1634638 - AddressSanitizer: heap-use-after-free [@ nsRefreshDriver::Tick] with READ of size 8

Status: RESOLVED DUPLICATE of bug 1632755

(Core :: Graphics: WebGPU, defect)

Description

[Christian Holler (:decoder)]

The attached crash information was submitted via the ASan Nightly Reporter on mozilla-central-asan-nightly revision 77.0a1-20200427214618-https://hg.mozilla.org/mozilla-central/rev/2b0e2483e2eaaef7ac49866a98e8e857520bdd5c.

For detailed crash information, see attachment.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 3

[Dzmitry Malyshau [:kvark]]

Fairly sure this was fixed by https://phabricator.services.mozilla.com/rMOZILLACENTRAL7d6135dac2f270fa13ec7cea498b3c245de62ecc (which went in a day after the affected nightly was made).

Christian, is this still considered a security issue if it's on Nightly behind a pref the user has to turn on, enabling an experimental technology?

Comment 6

[Teal Dulcet [:tdulcet] (TB Council)]

I was wondering if this was eligible for a bug bounty, since it was flagged sec-bounty? This is my first time reporting a security issue, so I am unsure what I am supposed to do.

If it helps, the bug happened when I was running these WebGPU examples: https://austineng.github.io/webgpu-samples/, after reading this Mozilla Hacks article: https://hacks.mozilla.org/2020/04/experimental-webgpu-in-firefox/. I am happy to provide any other information you need.

Comment 7

[Andrew McCreight [:mccr8]]

(In reply to tdulcet from comment #6)

I was wondering if this was eligible for a bug bounty, since it was flagged sec-bounty? This is my first time reporting a security issue, so I am unsure what I am supposed to do.

You don't need to do anything. The bounty committee meets periodically and will decide whether or not this should receive a bounty.

Comment 8

[Daniel Veditz [:dveditz]]

This was certainly potentially eligible for a bounty, but it appears to have been a duplicate of a bug that was filed earlier and whose patch landed on the day this was filed. So unfortunately not this time, but please do keep submitting these!