[tor-bugs] #19400 [Applications/Tor Browser]: [Asan] Crash in js::AsmJSModule::deserialize / DeserializeSig

[Tor Bug Tracker & Wiki]

#19400: [Asan] Crash in js::AsmJSModule::deserialize / DeserializeSig
---------------------------------------------+-----------------------------
 Reporter:  cypherpunks                      |          Owner:  tbb-team
     Type:  defect                           |         Status:
 Priority:  Very High                        |  needs_information
Component:  Applications/Tor Browser         |      Milestone:
 Severity:  Critical                         |        Version:
 Keywords:  tbb-crash, TorBrowserTeam201606  |     Resolution:
Parent ID:                                   |  Actual Points:
 Reviewer:                                   |         Points:
                                             |        Sponsor:
---------------------------------------------+-----------------------------

Comment (by gk):

 Thanks! I've confirmed by manual testing that the build in comment:8 only
 omits the patch for #19187 and the build in comment:10 omits both. This
 seems to indicate that the backport of the ASan crash fix is somehow
 involved which does not make much sense to me. At least according to
 Mozilla this issue should only affect chrome code. Hm.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19400#comment:14>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online