The testcase reproduces for me on Windows 10 using mozilla-central rev 8948d4a41f23.
```
==1068==ERROR: AddressSanitizer: heap-use-after-free on address 0x11fb48edbc98 at pc 0x7ff6debfdb54 bp 0x005ab2dff6a0 sp 0x005ab2dff6e0
READ of size 4 at 0x11fb48edbc98 thread T1
#0 0x7ff6debfdb53 in sandbox::BrokerServicesBase::TargetEventsThread z:\build\build\src\security\sandbox\chromium\sandbox\win\src\broker_services.cc:373
#1 0x7ff822f0e448 in __asan::AsanThread::ThreadStart Z:\task_1598931574\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_thread.cpp:262
#2 0x7ff8523a7bd3 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017bd3)
#3 0x7ff83aeb4962 in patched_BaseThreadInitThunk z:\build\build\src\mozglue\dllservices\WindowsDllBlocklist.cpp:592
#4 0x7ff8542cced0 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18006ced0)
0x11fb48edbc98 is located 8 bytes inside of 40-byte region [0x11fb48edbc90,0x11fb48edbcb8)
freed by thread T1 here:
#0 0x7ff822f1098f in operator delete Z:\task_1598931574\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_new_delete.cpp:160
#1 0x7ff6debfc8c0 in sandbox::BrokerServicesBase::TargetEventsThread z:\build\build\src\security\sandbox\chromium\sandbox\win\src\broker_services.cc:373
#2 0x7ff822f0e448 in __asan::AsanThread::ThreadStart Z:\task_1598931574\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_thread.cpp:262
#3 0x7ff8523a7bd3 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017bd3)
#4 0x7ff83aeb4962 in patched_BaseThreadInitThunk z:\build\build\src\mozglue\dllservices\WindowsDllBlocklist.cpp:592
#5 0x7ff8542cced0 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18006ced0)
previously allocated by thread T22 here:
#0 0x7ff822f1008f in operator new Z:\task_1598931574\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_new_delete.cpp:99
#1 0x7ff6dec01226 in sandbox::BrokerServicesBase::AddTargetPeerInternal z:\build\build\src\security\sandbox\chromium\sandbox\win\src\broker_services.cc:702
#2 0x7ff6dec01aaa in sandbox::BrokerServicesBase::AddTargetPeer z:\build\build\src\security\sandbox\chromium\sandbox\win\src\broker_services.cc:717
#3 0x7ff80cd19b18 in mozilla::SandboxBroker::AddTargetPeer z:\build\build\src\security\sandbox\win\src\sandboxbroker\sandboxBroker.cpp:1461
#4 0x7ff80e30bf8b in mozilla::ipc::WindowsProcessLauncher::DoFinishLaunch z:\build\build\src\ipc\glue\GeckoChildProcessHost.cpp:1589
#5 0x7ff80e30c10f in mozilla::ipc::BaseProcessLauncher::FinishLaunch z:\build\build\src\ipc\glue\GeckoChildProcessHost.cpp:1602
#6 0x7ff80e338822 in mozilla::MozPromise<void *,mozilla::ipc::LaunchError,0>::ThenValue<`lambda at z:/build/build/src/ipc/glue/GeckoChildProcessHost.cpp:1018:7',`lambda at z:/build/build/src/ipc/glue/GeckoChildProcessHost.cpp:1022:7'>::DoResolveOrRejectInternal z:\build\workspace\obj-build\dist\include\mozilla\MozPromise.h:769
#7 0x7ff80cd0a3a1 in mozilla::MozPromise<void *,mozilla::ipc::LaunchError,0>::ThenValueBase::ResolveOrRejectRunnable::Run z:\build\workspace\obj-build\dist\include\mozilla\MozPromise.h:410
#8 0x7ff80cffcd86 in mozilla::TaskQueue::Runner::Run z:\build\build\src\xpcom\threads\TaskQueue.cpp:158
#9 0x7ff80d019fb5 in nsThread::ProcessNextEvent z:\build\build\src\xpcom\threads\nsThread.cpp:1234
#10 0x7ff80d0269bc in NS_ProcessNextEvent z:\build\build\src\xpcom\threads\nsThreadUtils.cpp:513
#11 0x7ff80e364b6e in mozilla::ipc::MessagePumpForNonMainThreads::Run z:\build\build\src\ipc\glue\MessagePump.cpp:302
#12 0x7ff80e2abed5 in MessageLoop::RunHandler z:\build\build\src\ipc\chromium\src\base\message_loop.cc:327
#13 0x7ff80e2abca5 in MessageLoop::Run z:\build\build\src\ipc\chromium\src\base\message_loop.cc:309
#14 0x7ff80d0120cd in nsThread::ThreadFunc z:\build\build\src\xpcom\threads\nsThread.cpp:442
#15 0x7ff823df95ae in _PR_NativeRunThread z:\build\build\src\nsprpub\pr\src\threads\combined\pruthr.c:399
#16 0x7ff823dd28fb in pr_root z:\build\build\src\nsprpub\pr\src\md\windows\w95thred.c:139
#17 0x7ff851330e71 in beginthreadex+0x141 (C:\WINDOWS\System32\ucrtbase.dll+0x180020e71)
#18 0x7ff822f0e448 in __asan::AsanThread::ThreadStart Z:\task_1598931574\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_thread.cpp:262
Thread T1 created by T0 here:
#0 0x7ff822f0f907 in __asan_wrap_CreateThread Z:\task_1598931574\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_win.cpp:146
#1 0x7ff6debfb3a2 in sandbox::BrokerServicesBase::Init z:\build\build\src\security\sandbox\chromium\sandbox\win\src\broker_services.cc:170
#2 0x7ff6dec786fa in mozilla::sandboxing::InitializeBrokerServices z:\build\build\src\security\sandbox\win\SandboxInitialization.cpp:167
#3 0x7ff6dec785dc in mozilla::sandboxing::GetInitializedBrokerServices z:\build\build\src\security\sandbox\win\SandboxInitialization.cpp:184
#4 0x7ff6deba1ff4 in NS_internal_main z:\build\build\src\browser\app\nsBrowserApp.cpp:331
#5 0x7ff6deba148e in wmain z:\build\build\src\toolkit\xre\nsWindowsWMain.cpp:131
#6 0x7ff6dec937a7 in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#7 0x7ff8523a7bd3 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017bd3)
#8 0x7ff8542cced0 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18006ced0)
Thread T22 created by T0 here:
#0 0x7ff822f0f907 in __asan_wrap_CreateThread Z:\task_1598931574\fetches\llvm-project\llvm\projects\compiler-rt\lib\asan\asan_win.cpp:146
#1 0x7ff851330d86 in beginthreadex+0x56 (C:\WINDOWS\System32\ucrtbase.dll+0x180020d86)
#2 0x7ff823dd272d in _PR_MD_CREATE_THREAD z:\build\build\src\nsprpub\pr\src\md\windows\w95thred.c:153
#3 0x7ff823dfa40c in _PR_NativeCreateThread z:\build\build\src\nsprpub\pr\src\threads\combined\pruthr.c:1058
#4 0x7ff823dfad73 in _PR_CreateThread z:\build\build\src\nsprpub\pr\src\threads\combined\pruthr.c:1184
#5 0x7ff823df0d2f in PR_CreateThread z:\build\build\src\nsprpub\pr\src\threads\combined\pruthr.c:1404
#6 0x7ff80d014d09 in nsThread::Init z:\build\build\src\xpcom\threads\nsThread.cpp:659
#7 0x7ff80d025526 in nsThreadManager::NewNamedThread z:\build\build\src\xpcom\threads\nsThreadManager.cpp:628
#8 0x7ff80d02f6aa in NS_NewNamedThread z:\build\build\src\xpcom\threads\nsThreadUtils.cpp:161
#9 0x7ff80d029a92 in NS_NewNamedThread z:\build\build\src\xpcom\threads\nsThreadUtils.cpp:152
#10 0x7ff80e3051ec in mozilla::ipc::GetIPCLauncher z:\build\build\src\ipc\glue\GeckoChildProcessHost.cpp:927
#11 0x7ff80e32dbca in mozilla::ipc::BaseProcessLauncher::BaseProcessLauncher z:\build\build\src\ipc\glue\GeckoChildProcessHost.cpp:150
#12 0x7ff80e3013a6 in mozilla::ipc::GeckoChildProcessHost::AsyncLaunch z:\build\build\src\ipc\glue\GeckoChildProcessHost.cpp:692
#13 0x7ff80e3042f0 in mozilla::ipc::GeckoChildProcessHost::LaunchAndWaitForProcessHandle z:\build\build\src\ipc\glue\GeckoChildProcessHost.cpp:809
#14 0x7ff80e0a5901 in mozilla::net::SocketProcessHost::Launch z:\build\build\src\netwerk\ipc\SocketProcessHost.cpp:76
#15 0x7ff80d3427a8 in mozilla::net::nsIOService::LaunchSocketProcess z:\build\build\src\netwerk\base\nsIOService.cpp:542
#16 0x7ff80dbecf88 in mozilla::net::nsHttpHandler::Init z:\build\build\src\netwerk\protocol\http\nsHttpHandler.cpp:470
#17 0x7ff80dbe9b95 in mozilla::net::nsHttpHandler::GetInstance z:\build\build\src\netwerk\protocol\http\nsHttpHandler.cpp:178
#18 0x7ff80e26f7c1 in mozCreateComponent<mozilla::net::nsHttpHandler> z:\build\build\src\netwerk\build\nsNetModule.cpp:61
#19 0x7ff80cf7d1b6 in mozilla::xpcom::CreateInstanceImpl z:\build\workspace\obj-build\xpcom\components\StaticComponents.cpp:9213
#20 0x7ff80cfc0e69 in nsComponentManagerImpl::GetServiceLocked z:\build\build\src\xpcom\components\nsComponentManager.cpp:1370
#21 0x7ff80cfb5b68 in nsComponentManagerImpl::GetServiceByContractID z:\build\build\src\xpcom\components\nsComponentManager.cpp:1555
#22 0x7ff80cfc9777 in nsGetServiceByContractIDWithError::operator() z:\build\build\src\xpcom\components\nsComponentManagerUtils.cpp:253
#23 0x7ff80cde6694 in nsCOMPtr_base::assign_from_gs_contractid_with_error z:\build\build\src\xpcom\base\nsCOMPtr.cpp:91
#24 0x7ff810eb8de5 in mozilla::dom::Navigator::GetAppVersion z:\build\build\src\dom\base\Navigator.cpp:1895
#25 0x7ff8158f74fb in mozilla::dom::workerinternals::RuntimeService::RegisterWorker z:\build\build\src\dom\workers\RuntimeService.cpp:1193
#26 0x7ff81595e4d1 in mozilla::dom::WorkerPrivate::Constructor z:\build\build\src\dom\workers\WorkerPrivate.cpp:2420
#27 0x7ff8158ed660 in mozilla::dom::ChromeWorker::Constructor z:\build\build\src\dom\workers\ChromeWorker.cpp:22
#28 0x7ff8129f91ae in mozilla::dom::ChromeWorker_Binding::_constructor z:\build\workspace\obj-build\dom\bindings\WorkerBinding.cpp:287
#29 0x7ff81a45c544 in InternalConstruct z:\build\build\src\js\src\vm\Interpreter.cpp:728
#30 0x7ff81a440232 in Interpret z:\build\build\src\js\src\vm\Interpreter.cpp:3327
#31 0x7ff81a425f06 in js::RunScript z:\build\build\src\js\src\vm\Interpreter.cpp:469
#32 0x7ff81a458ec9 in js::InternalCallOrConstruct z:\build\build\src\js\src\vm\Interpreter.cpp:637
#33 0x7ff81a45b53a in js::Call z:\build\build\src\js\src\vm\Interpreter.cpp:682
#34 0x7ff81a45de0f in js::CallGetter z:\build\build\src\js\src\vm\Interpreter.cpp:806
#35 0x7ff81aaab344 in js::NativeGetProperty z:\build\build\src\js\src\vm\NativeObject.cpp:2603
#36 0x7ff81a466551 in js::GetProperty z:\build\build\src\js\src\vm\Interpreter.cpp:4730
#37 0x7ff81a440f60 in Interpret z:\build\build\src\js\src\vm\Interpreter.cpp:3017
#38 0x7ff81a425f06 in js::RunScript z:\build\build\src\js\src\vm\Interpreter.cpp:469
#39 0x7ff81a458ec9 in js::InternalCallOrConstruct z:\build\build\src\js\src\vm\Interpreter.cpp:637
#40 0x7ff81a45b53a in js::Call z:\build\build\src\js\src\vm\Interpreter.cpp:682
#41 0x7ff81abc565d in js::CallSelfHostedFunction z:\build\build\src\js\src\vm\SelfHosting.cpp:1694
#42 0x7ff81a6faa1f in AsyncFunctionResume z:\build\build\src\js\src\vm\AsyncFunction.cpp:128
#43 0x7ff81a8814ee in PromiseReactionJob z:\build\build\src\js\src\builtin\Promise.cpp:1853
#44 0x7ff81a45867c in js::InternalCallOrConstruct z:\build\build\src\js\src\vm\Interpreter.cpp:600
#45 0x7ff81a45b53a in js::Call z:\build\build\src\js\src\vm\Interpreter.cpp:682
#46 0x7ff81a5f3b81 in JS::Call z:\build\build\src\js\src\jsapi.cpp:2820
#47 0x7ff811c77d10 in mozilla::dom::PromiseJobCallback::Call z:\build\workspace\obj-build\dom\bindings\PromiseBinding.cpp:30
#48 0x7ff80cdd0f5e in mozilla::PromiseJobRunnable::Run z:\build\build\src\xpcom\base\CycleCollectedJSContext.cpp:211
#49 0x7ff80cda9be3 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint z:\build\build\src\xpcom\base\CycleCollectedJSContext.cpp:646
#50 0x7ff80cdaac1b in mozilla::CycleCollectedJSContext::BeforeProcessTask z:\build\build\src\xpcom\base\CycleCollectedJSContext.cpp:445
#51 0x7ff80f02ddc6 in XPCJSContext::BeforeProcessTask z:\build\build\src\js\xpconnect\src\XPCJSContext.cpp:1396
#52 0x7ff80d018c4a in nsThread::ProcessNextEvent z:\build\build\src\xpcom\threads\nsThread.cpp:1114
#53 0x7ff80d0269bc in NS_ProcessNextEvent z:\build\build\src\xpcom\threads\nsThreadUtils.cpp:513
#54 0x7ff80d025fc0 in nsThreadManager::SpinEventLoopUntilInternal z:\build\build\src\xpcom\threads\nsThreadManager.cpp:702
#55 0x7ff81d5cd531 in XPTC__InvokebyIndex+0x71 (C:\builds\m-c-20200910093613-asan-opt\xul.dll+0x1908ed531)
#56 0x7ff80f0b3da3 in XPCWrappedNative::CallMethod z:\build\build\src\js\xpconnect\src\XPCWrappedNative.cpp:1142
#57 0x7ff80f0ba553 in XPC_WN_CallMethod z:\build\build\src\js\xpconnect\src\XPCWrappedNativeJSOps.cpp:947
#58 0x7ff81a45867c in js::InternalCallOrConstruct z:\build\build\src\js\src\vm\Interpreter.cpp:600
#59 0x7ff81a43ffb9 in Interpret z:\build\build\src\js\src\vm\Interpreter.cpp:3337
#60 0x7ff81a425f06 in js::RunScript z:\build\build\src\js\src\vm\Interpreter.cpp:469
#61 0x7ff81a458ec9 in js::InternalCallOrConstruct z:\build\build\src\js\src\vm\Interpreter.cpp:637
#62 0x7ff81a45b53a in js::Call z:\build\build\src\js\src\vm\Interpreter.cpp:682
#63 0x7ff81a9b3b69 in js::fun_apply z:\build\build\src\js\src\vm\JSFunction.cpp:1209
#64 0x7ff81a45867c in js::InternalCallOrConstruct z:\build\build\src\js\src\vm\Interpreter.cpp:600
#65 0x7ff81a43ffb9 in Interpret z:\build\build\src\js\src\vm\Interpreter.cpp:3337
#66 0x7ff81a425f06 in js::RunScript z:\build\build\src\js\src\vm\Interpreter.cpp:469
#67 0x7ff81a458ec9 in js::InternalCallOrConstruct z:\build\build\src\js\src\vm\Interpreter.cpp:637
#68 0x7ff81a45b53a in js::Call z:\build\build\src\js\src\vm\Interpreter.cpp:682
#69 0x7ff81a5f1f07 in JS_CallFunctionValue z:\build\build\src\js\src\jsapi.cpp:2757
#70 0x7ff80f0a37b5 in nsXPCWrappedJS::CallMethod z:\build\build\src\js\xpconnect\src\XPCWrappedJSClass.cpp:964
#71 0x7ff80d05ea84 in PrepareAndDispatch z:\build\build\src\xpcom\reflect\xptcall\md\win32\xptcstubs_x86_64.cpp:168
#72 0x7ff81d5cd588 in SharedStub+0x48 (C:\builds\m-c-20200910093613-asan-opt\xul.dll+0x1908ed588)
#73 0x7ff81a1ee12f in nsXREDirProvider::DoStartup z:\build\build\src\toolkit\xre\nsXREDirProvider.cpp:971
#74 0x7ff81a1808ba in XREMain::XRE_mainRun z:\build\build\src\toolkit\xre\nsAppRunner.cpp:4536
#75 0x7ff81a1873ea in XREMain::XRE_main z:\build\build\src\toolkit\xre\nsAppRunner.cpp:4946
#76 0x7ff81a188278 in XRE_main z:\build\build\src\toolkit\xre\nsAppRunner.cpp:5003
#77 0x7ff6deba20d6 in NS_internal_main z:\build\build\src\browser\app\nsBrowserApp.cpp:331
#78 0x7ff6deba148e in wmain z:\build\build\src\toolkit\xre\nsWindowsWMain.cpp:131
#79 0x7ff6dec937a7 in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#80 0x7ff8523a7bd3 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017bd3)
#81 0x7ff8542cced0 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18006ced0)
SUMMARY: AddressSanitizer: heap-use-after-free z:\build\build\src\security\sandbox\chromium\sandbox\win\src\broker_services.cc:373 in sandbox::BrokerServicesBase::TargetEventsThread
Shadow bytes around the buggy address:
0x0432b1f5b740: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
0x0432b1f5b750: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
0x0432b1f5b760: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
0x0432b1f5b770: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
0x0432b1f5b780: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
=>0x0432b1f5b790: fa fa fd[fd]fd fd fd fa fa fa fd fd fd fd fd fd
0x0432b1f5b7a0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
0x0432b1f5b7b0: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 fa
0x0432b1f5b7c0: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 fa
0x0432b1f5b7d0: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 fa
0x0432b1f5b7e0: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1068==ABORTING
```
Bug 1663466 Comment 4 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
The testcase reproduces for me on Windows 10 using mozilla-central rev 8948d4a41f23.