Closed Bug 2043188 (CVE-2026-16362) Opened 5 months ago Closed 3 months ago

Firefox WebRTC Encoded Transform `RTCEncodedVideoFrame.data` stale `ArrayBuffer` heap-use-after-free

Categories

(Core :: WebRTC: Audio/Video, defect)

Product:
Core
Component:
WebRTC: Audio/Video
Version:
Firefox 152
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
154 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox-esr140 153+ fixed
firefox152 --- wontfix
firefox153 + fixed
firefox154 + fixed

People

(Reporter: pwning.me, Assigned: bwc)

References

(Regression)

Details

(4 keywords, Whiteboard: [adv-main153+][adv-ESR140.13+])

Attachments

(1 file, 3 external files)

rtcencodedframe-uaf-read-imagebitmap.html
9.29 KB, text/html
Details

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36

Steps to reproduce:

RTCEncodedVideoFrame.data exposes WebRTC encoded frame storage to JavaScript as an ArrayBuffer
created with JS::NewArrayBufferWithUserOwnedContents. The JavaScript ArrayBuffer does not own this
backing store. The backing memory is owned by the WebRTC encoded frame path, specifically the
EncodedImageBuffer referenced by the transformable sender frame.

If script retains a typed array view derived from RTCEncodedVideoFrame.data, and the WebRTC sender/
frame is later torn down while native BufferSource consumers are still operating on that view, the
backing store can be released while the JavaScript view still points to it.
RTCEncodedFrameBase::~RTCEncodedFrameBase() attempts to detach the exposed ArrayBuffer, but the
return value of JS::DetachArrayBuffer is not checked. In the tested failure mode, detach can fail
because the typed array length is pinned by native code, after which the native WebRTC owner is still
released.

This was validated with ASan through two independent native consumer paths:

  • Read path: createImageBitmap(ImageData) on a worker path, reaching CropAndCopyDataSourceSurface.
  • Write path: FileSystemSyncAccessHandle.read(view), reaching
    FixedBufferOutputStream::WriteSegments.

The current evidence demonstrates ASan-confirmed heap-use-after-free READ and WRITE against the freed
WebRTC encoded frame backing store.

Actual results:

1. WebRTC buffer is exposed to JS without transferring ownership

RTCEncodedFrameBase exposes mState.mFrame->GetData().data() as an externally backed JS ArrayBuffer:

mData = JS::NewArrayBufferWithUserOwnedContents(
    jsapi.cx(),
    mState.mFrame->GetData().size(),
    (void*)(mState.mFrame->GetData().data()));

The JS ArrayBuffer does not own the underlying memory. The underlying memory belongs to the WebRTC encoded frame path.

Relevant source:

  • dom/media/webrtc/jsapi/RTCEncodedFrameBase.cpp
  • third_party/libwebrtc/modules/rtp_rtcp/source/rtp_sender_video_frame_transformer_delegate.cc

2. Destructor-time detach failure is ignored

RTCEncodedFrameBase::~RTCEncodedFrameBase() calls DetachData(), and DetachData() calls JS::DetachArrayBuffer, but the return value is not checked:

if (rootedData) {
  JS::DetachArrayBuffer(jsapi.cx(), rootedData);
}

When a native BufferSource consumer has pinned the typed array length, SpiderMonkey can reject detach with:

RangeError: attempting to change pinned length of ArrayBuffer

If detach fails, the native owner must not release the backing store while JS views or native consumers can still use it. The observed behavior violates that lifetime requirement.

Relevant source:

  • dom/media/webrtc/jsapi/RTCEncodedFrameBase.cpp
  • js/src/vm/ArrayBufferObject.cpp
  • dom/bindings/TypedArray.h

3. ImageBitmap read sink keeps using a raw pointer

The ImageData path processes a fixed typed-array span and passes the raw pointer through a worker-to-main-thread ImageBitmap task:

return array.ProcessFixedData([&](const Span<const uint8_t>& aData) {
  uint8_t* fixedData = const_cast<uint8_t*>(aData.Elements());
  ...
  RefPtr<CreateImageFromRawDataInMainThreadSyncTask> task =
      new CreateImageFromRawDataInMainThreadSyncTask(fixedData, ...);
  task->Dispatch(...);
});

The main-thread task then reaches a copy path:

CropAndCopyDataSourceSurface
CreateImageFromRawData
CreateImageFromRawDataInMainThreadSyncTask::MainThreadRun

If the WebRTC owner is released in the overlap window, that raw pointer references freed storage.

Relevant source:

  • dom/canvas/ImageBitmap.cpp

4. OPFS write sink uses the stale view as a native output buffer

FileSystemSyncAccessHandle.read(view) turns the destination BufferSource into a fixed output buffer:

return ProcessTypedArraysFixed(aBuffer, [&](const Span<uint8_t> aData) {
  ...
  outputStream = FixedBufferOutputStream::Create(AsWritableChars(aData));
  ...
  fs::AsyncCopy(inputStream, outputStream, ...);
});

FixedBufferOutputStream::WriteSegments then writes file input bytes into that destination:

nsFileStreamBase::Read
nsStreamCopierOB::FillOutputBuffer
FixedBufferOutputStream::WriteSegments

If aData points to the stale external backing store from RTCEncodedVideoFrame.data, the file read writes into freed WebRTC encoded frame memory.

Relevant source:

  • dom/fs/api/FileSystemSyncAccessHandle.cpp
  • xpcom/io/FixedBufferOutputStream.cpp
==85255==ERROR: AddressSanitizer: heap-use-after-free on address 0x62c000030200 at pc 0x000106645ae8 bp 0x00016af93c30 sp 0x00016af933e0
READ of size 4 at 0x62c000030200 thread T0
==85255==WARNING: failed to spawn external symbolizer (errno: 25)
==85255==WARNING: failed to spawn external symbolizer (errno: 25)
==85255==WARNING: failed to spawn external symbolizer (errno: 25)
==85255==WARNING: failed to spawn external symbolizer (errno: 25)
==85255==WARNING: failed to spawn external symbolizer (errno: 25)
==85255==WARNING: Failed to use and restart external symbolizer!
    #0 0x000106645ae4 in __asan_memcpy+0x3e4 (/opt/homebrew/Cellar/llvm/22.1.4/lib/clang/22/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:arm64+0x51ae4)
    #1 0x00012a735bdc in mozilla::dom::CropAndCopyDataSourceSurface(mozilla::gfx::DataSourceSurface*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)+0x3d0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x6575bdc)
    #2 0x00012a7f2af8 in mozilla::dom::CreateImageFromRawData(mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, unsigned int, mozilla::gfx::SurfaceFormat, unsigned char*, unsigned int, mozilla::Maybe<mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits>> const&, mozilla::dom::ImageBitmapOptions const&)+0x1fc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x6632af8)
    #3 0x00012a7f3a54 in mozilla::dom::CreateImageFromRawDataInMainThreadSyncTask::MainThreadRun()+0x90 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x6633a54)
    #4 0x00012e58f744 in mozilla::dom::WorkerMainThreadRunnable::Run()+0x4c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa3cf744)
    #5 0x000125ca6c1c in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable()+0x2b0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ae6c1c)
    #6 0x000125c9d87c in mozilla::ThrottledEventQueue::Inner::Executor::Run()+0x28 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1add87c)
    #7 0x000125c4a864 in mozilla::RunnableTask::Run()+0x54 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a8a864)
    #8 0x000125c3e80c in mozilla::TaskController::RunTask(mozilla::Task*)+0x1a4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a7e80c)
    #9 0x000125c45edc in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)+0xdd0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a85edc)
    #10 0x000125c43a1c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)+0xd4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a83a1c)
    #11 0x000125c5bbfc in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run()+0xcc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a9bbfc)
    #12 0x000125c7fbc4 in nsThread::ProcessNextEvent(bool, bool*)+0x7bc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1abfbc4)
    #13 0x000125c89258 in NS_ProcessNextEvent(nsIThread*, bool)+0x108 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ac9258)
    #14 0x000125e93b58 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)+0x150 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1cd3b58)
    #15 0x000125d94c14 in MessageLoop::Run()+0x150 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1bd4c14)
    #16 0x00012f13f6cc in nsBaseAppShell::Run()+0x68 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xaf7f6cc)
    #17 0x00012f236964 in nsAppShell::Run()+0x3c0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xb076964)
    #18 0x0001314237a4 in XRE_RunAppShell()+0x21c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xd2637a4)
    #19 0x000125d94c14 in MessageLoop::Run()+0x150 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1bd4c14)
    #20 0x000131420f04 in XRE_InitChildProcess(int, char**, XREChildData const*)+0x135c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xd260f04)
    #21 0x000104e68b3c in main+0x1bc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container:arm64+0x100000b3c)
    #22 0x000189fa3da0 in start+0x1b4c (/usr/lib/dyld:arm64e+0x1fda0)

0x62c000030200 is located 0 bytes inside of 30541-byte region [0x62c000030200,0x62c00003794d)
freed by thread T22 here:
    #0 0x000106648f10 in free+0x74 (/opt/homebrew/Cellar/llvm/22.1.4/lib/clang/22/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:arm64+0x54f10)
    #1 0x00012cf1db68 in webrtc::RefCountedObject<webrtc::EncodedImageBuffer>::~RefCountedObject()+0x54 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8d5db68)
    #2 0x00012cf1da60 in webrtc::RefCountedObject<webrtc::EncodedImageBuffer>::Release() const+0x6c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8d5da60)
    #3 0x00012d39d0c8 in webrtc::TransformableVideoSenderFrame::~TransformableVideoSenderFrame()+0x14c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x91dd0c8)
    #4 0x00012d39c24c in webrtc::TransformableVideoSenderFrame::~TransformableVideoSenderFrame()+0x8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x91dc24c)
    #5 0x00012cb80380 in mozilla::dom::RTCEncodedVideoFrame::~RTCEncodedVideoFrame()+0x1d4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x89c0380)
    #6 0x00012cb51fdc in mozilla::dom::RTCEncodedVideoFrame::~RTCEncodedVideoFrame()+0x8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8991fdc)
    #7 0x000125ac6d88 in SnowWhiteKiller::~SnowWhiteKiller()+0x27c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1906d88)
    #8 0x000125aaa5fc in nsCycleCollector::FreeSnowWhite(bool)+0x3f0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x18ea5fc)
    #9 0x000125ab4430 in nsCycleCollector::BeginCollection(mozilla::CCReason, ccIsManual, nsICycleCollectorListener*)+0x5e8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x18f4430)
    #10 0x000125ab3108 in nsCycleCollector::Collect(mozilla::CCReason, ccIsManual, JS::SliceBudget&, nsICycleCollectorListener*, bool)+0x638 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x18f3108)
    #11 0x000125ab7ff4 in nsCycleCollector_collect(mozilla::CCReason, nsICycleCollectorListener*)+0x218 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x18f7ff4)
    #12 0x00012e5396b8 in mozilla::dom::workerinternals::(anonymous namespace)::WorkerJSRuntime::CustomGCCallback(JSGCStatus)+0x44 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa3796b8)
    #13 0x000131d12d00 in js::gc::GCRuntime::maybeCallGCCallback(JSGCStatus, JS::GCReason)+0x210 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xdb52d00)
    #14 0x000131d13ae0 in js::gc::GCRuntime::gcCycle(bool, JS::SliceBudget const&, JS::GCReason)+0xa70 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xdb53ae0)
    #15 0x000131d150a0 in js::gc::GCRuntime::collect(bool, JS::SliceBudget const&, JS::GCReason)+0x3dc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xdb550a0)
    #16 0x000131cfa7a0 in js::gc::GCRuntime::gcIfRequestedImpl(bool)+0x580 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xdb3a7a0)
    #17 0x00012e57c6dc in mozilla::dom::WorkerPrivate::RunCurrentSyncLoop()+0x7e4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa3bc6dc)
    #18 0x00012e552fc8 in mozilla::dom::WorkerMainThreadRunnable::Dispatch(mozilla::dom::WorkerPrivate*, mozilla::dom::WorkerStatus, mozilla::ErrorResult&)+0x544 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa392fc8)
    #19 0x00012a73a370 in mozilla::dom::ImageBitmap::CreateInternal(nsIGlobalObject*, mozilla::dom::ImageData&, mozilla::Maybe<mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits>> const&, mozilla::dom::ImageBitmapOptions const&, mozilla::ErrorResult&)+0x7a4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x657a370)
    #20 0x00012a73ca2c in mozilla::dom::ImageBitmap::Create(nsIGlobalObject*, mozilla::dom::HTMLImageElementOrSVGImageElementOrHTMLCanvasElementOrHTMLVideoElementOrOffscreenCanvasOrImageBitmapOrVideoFrameOrBlobOrCanvasRenderingContext2DOrImageData const&, mozilla::Maybe<mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits>> const&, mozilla::dom::ImageBitmapOptions const&, mozilla::ErrorResult&)+0x3dc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x657ca2c)
    #21 0x00012e5993b4 in mozilla::dom::WorkerGlobalScope::CreateImageBitmap(mozilla::dom::HTMLImageElementOrSVGImageElementOrHTMLCanvasElementOrHTMLVideoElementOrOffscreenCanvasOrImageBitmapOrVideoFrameOrBlobOrCanvasRenderingContext2DOrImageData const&, mozilla::dom::ImageBitmapOptions const&, mozilla::ErrorResult&)+0xf0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa3d93b4)
    #22 0x000129df5a74 in mozilla::dom::WorkerGlobalScope_Binding::createImageBitmap_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)+0x234 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x5c35a74)
    #23 0x00012a4beaa4 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*)+0x354 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x62feaa4)
    #24 0x1d116b69034c  (<unknown module>)
    #25 0x1d116b691ea4  (<unknown module>)
    #26 0x1d116b691504  (<unknown module>)
    #27 0x1d116b66059c  (<unknown module>)
    #28 0x0001328c7b28 in js::jit::MaybeEnterJit(JSContext*, js::RunState&)+0x5e4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe707b28)
    #29 0x000132a7a310 in js::RunScript(JSContext*, js::RunState&)+0x22c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8ba310)
    #30 0x000132a7b668 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)+0x858 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8bb668)
    #31 0x000132a7cb20 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)+0x1dc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8bcb20)
    #32 0x000132b897d8 in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)+0x234 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe9c97d8)
    #33 0x000132ad4d08 in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>)+0x3cc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe914d08)
    #34 0x000131746b98 in JS::RunJSMicroTask(JSContext*, JS::Handle<JSObject*>)+0xe04 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xd586b98)
    #35 0x000125a5c224 in mozilla::RunMicroTask(JSContext*, mozilla::CycleCollectedJSContext*, JS::MutableHandle<mozilla::MustConsumeMicroTask>, bool)+0x878 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x189c224)
    #36 0x000125a57880 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool)+0x530 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1897880)
    #37 0x000125a58b88 in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int)+0x28 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1898b88)
    #38 0x000125c80284 in nsThread::ProcessNextEvent(bool, bool*)+0xe7c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ac0284)
    #39 0x000125c89258 in NS_ProcessNextEvent(nsIThread*, bool)+0x108 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ac9258)
    #40 0x00012e56f588 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*)+0x11d8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa3af588)
    #41 0x00012e537c60 in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run()+0x770 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa377c60)
    #42 0x000125c7fdf0 in nsThread::ProcessNextEvent(bool, bool*)+0x9e8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1abfdf0)
    #43 0x000125c89258 in NS_ProcessNextEvent(nsIThread*, bool)+0x108 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ac9258)
    #44 0x000125e94d04 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)+0x17c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1cd4d04)
    #45 0x000125d94c14 in MessageLoop::Run()+0x150 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1bd4c14)
    #46 0x000125c79024 in nsThread::ThreadFunc(void*)+0x2a4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ab9024)
    #47 0x0001061003b4 in _pt_root+0x370 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/libnss3.dylib:arm64+0x45c3b4)
    #48 0x0001066456d4 in asan_thread_start(void*)+0x48 (/opt/homebrew/Cellar/llvm/22.1.4/lib/clang/22/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:arm64+0x516d4)
    #49 0x00018a35fc54 in _pthread_start+0x84 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x6c54)

previously allocated by thread T40 here:
    #0 0x000106648e24 in malloc+0x70 (/opt/homebrew/Cellar/llvm/22.1.4/lib/clang/22/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:arm64+0x54e24)
    #1 0x000104fe4d60 in moz_xmalloc+0x10 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/libmozglue.dylib:arm64+0xd60)
    #2 0x00012cf1b064 in webrtc::EncodedImageBuffer::Create(unsigned long)+0x60 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8d5b064)
    #3 0x00012d479940 in webrtc::LibvpxVp8Encoder::GetEncodedPartitions(webrtc::VideoFrame const&, bool)+0x4a4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x92b9940)
    #4 0x00012d4755c0 in webrtc::LibvpxVp8Encoder::Encode(webrtc::VideoFrame const&, std::__1::vector<webrtc::VideoFrameType, std::__1::allocator<webrtc::VideoFrameType>> const*)+0x168c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x92b55c0)
    #5 0x00012d05c248 in webrtc::SimulcastEncoderAdapter::StreamContext::Encode(webrtc::VideoFrame const&, std::__1::vector<webrtc::VideoFrameType, std::__1::allocator<webrtc::VideoFrameType>> const*)+0x1f4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8e9c248)
    #6 0x00012d063168 in webrtc::SimulcastEncoderAdapter::Encode(webrtc::VideoFrame const&, std::__1::vector<webrtc::VideoFrameType, std::__1::allocator<webrtc::VideoFrameType>> const*)+0x13f8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8ea3168)
    #7 0x00012d656878 in webrtc::VideoStreamEncoder::EncodeVideoFrame(webrtc::VideoFrame const&, long long)+0x120c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x9496878)
    #8 0x00012d6545b0 in webrtc::VideoStreamEncoder::MaybeEncodeVideoFrame(webrtc::VideoFrame const&, long long)+0x1254 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x94945b0)
    #9 0x00012d641dfc in webrtc::VideoStreamEncoder::OnFramePrepared(unsigned long)+0x420 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x9481dfc)
    #10 0x00012d6419bc in webrtc::VideoStreamEncoder::PreparedFramesProcessor::OnFramePrepared(unsigned long)+0x48 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x94819bc)
    #11 0x00012d652ed8 in webrtc::VideoStreamEncoder::MaybePrepareVideoFrame(webrtc::VideoFrame const&, long long)+0x524 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x9492ed8)
    #12 0x00012d6524e8 in webrtc::VideoStreamEncoder::OnFrame(webrtc::Timestamp, bool, webrtc::VideoFrame const&)+0x698 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x94924e8)
    #13 0x00012d5b4d20 in void absl::internal_any_invocable::RemoteInvoker<false, void, webrtc::(anonymous namespace)::FrameCadenceAdapterImpl::OnFrame(webrtc::VideoFrame const&)::$_0&&>(absl::internal_any_invocable::TypeErasedState*)+0xd0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x93f4d20)
    #14 0x00012cdb0edc in mozilla::InvocableRunnable::Run()+0x2c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8bf0edc)
    #15 0x000125c63320 in mozilla::TaskQueue::Runner::Run()+0x258 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1aa3320)
    #16 0x000125c8cf58 in nsThreadPool::Run()+0x6b8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1accf58)
    #17 0x000125c7fdf0 in nsThread::ProcessNextEvent(bool, bool*)+0x9e8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1abfdf0)
    #18 0x000125c89258 in NS_ProcessNextEvent(nsIThread*, bool)+0x108 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ac9258)
    #19 0x000125e94d04 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)+0x17c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1cd4d04)
    #20 0x000125d94c14 in MessageLoop::Run()+0x150 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1bd4c14)
    #21 0x000125c79024 in nsThread::ThreadFunc(void*)+0x2a4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ab9024)
    #22 0x0001061003b4 in _pt_root+0x370 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/libnss3.dylib:arm64+0x45c3b4)
    #23 0x0001066456d4 in asan_thread_start(void*)+0x48 (/opt/homebrew/Cellar/llvm/22.1.4/lib/clang/22/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:arm64+0x516d4)
    #24 0x00018a35fc54 in _pthread_start+0x84 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x6c54)
    #25 0x00018a35ac18 in thread_start+0x4 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x1c18)

Thread T22 created by T0 here:
    #0 0x00010663f7bc in pthread_create+0x58 (/opt/homebrew/Cellar/llvm/22.1.4/lib/clang/22/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4b7bc)
    #1 0x0001060f1d2c in _PR_CreateThread+0x438 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/libnss3.dylib:arm64+0x44dd2c)
    #2 0x000125c7b544 in nsThread::Init(nsTSubstring<char> const&)+0x1d4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1abb544)
    #3 0x00012e5a3864 in mozilla::dom::WorkerThread::Create(mozilla::dom::WorkerThreadFriendKey const&)+0xdc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa3e3864)
    #4 0x00012e511028 in mozilla::dom::workerinternals::RuntimeService::ScheduleWorker(mozilla::dom::WorkerPrivate&)+0xd4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa351028)
    #5 0x00012e50f0ec in mozilla::dom::workerinternals::RuntimeService::RegisterWorker(mozilla::dom::WorkerPrivate&)+0xbf4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa34f0ec)
    #6 0x00012e56864c in mozilla::dom::WorkerPrivate::Constructor(JSContext*, nsTSubstring<char16_t> const&, bool, mozilla::dom::WorkerKind, mozilla::dom::RequestCredentials, mozilla::dom::WorkerType, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::WorkerLoadInfo*, mozilla::ErrorResult&, nsTString<char16_t>, std::__1::function<void (bool)>&&, std::__1::function<void ()>&&, mozilla::ipc::Endpoint<mozilla::dom::PRemoteWorkerNonLifeCycleOpControllerChild>&&)+0x3a4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa3a864c)
    #7 0x00012e5262c0 in mozilla::dom::Worker::Constructor(mozilla::dom::GlobalObject const&, mozilla::dom::TrustedScriptURLOrUSVString const&, mozilla::dom::WorkerOptions const&, mozilla::ErrorResult&)+0x47c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa3662c0)
    #8 0x000129de69f0 in mozilla::dom::Worker_Binding::_constructor(JSContext*, unsigned int, JS::Value*)+0x388 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x5c269f0)
    #9 0x000132a7d930 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason)+0x8dc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8bd930)
    #10 0x000132a8fe98 in js::Interpret(JSContext*, js::RunState&)+0xca50 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8cfe98)
    #11 0x000132a7a554 in js::RunScript(JSContext*, js::RunState&)+0x470 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8ba554)
    #12 0x000132a7eecc in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>)+0x390 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8beecc)
    #13 0x000132d9c8e8 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>)+0x18c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xebdc8e8)
    #14 0x000132d9cb60 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>)+0x190 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xebdcb60)
    #15 0x00012ec7d99c in mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*)+0x6cc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xaabd99c)
    #16 0x00012ec7c3f4 in mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*)+0x7dc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xaabc3f4)
    #17 0x00012ec75bf8 in mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*)+0x59c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xaab5bf8)
    #18 0x00012ec72648 in mozilla::dom::ScriptLoader::ProcessInlineScript(nsIScriptElement*, JS::loader::ScriptKind, nsTSubstring<char16_t> const&)+0x11d4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xaab2648)
    #19 0x00012ec59108 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*, nsTSubstring<char16_t> const&)+0x244 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xaa99108)
    #20 0x00012ec58404 in mozilla::dom::ScriptElement::MaybeProcessScript(nsTSubstring<char16_t> const&)+0x62c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xaa98404)
    #21 0x00012ec57ae0 in mozilla::dom::ScriptElement::MaybeProcessScript(nsCOMPtr<nsIParser>)+0x1ac (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xaa97ae0)
    #22 0x00012ec924d0 in nsIScriptElement::AttemptToExecute(nsCOMPtr<nsIParser>)+0x140 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xaad24d0)
    #23 0x000126633930 in nsHtml5TreeOpExecutor::RunScript(nsIContent*, bool)+0x1a0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x2473930)
    #24 0x00012662ee74 in nsHtml5TreeOpExecutor::RunFlushLoop()+0x848 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x246ee74)
    #25 0x000126638fec in nsHtml5ExecutorFlusher::Run()+0x254 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x2478fec)
    #26 0x000125c4a864 in mozilla::RunnableTask::Run()+0x54 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a8a864)
    #27 0x000125c3e80c in mozilla::TaskController::RunTask(mozilla::Task*)+0x1a4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a7e80c)
    #28 0x000125c45edc in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)+0xdd0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a85edc)
    #29 0x000125c43a1c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)+0xd4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a83a1c)
    #30 0x000125c5bbfc in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run()+0xcc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a9bbfc)
    #31 0x000125c7fbc4 in nsThread::ProcessNextEvent(bool, bool*)+0x7bc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1abfbc4)
    #32 0x000125c89258 in NS_ProcessNextEvent(nsIThread*, bool)+0x108 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ac9258)
    #33 0x000125e93b58 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)+0x150 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1cd3b58)
    #34 0x000125d94c14 in MessageLoop::Run()+0x150 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1bd4c14)
    #35 0x00012f13f6cc in nsBaseAppShell::Run()+0x68 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xaf7f6cc)
    #36 0x00012f236964 in nsAppShell::Run()+0x3c0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xb076964)
    #37 0x0001314237a4 in XRE_RunAppShell()+0x21c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xd2637a4)
    #38 0x000125d94c14 in MessageLoop::Run()+0x150 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1bd4c14)
    #39 0x000131420f04 in XRE_InitChildProcess(int, char**, XREChildData const*)+0x135c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xd260f04)
    #40 0x000104e68b3c in main+0x1bc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container:arm64+0x100000b3c)
    #41 0x000189fa3da0 in start+0x1b4c (/usr/lib/dyld:arm64e+0x1fda0)

Thread T40 created by T0 here:
    #0 0x00010663f7bc in pthread_create+0x58 (/opt/homebrew/Cellar/llvm/22.1.4/lib/clang/22/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4b7bc)
    #1 0x0001060f1d2c in _PR_CreateThread+0x438 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/libnss3.dylib:arm64+0x44dd2c)
    #2 0x000125c7b544 in nsThread::Init(nsTSubstring<char> const&)+0x1d4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1abb544)
    #3 0x000125c874d4 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**)+0x3f4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ac74d4)
    #4 0x000125c94df8 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions)+0x90 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ad4df8)
    #5 0x000125c8ba5c in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>, nsIEventTarget::DispatchFlags, mozilla::detail::BaseAutoLock<mozilla::Mutex&>&)+0x4c4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1acba5c)
    #6 0x000125c8e540 in non-virtual thunk to nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>, nsIEventTarget::DispatchFlags)+0xdc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ace540)
    #7 0x000125c61054 in mozilla::TaskQueue::DispatchLocked(nsCOMPtr<nsIRunnable>&, nsIEventTarget::DispatchFlags, mozilla::AbstractThread::DispatchReason)+0x588 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1aa1054)
    #8 0x000125c9d63c in mozilla::TaskQueue::Dispatch(already_AddRefed<nsIRunnable>, nsIEventTarget::DispatchFlags)+0x44 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1add63c)
    #9 0x00012cea58f0 in mozilla::VideoFrameConverterImpl<(mozilla::FrameDroppingPolicy)0>::SetIdleFrameDuplicationInterval(mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>)+0x17c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8ce58f0)
    #10 0x00012cea51b8 in mozilla::MediaPipelineTransmit::RegisterListener()+0x228 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8ce51b8)
    #11 0x00012cea5c00 in mozilla::MediaPipelineTransmit::Create(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, RefPtr<mozilla::MediaTransportHandler>, RefPtr<mozilla::AbstractThread>, RefPtr<nsISerialEventTarget>, bool, RefPtr<mozilla::MediaSessionConduit>)+0x1ec (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8ce5c00)
    #12 0x00012cc4f98c in mozilla::dom::RTCRtpSender::RTCRtpSender(nsPIDOMWindowInner*, mozilla::PeerConnectionImpl*, mozilla::MediaTransportHandler*, mozilla::AbstractThread*, nsISerialEventTarget*, mozilla::MediaSessionConduit*, mozilla::dom::MediaStreamTrack*, mozilla::dom::Sequence<mozilla::dom::RTCRtpEncodingParameters> const&, mozilla::dom::RTCRtpTransceiver*)+0xaf0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8a8f98c)
    #13 0x00012cc72034 in mozilla::dom::RTCRtpTransceiver::Init(mozilla::dom::RTCRtpTransceiverInit const&, mozilla::ErrorResult&)+0x334 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x8ab2034)
    #14 0x00012cafbc74 in mozilla::PeerConnectionImpl::CreateTransceiver(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, bool, mozilla::dom::RTCRtpTransceiverInit const&, mozilla::dom::MediaStreamTrack*, bool, mozilla::ErrorResult&)+0x720 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x893bc74)
    #15 0x00012caf93dc in mozilla::PeerConnectionImpl::AddTransceiver(mozilla::dom::RTCRtpTransceiverInit const&, nsTSubstring<char16_t> const&, mozilla::dom::MediaStreamTrack*, bool, mozilla::ErrorResult&)+0x8f4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x89393dc)
    #16 0x0001292d13d8 in mozilla::dom::PeerConnectionImpl_Binding::addTransceiver(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)+0x578 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x51113d8)
    #17 0x00012a4bd1f4 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)+0x2b0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x62fd1f4)
    #18 0x000132a7b554 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)+0x744 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8bb554)
    #19 0x000132a8fed8 in js::Interpret(JSContext*, js::RunState&)+0xca90 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8cfed8)
    #20 0x000132a7a554 in js::RunScript(JSContext*, js::RunState&)+0x470 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8ba554)
    #21 0x000132a7b668 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)+0x858 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8bb668)
    #22 0x000132a7cb20 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)+0x1dc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8bcb20)
    #23 0x000132d6bcc0 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)+0x260 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xebabcc0)
    #24 0x0001294ab6b0 in mozilla::dom::RTCPeerConnectionJSImpl::AddTrack(mozilla::dom::MediaStreamTrack&, nsTArray<mozilla::OwningNonNull<mozilla::DOMMediaStream>> const&, mozilla::ErrorResult&, JS::Realm*)+0x6b8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x52eb6b0)
    #25 0x00012954aad4 in mozilla::dom::RTCPeerConnection_Binding::addTrack(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)+0xa9c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x538aad4)
    #26 0x00012a4bd1f4 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)+0x2b0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x62fd1f4)
    #27 0x000132a7b554 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)+0x744 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8bb554)
    #28 0x000132a8fed8 in js::Interpret(JSContext*, js::RunState&)+0xca90 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8cfed8)
    #29 0x000132a7a554 in js::RunScript(JSContext*, js::RunState&)+0x470 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8ba554)
    #30 0x000132a7b668 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)+0x858 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8bb668)
    #31 0x000132a7cb20 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)+0x1dc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xe8bcb20)
    #32 0x000132d6bcc0 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)+0x260 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xebabcc0)
    #33 0x00012a241bac in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)+0x3b4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x6081bac)
    #34 0x00012b223bd0 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*)+0x174 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x7063bd0)
    #35 0x00012b222b18 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)+0x4e4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x7062b18)
    #36 0x00012b1dbc9c in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool)+0x2f0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x701bc9c)
    #37 0x00012b1ddf68 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool)+0x4c8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x701df68)
    #38 0x00012b1dcd24 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)+0x350 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x701cd24)
    #39 0x00012b1c57a0 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)+0xd8c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x70057a0)
    #40 0x00012b1cae68 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)+0x292c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x700ae68)
    #41 0x00012b16a764 in mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)+0xdc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x6faa764)
    #42 0x00012b1ebdac in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&)+0xf8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x702bdac)
    #43 0x00012e50bdf8 in mozilla::dom::MessageEventToParentRunnable::DispatchDOMEvent(JSContext*, mozilla::dom::WorkerPrivate*, RefPtr<mozilla::DOMEventTargetHelper>, bool)+0x65c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa34bdf8)
    #44 0x00012e50c6c4 in mozilla::dom::MessageEventToParentRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*)+0xd8 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa34c6c4)
    #45 0x00012e58c984 in mozilla::dom::WorkerParentThreadRunnable::Run()+0x38c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xa3cc984)
    #46 0x000125ca6c1c in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable()+0x2b0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ae6c1c)
    #47 0x000125c9d87c in mozilla::ThrottledEventQueue::Inner::Executor::Run()+0x28 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1add87c)
    #48 0x000125ca6c1c in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable()+0x2b0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ae6c1c)
    #49 0x000125c9d87c in mozilla::ThrottledEventQueue::Inner::Executor::Run()+0x28 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1add87c)
    #50 0x000125c4a864 in mozilla::RunnableTask::Run()+0x54 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a8a864)
    #51 0x000125c3e80c in mozilla::TaskController::RunTask(mozilla::Task*)+0x1a4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a7e80c)
    #52 0x000125c45edc in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)+0xdd0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a85edc)
    #53 0x000125c43a1c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)+0xd4 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a83a1c)
    #54 0x000125c44020 in mozilla::TaskController::ProcessPendingMTTask(bool)+0xdc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a84020)
    #55 0x000125c5bda0 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run()+0x14 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1a9bda0)
    #56 0x000125c7fbc4 in nsThread::ProcessNextEvent(bool, bool*)+0x7bc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1abfbc4)
    #57 0x000125c89258 in NS_ProcessNextEvent(nsIThread*, bool)+0x108 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1ac9258)
    #58 0x000125e93c7c in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)+0x274 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1cd3c7c)
    #59 0x000125d94c14 in MessageLoop::Run()+0x150 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1bd4c14)
    #60 0x00012f13f6cc in nsBaseAppShell::Run()+0x68 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xaf7f6cc)
    #61 0x00012f236964 in nsAppShell::Run()+0x3c0 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xb076964)
    #62 0x0001314237a4 in XRE_RunAppShell()+0x21c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xd2637a4)
    #63 0x000125d94c14 in MessageLoop::Run()+0x150 (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x1bd4c14)
    #64 0x000131420f04 in XRE_InitChildProcess(int, char**, XREChildData const*)+0x135c (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0xd260f04)
    #65 0x000104e68b3c in main+0x1bc (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container:arm64+0x100000b3c)
    #66 0x000189fa3da0 in start+0x1b4c (/usr/lib/dyld:arm64e+0x1fda0)

SUMMARY: AddressSanitizer: heap-use-after-free (/Users/roastbeatz/workspace/firefox/out/asan-release-dbgsyms-llvm22/dist/Nightly.app/Contents/MacOS/XUL:arm64+0x6575bdc) in mozilla::dom::CropAndCopyDataSourceSurface(mozilla::gfx::DataSourceSurface*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)+0x3d0
Shadow bytes around the buggy address:
  0x62c00002ff80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x62c000030000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x62c000030080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x62c000030100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x62c000030180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x62c000030200:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62c000030280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62c000030300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62c000030380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62c000030400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x62c000030480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==85255==ABORTING
A content process crashed and MOZ_CRASHREPORTER_SHUTDOWN is set, shutting down
[Parent 85022, IPC I/O Parent] WARNING: process 85255 exited on signal 6: file ipc/chromium/src/chrome/common/process_watcher_posix_sigchld.cc:161

exit_status=245
Group: core-security → media-core-security
Keywords: csectype-uaf, reporter-external
Keywords: sec-high

The severity field is not set for this bug.
:jib, could you have a look please?

For more information, please visit BugBot documentation.

Flags: needinfo?(jib)
Duplicate of this bug: 2044626

We seem to be the only actual user of JS::NewArrayBufferWithUserOwnedContents if searchfox is to be believed, so at this point I'm leaning toward copying regardless of whether the detach can be forced, or ownership can be transferred. This seems like too much of a footgun.

Assignee: nobody → docfaraday
Attached file (secure) —
Flags: sec-bounty?

Hey Byron, do you have everything you need to land this? Jib just r+'d your patch.
(With JimM on PTO, I'm "stunt JimM" this week. :-) ) Thanks!

Severity: -- → S2
Flags: needinfo?(jib) → needinfo?(docfaraday)
Keywords: regression
Regressed by: 1631263

This seems likely to require custom backports to several branches since the code has undergone several recent changes, so it might be best to have Byron look it over on Monday.

Duplicate of this bug: 2050851

I'm back from vacation today, and will try to get this landed today.

Flags: needinfo?(docfaraday)
Duplicate of this bug: 2050956

Comment on attachment 9595788 [details]
(secure)

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: Maybe not too hard, but we're not painting a bullseye on the issue. At first glance it looks like simplification.
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
  • Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: Everything except esr 115, probably
  • If not all supported branches, which bug introduced the flaw?: Bug 1631263
  • Do you have backports for the affected branches?: No
  • If not, how different, hard to create, and risky will they be?: Probably not terribly difficult.
  • How likely is this patch to cause regressions; how much testing does it need?: Not super likely.
  • Is the patch ready to land after security approval is given?: Yes
  • Is Android affected?: Yes
Attachment #9595788 - Flags: sec-approval?

Patch applies cleanly to release, and probably also beta. Making sure it builds.

Does not cleanly apply to esr140. Running a patch through its paces.

The bug has a release status flag that shows some version of Firefox is affected, thus it will be considered confirmed.

Status: UNCONFIRMED → NEW
Ever confirmed: true

I'm not totally clear what "tracking-firefox-esr140: --- → 153+" means; does that mean we will not be doing an esr140 uplift?

Flags: needinfo?(dmeehan)

(In reply to Byron Campen [:bwc] from comment #14)

I'm not totally clear what "tracking-firefox-esr140: --- → 153+" means; does that mean we will not be doing an esr140 uplift?

It means we will do an ESR140 uplift for the ESR140 that ships alongside 153.0

Flags: needinfo?(dmeehan)

Ok, gotcha, I'll make a patch for 140 then.

Attached file (secure) —
Attachment #9605271 - Flags: approval-mozilla-esr140?

Comment on attachment 9595788 [details]
(secure)

Not a parent process exploit.

Attachment #9595788 - Flags: sec-approval?

https://hg.mozilla.org/mozilla-central/rev/ce6e012f8850

Group: media-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 3 months ago
status-firefox154: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 154 Branch

The patch landed in nightly and beta is affected.
:bwc, is this bug important enough to require an uplift?

For more information, please visit BugBot documentation.

Flags: needinfo?(docfaraday)

Beta uplift requested.

Flags: needinfo?(docfaraday)

firefox-beta Uplift Approval Request

  • User impact if declined/Reason for urgency: Sec bug
  • Code covered by automated testing?: yes
  • Fix verified in Nightly?: yes
  • Needs manual QE testing?: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: We are using a simpler/safer API here.
  • String changes made/needed?: None.
  • Is Android affected?: yes
Attachment #9605678 - Flags: approval-mozilla-beta?
Attached file (secure) —

Original Revision: https://phabricator.services.mozilla.com/D305725

Attachment #9605678 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attachment #9605271 - Flags: approval-mozilla-esr140? → approval-mozilla-esr140+
QA Whiteboard: [sec] [qa-triage-done-c154/b153]
Whiteboard: [adv-main153+][adv-ESR140.13+]
Alias: CVE-2026-16362
Depends on: 2060920
Flags: sec-bounty? → sec-bounty+
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: