[tor-bugs] #19400 [Applications/Tor Browser]: [Asan] Crash in js::AsmJSModule::deserialize / DeserializeSig

[Tor Bug Tracker & Wiki]

#19400: [Asan] Crash in js::AsmJSModule::deserialize / DeserializeSig
-------------------------------------------------+-------------------------
 Reporter:  cypherpunks                          |          Owner:  tbb-
     Type:  defect                               |  team
 Priority:  Very High                            |         Status:
Component:  Applications/Tor Browser             |  assigned
 Severity:  Critical                             |      Milestone:
 Keywords:  tbb-crash, TorBrowserTeam201606,     |        Version:
  tbb-6.0-issues                                 |     Resolution:
Parent ID:                                       |  Actual Points:
 Reviewer:                                       |         Points:
                                                 |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by gk):

 Replying to [comment:24 mcs]:
 > * The crash also occurs on Linux with a gitian-based build that has no
 Tor Browser patches at all (commit
 eba381b5a1d26f1c5d5ba51c67117cae985680c4).
 >
 > The last thing makes me think we should be able to reproduce this with
 Firefox, but looking at the evidence as a whole I am starting to suspect a
 compiler bug. But I am out of time and energy for today.

 Thanks, that helped. I tried different things today to narrow this further
 down and I finally got a gitian build going that is not crashing. I hope
 to pin down the culprit tomorrow and maybe that will be the time for a
 proper fix even.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19400#comment:29>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online