1497991 - AddressSanitizer: use-after-poison [@ RefreshDriver] with READ of size 8

Status: RESOLVED DUPLICATE of bug 1490561

(Core :: Layout, defect)

Description

[Christian Holler (:decoder)]

The attached crash information was submitted via the ASan Nightly Reporter on mozilla-central-asan-nightly revision 63.0a1-20180831100058-https://hg.mozilla.org/mozilla-central/rev/ea869706644d3b2354b2438c77671d6e43df5e99.

For detailed crash information, see attachment.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Daniel Veditz [:dveditz]]

This looks like classic frame poisoning and not a security bug.

> 63.0a1-20180831100058 

That's kind of an old build. I thought these were supposed to auto-update? Or are you dealing with a backlog of crashes?

This may be similar to bug 1490561

Comment 3

[Christian Holler (:decoder)]

(In reply to Daniel Veditz [:dveditz] from comment #2)
> This looks like classic frame poisoning and not a security bug.
> 
> > 63.0a1-20180831100058 
> 
> That's kind of an old build. I thought these were supposed to auto-update?

Most of the reports I get are from up-to-date builds, but this one was from an older build. If someone hadn't started their ASan browser for a month and would then crash, then this would be the result, as there is no update without a browser restart.

Comment 4

[Mats Palmgren (inactive)]

Probably the same underlying issue as in bug 1490561.

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

Fixed in bug 1490561, in 63 and 64.