[tor-bugs] #19400 [Applications/Tor Browser]: [Asan] Crash in js::AsmJSModule::deserialize / DeserializeSig

[Tor Bug Tracker & Wiki]

#19400: [Asan] Crash in js::AsmJSModule::deserialize / DeserializeSig
-------------------------------------------------+-------------------------
 Reporter:  cypherpunks                          |          Owner:  tbb-
     Type:  defect                               |  team
 Priority:  Very High                            |         Status:
Component:  Applications/Tor Browser             |  assigned
 Severity:  Critical                             |      Milestone:
 Keywords:  tbb-crash, TorBrowserTeam201606,     |        Version:
  tbb-6.0-issues                                 |     Resolution:
Parent ID:                                       |  Actual Points:
 Reviewer:                                       |         Points:
                                                 |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by Chopchipcyps):

 Replying to [comment:7 cypherpunks]:
 > Replying to [comment:4 gk]:
 > > 1) Does saving the whole website locally and using that one (via
 file:///) crash as well? If so, could I get a copy of that website (see
 above for contact details)?
 >
 > No, it doesn't crash. I used a vanilla FF 47 profile to save the page
 and opened it in TBB 6.5a1-hardened and it didn't crash.

 Hope this is in the right place:
 Can confirm here - running ML - tried reinstalling, then reverting back to
 6 - it does not matter. The moment I begin to type something or interact
 with FB normal site, Tor crashes.

 I can only run FB through Tor if it is in mobile site.

 CRASH REPORT:
 Crashed Thread:  61  DOM Worker

 Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
 Exception Codes: KERN_INVALID_ADDRESS at 0x0000000132be6000

 VM Regions Near 0x132be6000:
     mapped file            0000000132b00000-0000000132be6000 [  920K]
 r--/rwx SM=COW  /Users/USER/Library/Application Support/TorBrowser-Data/*
 -->
     VM_ALLOCATE            0000000132c00000-0000000132d00000 [ 1024K]
 rw-/rwx SM=PRV


 CONSOLE:
 15/06/2016 11:21:40.058 com.apple.launchd.peruser.501[209]:
 ([0x0-0x109008f].org.mozilla.tor browser[25824]) Job appears to have
 crashed: Segmentation fault: 11

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19400#comment:26>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online