
     (void)STAN_ForceCERTCertificateUpdate(c);
+    nssCertificate_Destroy(c);
     SECITEM_FreeItem(keyID,PR_TRUE);
     return SECSuccess;
 loser:
     CERT_MapStanError();
     SECITEM_FreeItem(keyID,PR_TRUE);
     if (PORT_GetError() != SEC_ERROR_TOKEN_NOT_LOGGED_IN) {
         PORT_SetError(SEC_ERROR_ADDING_CERT);
     }
     return SECFailure;
 }
@@ skipping 1679 matching lines @@
     }
     if (!found) {
         PK11_FreeSlotList(slotList);
         PORT_SetError(SEC_ERROR_NO_TOKEN);
         slotList = NULL;
     }
 
     nssCryptokiObjectArray_Destroy(instances);
     return slotList;
 }