#Summary heap-use-after-free cc\tiles\gpu_image_decode_cache.cc:2469 in cc::GpuImageDecodeCache::DecodeImageIfNecessary

#Reproduce asan-win32-release_x64-1353186 This issue occurred unintentionally while I was browsing a normal page. I attempted some analysis to identify the root cause of the vulnerability, but ultimately, I was unable to reproduce it. I will share some of the work I did during this process.

#Analysis ImageData is a RefCountedThreadSafe object. The GetTaskForImageAndRefInternal function calls CreateImageData to create a new ImageData object, which is then stored in both the PersistentCache[2] and InUseCacheKey[3].

The InUseCacheKey reference count is decreased by the UnrefImage call from the Compositor thread. Meanwhile, the PersistentCache reference count is decreased during memory pressure in the ThreadPoolForegroundWorker thread when DecodeImageIfNecessary calls GpuImageDecodeCache::ClearCache.

Both UnrefImage in the Compositor thread and DecodeImageIfNecessary in the ThreadPoolForegroundWorker thread acquire base::AutoLock lock(lock_);. The DecodeImageIfNecessary function receives ImageData* image_data[6] as a raw pointer without increasing the reference count. Within this function, base::AutoUnlock unlock(lock_)[7] is used to temporarily release the lock.

Thus, there’s a potential timing issue where the ThreadPoolForegroundWorker thread releases the lock in DecodeImageIfNecessary and calls ClearCache, reducing the reference count in PersistentCache. At this point, the Compositor thread might execute UnrefImage, which further reduces the reference count through UnrefImageInternal, potentially freeing the image_data memory.

Subsequently, when the ThreadPoolForegroundWorker thread resumes execution of the remaining code in DecodeImageIfNecessary, it can lead to a use-after-free (UAF). This was identified as a possible root cause based on crash ASAN logs and my debugging analysis.

During my analysis, I confirmed that UnrefImage and ClearCache can indeed decrease the image_data reference count from different threads. However, I was unable to reproduce the issue by getting UnrefImage to execute immediately after ClearCache in DecodeImageIfNecessary.

[1] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=1310 [2] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=1397 [3] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=1401 [4] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2151 [5] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2425 [6] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2359 [7] https://source.chromium.org/chromium/chromium/src/+/main:cc/tiles/gpu_image_decode_cache.cc;drc=a150b50c0ff706af12c449c7fccd3cf2745e2061;l=2407

#Asan

==1472==ERROR: AddressSanitizer: heap-use-after-free on address 0x11fe92769910 at pc 0x7ffd6dc08248 bp 0x003a3b5fe960 sp 0x003a3b5fe9a8 READ of size 8 at 0x11fe92769910 thread T4 #0 0x7ffd6dc08247 in cc::GpuImageDecodeCache::DecodeImageIfNecessary C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2469 #1 0x7ffd6dbf699b in cc::GpuImageDecodeCache::DecodeImageAndGenerateDarkModeFilterIfNecessary C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2351 #2 0x7ffd6dc000e9 in cc::GpuImageDecodeCache::DecodeImageInTask C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1939 #3 0x7ffd6dc17e1c in cc::GpuImageDecodeTaskImpl::RunOnWorkerThread C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:616 #4 0x7ffd76f7bc26 in cc::ImageController::ProcessNextImageDecodeOnWorkerThread C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:309 #5 0x7ffd76f7d517 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(cc::ImageController::WorkerState *),cc::ImageController::WorkerState >,base::internal::BindState<0,1,0,void ()(cc::ImageController::WorkerState *),base::internal::UnretainedWrappercc::ImageController::WorkerState,base::unretained_traits::MayNotDangle,0 >,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:980 #6 0x7ffd682757a0 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:203 #7 0x7ffd713ecb2a in base::internal::TaskTracker::RunContinueOnShutdown C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:655 #8 0x7ffd713ec169 in base::internal::TaskTracker::RunTask C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:521 #9 0x7ffd713eb23e in base::internal::TaskTracker::RunAndPopNextTask C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:416 #10 0x7ffd76730c24 in base::internal::WorkerThread::RunWorker C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:493 #11 0x7ffd7672fa2f in base::internal::WorkerThread::RunPooledWorker C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:379 #12 0x7ffd6819ce45 in base::`anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:131 #13 0x7ff73039533d in asan_thread_start C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:147 #14 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #15 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27)

0x11fe92769910 is located 656 bytes inside of 1232-byte region [0x11fe92769680,0x11fe92769b50) freed by thread T9 here: #0 0x7ff7303a181d in free C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win.cpp:82 #1 0x7ffd6dbf4d93 in cc::GpuImageDecodeCache::UnrefImageInternal C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2151 #2 0x7ffd6dbf4911 in cc::GpuImageDecodeCache::UnrefImage C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1441 #3 0x7ffd76f7ae15 in cc::ImageController::UnlockImageDecode C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:261 #4 0x7ffd723cb24d in std::__Cr::__destroy_at<std::__Cr::pair<int,std::__Cr::unique_ptr<cc::DecodedImageTracker::ImageLock,std::__Cr::default_deletecc::DecodedImageTracker::ImageLock > >,0> C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include__memory\construct_at.h:67 #5 0x7ffd723c8d5b in cc::DecodedImageTracker::UnlockAllImages C:\b\s\w\ir\cache\builder\src\cc\tiles\decoded_image_tracker.cc:62 #6 0x7ffd6dc8362c in cc::LayerTreeHostImpl::SetVisible C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host_impl.cc:3822 #7 0x7ffd72306d4b in cc::ProxyImpl::SetVisibleOnImpl C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:274 #8 0x7ffd6dc3ea88 in base::internal::Invoker<base::internal::FunctorTraits<void (cc::ProxyImpl::*&&)(bool),cc::ProxyImpl ,bool &&>,base::internal::BindState<1,1,0,void (cc::ProxyImpl::)(bool),base::internal::UnretainedWrappercc::ProxyImpl,base::unretained_traits::MayNotDangle,0,bool>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:980 #9 0x7ffd682757a0 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:203 #10 0x7ffd6c9bedcd in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:470 #11 0x7ffd6c9bdb79 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:332 #12 0x7ffd6ca025ce in base::MessagePumpDefault::Run C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:40 #13 0x7ffd6c9c0a9f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:640 #14 0x7ffd682cf96e in base::RunLoop::Run C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134 #15 0x7ffd65bc4ef9 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\scheduler\worker\non_main_thread_impl.cc:188 #16 0x7ffd6819ce45 in base::`anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:131 #17 0x7ff73039533d in asan_thread_start C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:147 #18 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #19 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27)

previously allocated by thread T9 here: #0 0x7ff7303a191d in malloc C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win.cpp:98 #1 0x7ffd7f22286e in operator new D:\a_work\1\s\src\vctools\crt\vcstartup\src\heap\new_scalar.cpp:36 #2 0x7ffd6dbef4dd in cc::GpuImageDecodeCache::CreateImageData C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2986 #3 0x7ffd6dbebef9 in cc::GpuImageDecodeCache::GetTaskForImageAndRefInternal C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1310 #4 0x7ffd6dbedb0e in cc::GpuImageDecodeCache::GetOutOfRasterDecodeTaskForImageAndRef C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1280 #5 0x7ffd76f78332 in cc::ImageController::GenerateTasksForOrphanedRequests C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:382 #6 0x7ffd76f77c7b in cc::ImageController::SetImageDecodeCache C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:148 #7 0x7ffd72353ba4 in cc::TileManager::SetResources C:\b\s\w\ir\cache\builder\src\cc\tiles\tile_manager.cc:628 #8 0x7ffd6dc70151 in cc::LayerTreeHostImpl::CreateTileManagerResources C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host_impl.cc:3926 #9 0x7ffd6dc86ee9 in cc::LayerTreeHostImpl::InitializeFrameSink C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host_impl.cc:4217 #10 0x7ffd72305dbc in cc::ProxyImpl::InitializeLayerTreeFrameSinkOnImpl C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:193 #11 0x7ffd6dc3e4d1 in base::internal::Invoker<base::internal::FunctorTraits<void (cc::ProxyImpl::*&&)(cc::LayerTreeFrameSink *, base::WeakPtrcc::ProxyMain),cc::ProxyImpl *,cc::LayerTreeFrameSink &&,base::WeakPtrcc::ProxyMain &&>,base::internal::BindState<1,1,0,void (cc::ProxyImpl::)(cc::LayerTreeFrameSink , base::WeakPtrcc::ProxyMain),base::internal::UnretainedWrappercc::ProxyImpl,base::unretained_traits::MayNotDangle,0,base::internal::UnretainedWrappercc::LayerTreeFrameSink,base::unretained_traits::MayNotDangle,0,base::WeakPtrcc::ProxyMain >,void ()>::RunImpl<void (cc::ProxyImpl::)(cc::LayerTreeFrameSink *, base::WeakPtrcc::ProxyMain),std::__Cr::tuple<base::internal::UnretainedWrappercc::ProxyImpl,base::unretained_traits::MayNotDangle,0,base::internal::UnretainedWrappercc::LayerTreeFrameSink,base::unretained_traits::MayNotDangle,0,base::WeakPtrcc::ProxyMain >,0,1,2> C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1067 #12 0x7ffd682757a0 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:203 #13 0x7ffd6c9bedcd in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:470 #14 0x7ffd6c9bdb79 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:332 #15 0x7ffd6ca025ce in base::MessagePumpDefault::Run C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:40 #16 0x7ffd6c9c0a9f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:640 #17 0x7ffd682cf96e in base::RunLoop::Run C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134 #18 0x7ffd65bc4ef9 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\scheduler\worker\non_main_thread_impl.cc:188 #19 0x7ffd6819ce45 in base::`anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:131 #20 0x7ff73039533d in asan_thread_start C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:147 #21 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #22 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27)

Thread T4 created by T0 here: #0 0x7ff730395252 in CreateThread C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:158 #1 0x7ffd6819be97 in base::`anonymous namespace’::CreateThreadInternal C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:196 #2 0x7ffd7672e258 in base::internal::WorkerThread::Start C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:207 #3 0x7ffd713e2bf5 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group.cc:93 #4 0x7ffd713e262d in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group.cc:84 #5 0x7ffd713ff8a2 in base::internal::ThreadGroupImpl::ScopedCommandsExecutor::~ScopedCommandsExecutor C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group_impl.cc:49 #6 0x7ffd713ff5be in base::internal::ThreadGroupImpl::Start C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group_impl.cc:248 #7 0x7ffd6c98d9b8 in base::internal::ThreadPoolImpl::Start C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_pool_impl.cc:190 #8 0x7ffd6b75f97a in content::ChildProcess::ChildProcess C:\b\s\w\ir\cache\builder\src\content\child\child_process.cc:102 #9 0x7ffd75c05848 in content::RenderProcess::RenderProcess C:\b\s\w\ir\cache\builder\src\content\renderer\render_process.cc:18 #10 0x7ffd7052c8ea in content::RenderProcessImpl::RenderProcessImpl C:\b\s\w\ir\cache\builder\src\content\renderer\render_process_impl.cc:113 #11 0x7ffd7052cfe5 in content::RenderProcessImpl::Create C:\b\s\w\ir\cache\builder\src\content\renderer\render_process_impl.cc:228 #12 0x7ffd6bd87092 in content::RendererMain C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:289 #13 0x7ffd66675dd1 in content::RunOtherNamedProcessTypeMain C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:795 #14 0x7ffd6667802f in content::ContentMainRunnerImpl::Run C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1164 #15 0x7ffd6666c635 in content::RunContentProcess C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:356 #16 0x7ffd6666d1dd in content::ContentMain C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:369 #17 0x7ffd57f916b0 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:231 #18 0x7ff7302c43ed in MainDllLoader::Launch C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201 #19 0x7ff7302c200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:351 #20 0x7ff7306e68cb in __scrt_common_main_seh D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #21 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #22 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27)

Thread T9 created by T0 here: #0 0x7ff730395252 in CreateThread C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:158 #1 0x7ffd6819be97 in base::`anonymous namespace’::CreateThreadInternal C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:196 #2 0x7ffd6823672e in base::SimpleThread::StartAsync C:\b\s\w\ir\cache\builder\src\base\threading\simple_thread.cc:55 #3 0x7ffd65b16c88 in blink::Thread::CreateAndSetCompositorThread C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\scheduler\common\thread.cc:84 #4 0x7ffd705376d4 in content::RenderThreadImpl::InitializeCompositorThread C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:837 #5 0x7ffd7053361b in content::RenderThreadImpl::InitializeWebKit C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:872 #6 0x7ffd7052ff01 in content::RenderThreadImpl::Init C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:564 #7 0x7ffd70532b8d in content::RenderThreadImpl::RenderThreadImpl C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:518 #8 0x7ffd6bd87103 in content::RendererMain C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:293 #9 0x7ffd66675dd1 in content::RunOtherNamedProcessTypeMain C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:795 #10 0x7ffd6667802f in content::ContentMainRunnerImpl::Run C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1164 #11 0x7ffd6666c635 in content::RunContentProcess C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:356 #12 0x7ffd6666d1dd in content::ContentMain C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:369 #13 0x7ffd57f916b0 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:231 #14 0x7ff7302c43ed in MainDllLoader::Launch C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201 #15 0x7ff7302c200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:351 #16 0x7ff7306e68cb in __scrt_common_main_seh D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #17 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #18 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27)

SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2469 in cc::GpuImageDecodeCache::DecodeImageIfNecessary Shadow bytes around the buggy address: 0x11fe92769680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x11fe92769900: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769b00: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x11fe92769b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb

==1472==ADDITIONAL INFO

==1472==Note: Please include this section with the ASan report. Task trace: #0 0x7ffd76f7a874 in cc::ImageController::ScheduleImageDecodeOnWorkerIfNeeded C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:402 #1 0x7ffd6dc2e877 in cc::ProxyMain::SetLayerTreeFrameSink C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:542 #2 0x7ffd72310385 in cc::ProxyImpl::ScheduledActionBeginLayerTreeFrameSinkCreation C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:877 #3 0x7ffd6dc2c1c5 in cc::ProxyMain::BeginMainFrame C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:468

MiraclePtr Status: NOT PROTECTED No raw_ptr<T> access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==1472==END OF ADDITIONAL INFO ==1472==ABORTING