Hardened browser should have a way to disable ASan
I've been hit twice recently by Address Sanitizer bugs (legacy/trac#20237 (moved), legacy/trac#19851 (moved)). It's always a huge pain to figure out what's happening, and then to work around it. I had to grab an old glibc and hack around with $LD_PRELOAD for one, screw around with ulimits for the other. And I need to boot a Tails VM to get a working browser to search for the error messages (which aren't even printed by default), and then copy/paste is difficult.
start-tor-browser should have a documented option to disable ASan. And the script shouldn't just clobber ASAN_OPTIONS if it's set, because that just complicates debugging (prepend/append your string instead).
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information