CVE-2025-5063

High chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

High

Severity

—

CVSS

Exploited ITW

Fixed

Fix Status

ImpactUse after free in Compositing

DescriptionUse after free in Compositing

ComponentCompositing

Bug ClassUAF

Tracker411573532

Fix commit02ddca5de087 (chromium/src) +4/-1

CISA KEVNot listed

CreditedAnonymous

Disclosed2025-05-27

Files Changed

cc/trees/layer_tree_host.cc

Patch

view commit

From 02ddca5de087c833fede8c46fb971acdc42a7e91 Mon Sep 17 00:00:00 2001
From: Vladimir Levin <[email protected]>
Date: Wed, 14 May 2025 06:52:57 -0700
Subject: [PATCH] vt/cc: Post a callback task instead of a synchronous call

The callback can end up calling more script to start view transitions
which can add more requests, and re-enter into modifying the vector.

So, instead, unwind the task to post the task.

[email protected]

Bug: 411573532
Change-Id: I80880e9e3ecf41c346910fb5cb6f44609ee5ef17
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6542846
Commit-Queue: Vladimir Levin <[email protected]>
Reviewed-by: Khushal Sagar <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1460048}
---

diff --git a/cc/trees/layer_tree_host.cc b/cc/trees/layer_tree_host.cc
index 8487d71b..7fdc79d 100644
--- a/cc/trees/layer_tree_host.cc
+++ b/cc/trees/layer_tree_host.cc
@@ -536,7 +536,10 @@
   if (it == view_transition_callbacks_.end()) {
     return;
   }
-  std::move(it->second).Run(rects);
+  // The callback can cause more requests to be added and run the lifecycle, so
+  // unwind the stack before calling it.
+  task_runner_provider_->MainThreadTaskRunner()->PostTask(
+      FROM_HERE, base::BindOnce(std::move(it->second), rects));
   view_transition_callbacks_.erase(it);
 }

Loading diff…

Original Bug Report

reported by [email protected]

heap-use-after-free in cc::LayerTreeHost::NotifyTransitionRequestsFinished

Security Bug

Important: Please do not change the component of this bug manually.

Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/faq.md

Please see the following link for instructions on filing security bugs: https://www.chromium.org/Home/chromium-security/reporting-security-bugs

Reports may be eligible for reward payments under the Chrome VRP: https://g.co/chrome/vrp

NOTE: Security bugs are normally made public once a fix has been widely deployed.

VULNERABILITY DETAILS

Reproduction Steps

python -m http.server 8000
Run: chrome --headless --no-sandbox --user-data-dir=test --enable-logging=stderr http://localhost:8000/poc.html?url=http://localhost:8000/poc.html
Press the Escape key to trigger the bug

About `headless`

The headless flag is added for easier reproduction—without it, a print dialog would pop up, but the vulnerability will still trigger no matter which button the user clicks in the print page.

Root Cause Analysis (RCA)

In the NotifyTransitionRequestsFinished function, the iterator of view_transition_callbacks_ is first obtained
Then, in [1] the code calls the callback function, which causes the iterator to become invalid
Using the iterator leads to a UAF

https://source.chromium.org/chromium/chromium/src/+/main:cc/trees/layer_tree_host.cc;drc=d5e762e022c4d40d97ee0dc70521b161d72a06b1;l=538
void LayerTreeHost::NotifyTransitionRequestsFinished(
    const uint32_t sequence_id,
    const viz::ViewTransitionElementResourceRects& rects) {
  DCHECK(IsMainThread());
  // TODO(vmpstr): This might also be a good spot to expire long standing
  // requests if they were not finished.
  auto it = view_transition_callbacks_.find(sequence_id);
  if (it == view_transition_callbacks_.end()) {
    return;
  }
  std::move(it->second).Run(rects);       <<[1]>>
  view_transition_callbacks_.erase(it);
}

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: [tab]

ASAN

=================================================================
==16784==ERROR: AddressSanitizer: heap-use-after-free on address 0x11b78c231e70 at pc 0x7ffe820f176e bp 0x00aad99fb780 sp 0x00aad99fb7c8
READ of size 4 at 0x11b78c231e70 thread T0
    #0 0x7ffe820f176d in std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >::operator= C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__utility\pair.h:236
    #1 0x7ffe820f176d in std::__Cr::__move_impl<std::__Cr::_ClassicAlgPolicy>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\move.h:46
    #2 0x7ffe820f176d in std::__Cr::__copy_move_unwrap_iters C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\copy_move_common.h:94
    #3 0x7ffe820f176d in std::__Cr::__move C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\move.h:122
    #4 0x7ffe820f176d in std::__Cr::move C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\move.h:132
    #5 0x7ffe820f176d in std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > >::erase C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:1175
    #6 0x7ffe820f176d in base::internal::flat_tree<unsigned int, struct base::internal::GetFirst, struct std::__Cr::less<void>, class std::__Cr::vector<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>, class std::__Cr::allocator<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>>>>::erase(class std::__Cr::__wrap_iter<struct std::__Cr::pair<unsigned int, class base::OnceCallback<void __cdecl(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>> *>) C:\b\s\w\ir\cache\builder\src\base\containers\flat_tree.h:862:16
    #7 0x7ffe820f132b in cc::LayerTreeHost::NotifyTransitionRequestsFinished(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:539:30
    #8 0x7ffe820b45e9 in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #9 0x7ffe820b45e9 in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #10 0x7ffe820b45e9 in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain>,unsigned int,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #11 0x7ffe820b45e9 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain> &&, unsigned int &&, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain>, unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #12 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #13 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #14 0x7ffe7cde9a29 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #15 0x7ffe7cde9a29 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #16 0x7ffe7cde88cf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #17 0x7ffe7cf49427 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #18 0x7ffe7cdeb751 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
    #19 0x7ffe7ce8643e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #20 0x7ffe9278f8fb in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:369:16
    #21 0x7ffe79901686 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:781:14
    #22 0x7ffe799039d1 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1155:10
    #23 0x7ffe798f7ab3 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359:36
    #24 0x7ffe798f866d in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:372:10
    #25 0x7ffe6a1116bb in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
    #26 0x7ff6e68147bb in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
    #27 0x7ff6e6812021 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20
    #28 0x7ff6e6cc55fb in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #29 0x7ff6e6cc55fb in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #30 0x7fff890ae8d6  (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
    #31 0x7fff8b1dbf6b  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x1800bbf6b)

0x11b78c231e70 is located 16 bytes inside of 32-byte region [0x11b78c231e60,0x11b78c231e80)
freed by thread T0 here:
    #0 0x7fff3e30b244  (E:\chrome_asan\asan-win32-release_x64-1448748\clang_rt.asan_dynamic-x86_64.dll+0x18005b244)
    #1 0x7ffe82107583 in std::__Cr::__libcpp_operator_delete C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:46
    #2 0x7ffe82107583 in std::__Cr::__libcpp_deallocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:86
    #3 0x7ffe82107583 in std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > >::deallocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocator.h:120
    #4 0x7ffe82107583 in std::__Cr::allocator_traits<std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > >::deallocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocator_traits.h:289
    #5 0x7ffe82107583 in std::__Cr::__split_buffer<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > &>::~__split_buffer C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__split_buffer:337
    #6 0x7ffe82107583 in std::__Cr::vector<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>, class std::__Cr::allocator<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>>>::emplace<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>(class std::__Cr::__wrap_iter<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>> const *>, unsigned int &&, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)> &&) C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:1263:3
    #7 0x7ffe820f7902 in base::internal::flat_tree<unsigned int,base::internal::GetFirst,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::unsafe_emplace C:\b\s\w\ir\cache\builder\src\base\containers\flat_tree.h:1103
    #8 0x7ffe820f7902 in base::flat_map<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::operator[] C:\b\s\w\ir\cache\builder\src\base\containers\flat_map.h:294
    #9 0x7ffe820f7902 in cc::LayerTreeHost::AddViewTransitionRequest(class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:975:5
    #10 0x7ffe8b6a36b4 in blink::PaintArtifactCompositor::Update(class blink::PaintArtifact const &, struct blink::PaintArtifactCompositor::ViewportProperties const &, class blink::HeapVector<class cppgc::internal::BasicMember<class blink::TransformPaintPropertyNode const, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 32> const &, class WTF::Vector<class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>, 0, class WTF::PartitionAllocator>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\graphics\compositing\paint_artifact_compositor.cc:980:11
    #11 0x7ffe899cc848 in blink::LocalFrameView::PushPaintArtifactToCompositor(bool) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3016:31
    #12 0x7ffe899c8877 in blink::LocalFrameView::RunPaintLifecyclePhase(enum blink::PaintBenchmarkMode) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2683:5
    #13 0x7ffe899c6e6b in blink::LocalFrameView::UpdateLifecyclePhasesInternal(enum blink::DocumentLifecycle::LifecycleState) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2378:3
    #14 0x7ffe899c29cf in blink::LocalFrameView::UpdateLifecyclePhases(enum blink::DocumentLifecycle::LifecycleState, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2163:3
    #15 0x7ffe899c210e in blink::LocalFrameView::UpdateAllLifecyclePhases(enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:1887:54
    #16 0x7ffe878671f4 in blink::PageAnimator::UpdateAllLifecyclePhases(class blink::LocalFrame &, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\page_animator.cc:397:9
    #17 0x7ffe8987caf5 in blink::WebFrameWidgetImpl::UpdateLifecycle(enum blink::WebLifecycleUpdate, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\web_frame_widget_impl.cc:1764:14
    #18 0x7ffe8b359f6d in blink::WidgetBase::UpdateVisualState(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\widget\widget_base.cc:1054:12
    #19 0x7ffe820ef283 in cc::LayerTreeHost::RequestMainFrameUpdate(bool) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:402:12
    #20 0x7ffe820c0359 in cc::ProxyMain::BeginMainFrame(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>) C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:297:21
    #21 0x7ffe820b64be in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #22 0x7ffe820b64be in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #23 0x7ffe820b64be in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #24 0x7ffe820b64be in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain> &&, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain>, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #25 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #26 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #27 0x7ffe7cde9a29 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #28 0x7ffe7cde9a29 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #29 0x7ffe7cde88cf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #30 0x7ffe7cf49427 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #31 0x7ffe7cdeb7c8 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:626:12
    #32 0x7ffe7ce8643e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #33 0x7ffe93241ceb in printing::PrintRenderFrameHelper::RequestPrintPreview(enum printing::PrintRenderFrameHelper::PrintPreviewRequestType, bool) C:\b\s\w\ir\cache\builder\src\components\printing\renderer\print_render_frame_helper.cc:2694:12
    #34 0x7ffe93240d49 in printing::PrintRenderFrameHelper::ScriptedPrint(bool) C:\b\s\w\ir\cache\builder\src\components\printing\renderer\print_render_frame_helper.cc:1229:5
    #35 0x7ffe928c9795 in content::RenderFrameImpl::ScriptedPrint(void) C:\b\s\w\ir\cache\builder\src\content\renderer\render_frame_impl.cc:2104:14
    #36 0x7ffe895a09d1 in blink::ChromeClientImpl::PrintDelegate(class blink::LocalFrame *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\chrome_client_impl.cc:777:24
    #37 0x7ffe87f39d6d in blink::ChromeClient::Print(class blink::LocalFrame *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\chrome_client.cc:282:3
    #38 0x7ffe8a127890 in blink::EditorCommand::Execute(class WTF::String const &, class blink::Event *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\commands\editor_command.cc:2161:10
    #39 0x7ffe8d9aa9e2 in blink::Document::execCommand(class WTF::String const &, bool, class blink::V8UnionStringOrTrustedHTML const *, class blink::ExceptionState &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\commands\document_exec_command.cc:149:25
    #40 0x7ffe8da0a4db in blink::`anonymous namespace'::v8_document::ExecCommandOperationCallback C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\modules\v8\v8_document.cc:6933:39
    #41 0x7ffe93ad1b44 in Builtins_CallApiCallbackGeneric (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99c1b44)
    #42 0x7ffe93acfd34 in Builtins_InterpreterEntryTrampoline (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bfd34)
    #43 0x7ffe93acfd34 in Builtins_InterpreterEntryTrampoline (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bfd34)
    #44 0x7ffe93acd29b in Builtins_JSEntryTrampoline (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bd29b)
    #45 0x7ffe93accdfe in Builtins_JSEntry (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bcdfe)
    #46 0x7ffe6f5eefbe in v8::internal::GeneratedCode<unsigned long long,unsigned long long,unsigned long long,unsigned long long,unsigned long long,long long,unsigned long long **>::Call C:\b\s\w\ir\cache\builder\src\v8\src\execution\simulator.h:212
    #47 0x7ffe6f5eefbe in v8::internal::`anonymous namespace'::Invoke C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:440:22
    #48 0x7ffe6f5ed68d in v8::internal::Execution::Call(class v8::internal::Isolate *, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::base::Vector<class v8::internal::DirectHandle<class v8::internal::Object> const>) C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:530:10
    #49 0x7ffe6f009468 in v8::Function::Call(class v8::Isolate *, class v8::Local<class v8::Context>, class v8::Local<class v8::Value>, int, class v8::Local<class v8::Value> *const) C:\b\s\w\ir\cache\builder\src\v8\src\api\api.cc:5427:7
    #50 0x7ffe8aeb6c68 in blink::V8ScriptRunner::CallFunction(class v8::Local<class v8::Function>, class blink::ExecutionContext *, class v8::Local<class v8::Value>, int, class v8::Local<class v8::Value> *const, class v8::Isolate *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\v8_script_runner.cc:886:48
    #51 0x7ffe8ce54106 in blink::bindings::CallbackInvokeHelper<blink::CallbackFunctionBase,0,1>::CallInternal C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\callback_invoke_helper.cc:142
    #52 0x7ffe8ce54106 in blink::bindings::CallbackInvokeHelper<class blink::CallbackFunctionWithTaskAttributionBase, 0, 1>::Call(int, class v8::Local<class v8::Value> *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\callback_invoke_helper.cc:157:10
    #53 0x7ffe8ce5cf3c in blink::V8ViewTransitionCallback::Invoke(class blink::bindings::V8ValueOrScriptWrappableAdapter) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\core\v8\v8_view_transition_callback.cc:57:13
    #54 0x7ffe8a492c00 in blink::DOMViewTransition::InvokeDOMChangeCallback(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\view_transition\dom_view_transition.cc:234:31
    #55 0x7ffe8a4802c9 in blink::ViewTransition::ProcessCurrentState(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\view_transition\view_transition.cc:528:27
    #56 0x7ffe8a48ae5f in base::internal::DecayedFunctorTraits<void (ViewTransition::*)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::ViewTransition *>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #57 0x7ffe8a48ae5f in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ViewTransition::*&&)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::ViewTransition *>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #58 0x7ffe8a48ae5f in base::internal::Invoker<base::internal::FunctorTraits<void (ViewTransition::*&&)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::ViewTransition *>,base::internal::BindState<1,1,0,void (ViewTransition::*)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::internal::BasicUnwrappingCrossThreadHandle<blink::ViewTransition,blink::internal::WeakCrossThreadHandleWeaknessPolicy> >,void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #59 0x7ffe8a48ae5f in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl blink::ViewTransition::*&&)(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class blink::ViewTransition *>, struct base::internal::BindState<1, 1, 0, void (__cdecl blink::ViewTransition::*)(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class blink::internal::BasicUnwrappingCrossThreadHandle<class blink::ViewTransition, struct blink::internal::WeakCrossThreadHandleWeaknessPolicy>>, (class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>::RunOnce(class base::internal::BindStateBase *, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #60 0x7ffe820f1300 in base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #61 0x7ffe820f1300 in cc::LayerTreeHost::NotifyTransitionRequestsFinished(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:538:25
    #62 0x7ffe820b45e9 in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #63 0x7ffe820b45e9 in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #64 0x7ffe820b45e9 in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain>,unsigned int,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #65 0x7ffe820b45e9 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain> &&, unsigned int &&, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain>, unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #66 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #67 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34

previously allocated by thread T0 here:
    #0 0x7fff3e30a65d  (E:\chrome_asan\asan-win32-release_x64-1448748\clang_rt.asan_dynamic-x86_64.dll+0x18005a65d)
    #1 0x7ffe821073f4 in std::__Cr::__libcpp_operator_new C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:37
    #2 0x7ffe821073f4 in std::__Cr::__libcpp_allocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:64
    #3 0x7ffe821073f4 in std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > >::allocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocator.h:105
    #4 0x7ffe821073f4 in std::__Cr::__allocate_at_least C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocate_at_least.h:41
    #5 0x7ffe821073f4 in std::__Cr::__split_buffer<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > &>::__split_buffer C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__split_buffer:325
    #6 0x7ffe821073f4 in std::__Cr::vector<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>, class std::__Cr::allocator<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>>>::emplace<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>(class std::__Cr::__wrap_iter<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>> const *>, unsigned int &&, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)> &&) C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:1260:49
    #7 0x7ffe820f7902 in base::internal::flat_tree<unsigned int,base::internal::GetFirst,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::unsafe_emplace C:\b\s\w\ir\cache\builder\src\base\containers\flat_tree.h:1103
    #8 0x7ffe820f7902 in base::flat_map<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::operator[] C:\b\s\w\ir\cache\builder\src\base\containers\flat_map.h:294
    #9 0x7ffe820f7902 in cc::LayerTreeHost::AddViewTransitionRequest(class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:975:5
    #10 0x7ffe8b6a36b4 in blink::PaintArtifactCompositor::Update(class blink::PaintArtifact const &, struct blink::PaintArtifactCompositor::ViewportProperties const &, class blink::HeapVector<class cppgc::internal::BasicMember<class blink::TransformPaintPropertyNode const, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 32> const &, class WTF::Vector<class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>, 0, class WTF::PartitionAllocator>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\graphics\compositing\paint_artifact_compositor.cc:980:11
    #11 0x7ffe899cc848 in blink::LocalFrameView::PushPaintArtifactToCompositor(bool) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3016:31
    #12 0x7ffe899c8877 in blink::LocalFrameView::RunPaintLifecyclePhase(enum blink::PaintBenchmarkMode) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2683:5
    #13 0x7ffe899c6e6b in blink::LocalFrameView::UpdateLifecyclePhasesInternal(enum blink::DocumentLifecycle::LifecycleState) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2378:3
    #14 0x7ffe899c29cf in blink::LocalFrameView::UpdateLifecyclePhases(enum blink::DocumentLifecycle::LifecycleState, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2163:3
    #15 0x7ffe899c210e in blink::LocalFrameView::UpdateAllLifecyclePhases(enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:1887:54
    #16 0x7ffe878671f4 in blink::PageAnimator::UpdateAllLifecyclePhases(class blink::LocalFrame &, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\page_animator.cc:397:9
    #17 0x7ffe8987caf5 in blink::WebFrameWidgetImpl::UpdateLifecycle(enum blink::WebLifecycleUpdate, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\web_frame_widget_impl.cc:1764:14
    #18 0x7ffe8b359f6d in blink::WidgetBase::UpdateVisualState(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\widget\widget_base.cc:1054:12
    #19 0x7ffe820ef283 in cc::LayerTreeHost::RequestMainFrameUpdate(bool) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:402:12
    #20 0x7ffe820c0359 in cc::ProxyMain::BeginMainFrame(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>) C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:297:21
    #21 0x7ffe820b64be in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #22 0x7ffe820b64be in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #23 0x7ffe820b64be in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #24 0x7ffe820b64be in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain> &&, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain>, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #25 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #26 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #27 0x7ffe7cde9a29 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #28 0x7ffe7cde9a29 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #29 0x7ffe7cde88cf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #30 0x7ffe7cf49427 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #31 0x7ffe7cdeb751 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
    #32 0x7ffe7ce8643e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #33 0x7ffe9278f8fb in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:369:16
    #34 0x7ffe79901686 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:781:14
    #35 0x7ffe799039d1 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1155:10
    #36 0x7ffe798f7ab3 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359:36
    #37 0x7ffe798f866d in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:372:10
    #38 0x7ffe6a1116bb in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
    #39 0x7ff6e68147bb in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
    #40 0x7ff6e6812021 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20
    #41 0x7ff6e6cc55fb in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #42 0x7ff6e6cc55fb in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #43 0x7fff890ae8d6  (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
    #44 0x7fff8b1dbf6b  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x1800bbf6b)

SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__utility\pair.h:236 in std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >::operator=
Shadow bytes around the buggy address:
  0x11b78c231b80: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c231c00: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
  0x11b78c231c80: fd fd fd fa f7 fa fd fd fd fd f7 fa fd fd fd fd
  0x11b78c231d00: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c231d80: fd fd f7 fa fd fd fd fd f7 fa 00 00 00 fa f7 fa
=>0x11b78c231e00: 00 00 00 fa f7 fa 00 00 00 00 f7 fa fd fd[fd]fd
  0x11b78c231e80: f7 fa fd fd fd fa f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c231f00: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fa f7 fa
  0x11b78c231f80: 00 00 00 00 f7 fa fd fd fd fd f7 fa fd fd fd fd
  0x11b78c232000: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c232080: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==16784==ADDITIONAL INFO

==16784==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7ffe820ac7c7 in cc::ProxyImpl::NotifyTransitionRequestFinished(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:643:7
    #1 0x7ffe7d330a58 in mojo::SimpleWatcher::Context::Notify(unsigned int, struct MojoHandleSignalsState, unsigned int) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc:102:13



MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==16784==END OF ADDITIONAL INFO
==16784==ABORTINGs

CREDIT INFORMATION Reporter credit: [f4@dnpushme]

View on issue tracker

Links in the report

References

Vendor advisory Fix commit Bug tracker NVD

On This Page