[tor-bugs] #19400 [Applications/Tor Browser]: [Asan] Crash in js::AsmJSModule::deserialize / DeserializeSig

[Tor Bug Tracker & Wiki]

#19400: [Asan] Crash in js::AsmJSModule::deserialize / DeserializeSig
---------------------------------------------+-----------------------------
 Reporter:  cypherpunks                      |          Owner:  tbb-team
     Type:  defect                           |         Status:
 Priority:  Very High                        |  needs_information
Component:  Applications/Tor Browser         |      Milestone:
 Severity:  Critical                         |        Version:
 Keywords:  tbb-crash, TorBrowserTeam201606  |     Resolution:
Parent ID:                                   |  Actual Points:
 Reviewer:                                   |         Points:
                                             |        Sponsor:
---------------------------------------------+-----------------------------

Comment (by gk):

 Replying to [comment:8 gk]:
 > Okay, thanks so much for narrowing this down. As far as I can see, there
 are three possible sources of the crash:
 >
 > 1) One of our (crash) fixes in 6.0.1 is causing this.
 > 2) It is a bug in Mozilla's code itself.
 > 3) It is a bug caused by new Mozilla code interfering badly with one of
 our patches.
 >
 > I've uploaded a test build trying to rule out 1). It only omits the
 fixes for #19212 and #19187 and is the code otherwise the same as the
 branch used for Tor Browser 6.0.1.
 >
 > https://people.torproject.org/~gk/testbuilds/tor-browser-
 linux64-bug19400-hardened_ALL.tar.xz
 > https://people.torproject.org/~gk/testbuilds/tor-browser-
 linux64-bug19400-hardened_ALL.tar.xz.asc
 >
 > Does this still crash for you?

 It actually only omits the fix for #19187. The other build omitting #19212
 is coming shortly.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19400#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online