CVE-2025-8576
Overview
Changed Functions
| Function | Change | Notes |
|---|---|---|
forextensions/renderer/extension_throttle_manager.cc |
modified | |
ExtensionThrottleManagerextensions/renderer/extension_throttle_manager.h |
modified | |
ExtensionThrottleManagerObserverextensions/renderer/extension_throttle_manager.h |
modified | |
TESTextensions/renderer/extension_throttle_unittest.cc |
modified | |
ifextensions/renderer/extension_url_loader_throttle.cc |
modified |
Files Changed
extensions/renderer/extension_throttle_manager.ccextensions/renderer/extension_throttle_manager.hextensions/renderer/extension_throttle_unittest.ccextensions/renderer/extension_url_loader_throttle.ccextensions/renderer/extension_url_loader_throttle.h
Patch
From 0882dbc4a6dc52eb4ca80e6e6f50ff1897fc4a42 Mon Sep 17 00:00:00 2001 From: Solomon Kinard <[email protected]> Date: Tue, 08 Jul 2025 17:50:59 -0700 Subject: [PATCH] Extensions: ExtensionThrottleManager: Observe dependency destruction ExtensionURLLoaderThrottle relies on ExtensionThrottleManager because they’re created at the same time when throttles have one manager in common, but they’re managed independently so the manager can go away without the throttles being aware. Doc: https://docs.google.com/document/d/1JXFBNF6-Nl6H6AjZGjALE_2UnMhCnSmKXPC4mAzZtpI/edit?usp=sharing Bug: chromium:414760982, chromium:377724744 Change-Id: If53fe5f7c8a6fb197d67be3b9afacf8329e97697 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6651042 Reviewed-by: Devlin Cronin <[email protected]> Commit-Queue: Solomon Kinard <[email protected]> Cr-Commit-Position: refs/heads/main@{#1484094} --- diff --git a/extensions/renderer/extension_throttle_manager.cc b/extensions/renderer/extension_throttle_manager.cc index 6dd82d56..75e2f481 100644 --- a/extensions/renderer/extension_throttle_manager.cc +++ b/extensions/renderer/extension_throttle_manager.cc @@ -34,6 +34,10 @@ base::AutoLock auto_lock(lock_); // Delete all entries. url_entries_.clear(); + + for (auto& observer : observers_) { + observer.OnExtensionThrottleManagerDestruct(this); + } } std::unique_ptr<blink::URLLoaderThrottle> diff --git a/extensions/renderer/extension_throttle_manager.h b/extensions/renderer/extension_throttle_manager.h index 8045e5f..e5b3c2a0 100644 --- a/extensions/renderer/extension_throttle_manager.h +++ b/extensions/renderer/extension_throttle_manager.h @@ -9,6 +9,7 @@ #include <memory> #include <string> +#include "base/observer_list.h" #include "base/synchronization/lock.h" #include "extensions/renderer/extension_throttle_entry.h" #include "services/network/public/mojom/url_response_head.mojom-forward.h" @@ -37,6 +38,10 @@ // are registered, and does garbage collection from time to time in order to // clean out outdated entries. URL ID consists of lowercased scheme, host, port // and path. All URLs converted to the same ID will share the same entry. +// +// ExtensionThrottleManager can be destructed before ExtensionURLLoaderThrottle +// even though it is an explicit constructor argument. In that case, the +// throttle will have no effect (failing open). class ExtensionThrottleManager { public: ExtensionThrottleManager(); @@ -78,6 +83,26 @@ int GetNumberOfEntriesForTests() const { return url_entries_.size(); } + // Observe extension throttle manager. + class ExtensionThrottleManagerObserver : public base::CheckedObserver { + public: + ExtensionThrottleManagerObserver() = default; + + virtual void OnExtensionThrottleManagerDestruct( + ExtensionThrottleManager* manager) {} + + protected: + ~ExtensionThrottleManagerObserver() override = default; + }; + + void AddObserver(ExtensionThrottleManagerObserver* observer) { + observers_.AddObserver(observer); + } + + void RemoveObserver(ExtensionThrottleManagerObserver* observer) { + observers_.RemoveObserver(observer); + } + protected: // Method that allows us to transform a URL into an ID that can be used in our // map. Resulting IDs will be lowercase and consist of the scheme, host, port @@ -131,6 +156,9 @@ // Used to synchronize all public methods. base::Lock lock_; + + // Observers of `ExtensionThrottleManager`. + base::ObserverList<ExtensionThrottleManagerObserver> observers_; }; } // namespace extensions diff --git a/extensions/renderer/extension_throttle_unittest.cc b/extensions/renderer/extension_throttle_unittest.cc index 41d2734..cf69de9a 100644 --- a/extensions/renderer/extension_throttle_unittest.cc +++ b/extensions/renderer/extension_throttle_unittest.cc @@ -10,6 +10,7 @@ #include "extensions/renderer/extension_throttle_entry.h" #include "extensions/renderer/extension_throttle_manager.h" #include "extensions/renderer/extension_throttle_test_support.h" +#include "extensions/renderer/extension_url_loader_throttle.h" #include "net/url_request/redirect_info.h" #include "services/network/public/mojom/url_response_head.mojom.h" #include "testing/gtest/include/gtest/gtest.h" @@ -398,4 +399,25 @@ manager.WillProcessResponse(redirect_info.new_url, *response_head); } +// Verify that throttles relying on a manager in the constructor can function +// even if manager is destructed before throttles are destructed. +TEST(ExtensionThrottleManagerTest, ThrottlesCanOutliveManager) { + // Create a manager that can be passed into the throttle constructor. + MockExtensionThrottleManager* manager = new MockExtensionThrottleManager(); + + // Create one or more throttles that receive the manager in the constructor. + auto throttle1 = ExtensionURLLoaderThrottle(manager); + auto throttle2 = ExtensionURLLoaderThrottle(manager); + + // Delete `manager` to prove that throttle functions can run without it. + delete manager; + + // Call a function in throttle that uses manager after manager destruction. + GURL gurl; + network::mojom::URLResponseHead* response_head = nullptr; + bool* defer = nullptr; + throttle1.WillProcessResponse(gurl, response_head, defer); + throttle2.WillProcessResponse(gurl, response_head, defer); +} + } // namespace extensions diff --git a/extensions/renderer/extension_url_loader_throttle.cc b/extensions/renderer/extension_url_loader_throttle.cc index faa7895b..bff851d 100644 --- a/extensions/renderer/extension_url_loader_throttle.cc +++ b/extensions/renderer/extension_url_loader_throttle.cc @@ -20,16 +20,29 @@ ExtensionThrottleManager* manager) : manager_(manager) { DCHECK(manager_); + manager_observation_.Observe(manager_); } ExtensionURLLoaderThrottle::~ExtensionURLLoaderThrottle() = default; +void ExtensionURLLoaderThrottle::OnExtensionThrottleManagerDestruct( + ExtensionThrottleManager* manager) { + manager_observation_.Reset(); + manager_ = nullptr; +} + void ExtensionURLLoaderThrottle::WillStartRequest( network::ResourceRequest* request, bool* defer) { start_request_url_ = request->url; - if (manager_->ShouldRejectRequest(start_request_url_)) + + if (!manager_) { + return; + } + + if (manager_->ShouldRejectRequest(start_request_url_)) { delegate_->CancelWithError(net::ERR_TEMPORARILY_THROTTLED, kCancelReason); + } } void ExtensionURLLoaderThrottle::WillRedirectRequest( @@ -39,6 +52,10 @@ /*to_be_removed_request_headers=*/std::vector<std::string>*, /*modified_request_headers=*/net::HttpRequestHeaders*, /*modified_cors_exempt_request_headers=*/net::HttpRequestHeaders*) { + if (!manager_) { + return; + } + if (manager_->ShouldRejectRedirect(start_request_url_, *redirect_info)) { delegate_->CancelWithError(net::ERR_TEMPORARILY_THROTTLED, kCancelReason); } @@ -48,6 +65,10 @@ const GURL& response_url, network::mojom::URLResponseHead* response_head, bool* defer) { + if (!manager_) { + return; + } + manager_->WillProcessResponse(response_url, *response_head); } diff --git a/extensions/renderer/extension_url_loader_throttle.h b/extensions/renderer/extension_url_loader_throttle.h index 6c44fcb7..06ced97 100644 --- a/extensions/renderer/extension_url_loader_throttle.h +++ b/extensions/renderer/extension_url_loader_throttle.h @@ -9,6 +9,8 @@ #include <vector> #include "base/memory/raw_ptr.h" +#include "base/scoped_observation.h"
Regression Test / PoC
diff --git a/extensions/renderer/extension_throttle_unittest.cc b/extensions/renderer/extension_throttle_unittest.cc
index 41d2734..cf69de9a 100644
--- a/extensions/renderer/extension_throttle_unittest.cc
+++ b/extensions/renderer/extension_throttle_unittest.cc
@@ -10,6 +10,7 @@
#include "extensions/renderer/extension_throttle_entry.h"
#include "extensions/renderer/extension_throttle_manager.h"
#include "extensions/renderer/extension_throttle_test_support.h"
+#include "extensions/renderer/extension_url_loader_throttle.h"
#include "net/url_request/redirect_info.h"
#include "services/network/public/mojom/url_response_head.mojom.h"
#include "testing/gtest/include/gtest/gtest.h"
@@ -398,4 +399,25 @@
manager.WillProcessResponse(redirect_info.new_url, *response_head);
}
+// Verify that throttles relying on a manager in the constructor can function
+// even if manager is destructed before throttles are destructed.
+TEST(ExtensionThrottleManagerTest, ThrottlesCanOutliveManager) {
+ // Create a manager that can be passed into the throttle constructor.
+ MockExtensionThrottleManager* manager = new MockExtensionThrottleManager();
+
+ // Create one or more throttles that receive the manager in the constructor.
+ auto throttle1 = ExtensionURLLoaderThrottle(manager);
+ auto throttle2 = ExtensionURLLoaderThrottle(manager);
+
+ // Delete `manager` to prove that throttle functions can run without it.
+ delete manager;
+
+ // Call a function in throttle that uses manager after manager destruction.
+ GURL gurl;
+ network::mojom::URLResponseHead* response_head = nullptr;
+ bool* defer = nullptr;
+ throttle1.WillProcessResponse(gurl, response_head, defer);
+ throttle2.WillProcessResponse(gurl, response_head, defer);
+}
+
} // namespace extensions
Original Bug Report
UAF in in extensions::ExtensionURLLoaderThrottle::WillProcessResponse
VULNERABILITY DETAILS
The UAF crash occurs in the extensions::ExtensionURLLoaderThrottle::WillProcessResponse function. The issue happens when an extension uses the Debugger API to attach to a tab while the tab is processing a URL request. The root cause is in how the ExtensionThrottleManager is managed during the lifecycle of throttle providers and URL loaders.
VERSION Chromium 138.0.7153.0 (Developer Build) (64-bit) OS Windows 11 Version 24H2 (Build 26120.3941)
Also reprodeced in Linux/ChromiumOS_Linux
REPRODUCTION CASE
- run the command: chrome.exe –user-data-dir=c:/tmp/test–no-sandbox –load-extension=“extension” https://example.com
The test environment needs to access external network resources
FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: [tab, browser, etc.]
=================================================================
==37512==ERROR: AddressSanitizer: heap-use-after-free on address 0x116457cb42c0 at pc 0x7ffbd24435a2 bp 0x0001043fbea0 sp 0x0001043fbee8
READ of size 1 at 0x116457cb42c0 thread T4
#0 0x7ffbd24435a1 in base::internal::anonymous namespace'::CrashImmediatelyOnUseAfterFree C:\b\s\w\ir\cache\builder\src\base\memory\raw_ptr_asan_hooks.cc:54:17 #1 0x7ffbd24430f1 in base::internal::anonymous namespace’::SafelyUnwrapForDereference C:\b\s\w\ir\cache\builder\src\base\memory\raw_ptr_asan_hooks.cc:77:5
#2 0x7ffbd06251d6 in base::internal::RawPtrHookableImpl<1>::SafelyUnwrapPtrForDereference C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\pointers\raw_ptr_hookable_impl.h:84
#3 0x7ffbd06251d6 in base::raw_ptrextensions::ExtensionThrottleManager,0::GetForDereference C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\pointers\raw_ptr.h:996
#4 0x7ffbd06251d6 in base::raw_ptrextensions::ExtensionThrottleManager,0::operator-> C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\pointers\raw_ptr.h:665
#5 0x7ffbd06251d6 in extensions::ExtensionURLLoaderThrottle::WillProcessResponse(class GURL const &, class network::mojom::URLResponseHead *, bool *) C:\b\s\w\ir\cache\builder\src\extensions\renderer\extension_url_loader_throttle.cc:51:3
#6 0x7ffbc3d930fb in blink::ThrottlingURLLoader::OnReceiveResponse(class mojo::StructPtr<class network::mojom::URLResponseHead>, class mojo::ScopedHandleBase<class mojo::DataPipeConsumerHandle>, class std::__Cr::optional<class mojo_base::BigBuffer>) C:\b\s\w\ir\cache\builder\src\third_party\blink\common\loader\throttling_url_loader.cc:666:17
#7 0x7ffbc0ddb911 in network::mojom::URLLoaderClientStubDispatch::Accept(class network::mojom::URLLoaderClient *, class mojo::Message *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\services\network\public\mojom\url_loader.mojom.cc:1127:13
#8 0x7ffbd204e05f in mojo::InterfaceEndpointClient::HandleValidatedMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:1059:54
#9 0x7ffbd204ae5a in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:43:19
#10 0x7ffbd20542ee in mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:731:20
#11 0x7ffbd20361e0 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(class mojo::internal::MultiplexRouter::MessageWrapper *, enum mojo::internal::MultiplexRouter::ClientCallBehavior, class base::SequencedTaskRunner *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\multiplex_router.cc:1120:42
#12 0x7ffbd2034804 in mojo::internal::MultiplexRouter::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\multiplex_router.cc:733:7
#13 0x7ffbd204ae5a in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:43:19
#14 0x7ffbd2072414 in mojo::Connector::DispatchMessageW(class mojo::ScopedHandleBase<class mojo::MessageHandle>) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc:561:49
#15 0x7ffbd2073d20 in mojo::Connector::ReadAllAvailableMessages(void) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc:619:14
#16 0x7ffbd2073747 in mojo::Connector::OnHandleReadyInternal C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc:450
#17 0x7ffbd2073747 in mojo::Connector::OnWatcherHandleReady(char const , unsigned int) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc:416:3
#18 0x7ffbd2075693 in base::internal::DecayedFunctorTraits<void (Connector::)(const char *, unsigned int),mojo::Connector *,const char *const &>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
#19 0x7ffbd2075693 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (Connector::*const &)(const char *, unsigned int),mojo::Connector *,const char *const &>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
#20 0x7ffbd2075693 in base::internal::Invoker<base::internal::FunctorTraits<void (Connector::*const &)(const char *, unsigned int),mojo::Connector *,const char const &>,base::internal::BindState<1,1,0,void (Connector::)(const char *, unsigned int),base::internal::UnretainedWrappermojo::Connector,base::unretained_traits::MayNotDangle,0,base::internal::UnretainedWrapper<const char,base::unretained_traits::MayNotDangle,0> >,void (unsigned int)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
#21 0x7ffbd2075693 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl mojo::Connector::*const &)(char const *, unsigned int), class mojo::Connector , char const const &>, struct base::internal::BindState<1, 1, 0, void (__cdecl mojo::Connector::)(char const , unsigned int), class base::internal::UnretainedWrapper<class mojo::Connector, struct base::unretained_traits::MayNotDangle, 0>, class base::internal::UnretainedWrapper<char const, struct base::unretained_traits::MayNotDangle, 0>>, (unsigned int)>::Run(class base::internal::BindStateBase , unsigned int) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:980:12
#22 0x7ffbc3d855fc in base::RepeatingCallback<(unsigned int)>::Run(unsigned int) const & C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:344:12
#23 0x7ffbc3d853ef in base::internal::DecayedFunctorTraits<void ()(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:664
#24 0x7ffbc3d853ef in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
#25 0x7ffbc3d853ef in base::internal::Invoker<base::internal::FunctorTraits<void (const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &>,base::internal::BindState<0,1,0,void ()(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),base::RepeatingCallback<void (unsigned int)> >,void (unsigned int, const mojo::HandleSignalsState &)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
#26 0x7ffbc3d853ef in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl const &)(class base::RepeatingCallback<(unsigned int)> const &, unsigned int, struct mojo::HandleSignalsState const &), class base::RepeatingCallback<void __cdecl(unsigned int)> const &>, struct base::internal::BindState<0, 1, 0, void (__cdecl )(class base::RepeatingCallback<(unsigned int)> const &, unsigned int, struct mojo::HandleSignalsState const &), class base::RepeatingCallback<void __cdecl(unsigned int)>>, (unsigned int, struct mojo::HandleSignalsState const &)>::Run(class base::internal::BindStateBase , unsigned int, struct mojo::HandleSignalsState const &) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:980:12
#27 0x7ffbd281a14b in base::RepeatingCallback<(unsigned int, struct mojo::HandleSignalsState const &)>::Run(unsigned int, struct mojo::HandleSignalsState const &) const & C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:344:12
#28 0x7ffbd2819a55 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, struct mojo::HandleSignalsState const &) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc:278:14
#29 0x7ffbd281ac68 in base::internal::DecayedFunctorTraits<void (SimpleWatcher::)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtrmojo::SimpleWatcher &&,int &&,unsigned int &&,mojo::HandleSignalsState &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
#30 0x7ffbd281ac68 in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (SimpleWatcher::&&)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtrmojo::SimpleWatcher &&,int &&,unsigned int &&,mojo::HandleSignalsState &&>,void,0,1,2,3>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
#31 0x7ffbd281ac68 in base::internal::Invoker<base::internal::FunctorTraits<void (SimpleWatcher::&&)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtrmojo::SimpleWatcher &&,int &&,unsigned int &&,mojo::HandleSignalsState &&>,base::internal::BindState<1,1,0,void (SimpleWatcher::)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtrmojo::SimpleWatcher,int,unsigned int,mojo::HandleSignalsState>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
#32 0x7ffbd281ac68 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl mojo::SimpleWatcher::&&)(int, unsigned int, struct mojo::HandleSignalsState const &), class base::WeakPtr<class mojo::SimpleWatcher> &&, int &&, unsigned int &&, struct mojo::HandleSignalsState &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl mojo::SimpleWatcher::)(int, unsigned int, struct mojo::HandleSignalsState const &), class base::WeakPtr<class mojo::SimpleWatcher>, int, unsigned int, struct mojo::HandleSignalsState>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
#33 0x7ffbd23025d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
#34 0x7ffbd23025d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
#35 0x7ffbd225728c in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
#36 0x7ffbd225728c in base::internal::TaskTracker::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:691
#37 0x7ffbd225728c in base::internal::TaskTracker::RunSkipOnShutdown(struct base::internal::Task &, class base::TaskTraits const &, class base::internal::TaskSource *, class base::internal::SequenceToken const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:676:3
#38 0x7ffbd225589a in base::internal::TaskTracker::RunTaskWithShutdownBehavior C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:706
#39 0x7ffbd225589a in base::internal::TaskTracker::RunTask(struct base::internal::Task, class base::internal::TaskSource *, class base::TaskTraits const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:504:5
#40 0x7ffbd225494e in base::internal::TaskTracker::RunAndPopNextTask(class base::internal::RegisteredTaskSource) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:394:5
#41 0x7ffbd223df85 in base::internal::WorkerThread::RunWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:473:36
#42 0x7ffbd223cd9f in base::internal::WorkerThread::RunPooledWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:359:3
#43 0x7ffbd214b9f3 in base::`anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:114:13
#44 0x7ffc78de9a6c (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x180059a6c)
#45 0x7ffccde7e8d6 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
#46 0x7ffccee51d1b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180011d1b)
0x116457cb42c0 is located 0 bytes inside of 200-byte region [0x116457cb42c0,0x116457cb4388)
freed by thread T4 here:
#0 0x7ffc78deae74 (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x18005ae74)
#1 0x7ffbd0624c20 in extensions::ExtensionThrottleManager::scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\extensions\renderer\extension_throttle_manager.cc:33:55 #2 0x7ffbe85fcc6c in std::__Cr::default_delete<extensions::ExtensionThrottleManager>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:76 #3 0x7ffbe85fcc6c in std::__Cr::unique_ptr<extensions::ExtensionThrottleManager,std::__Cr::default_delete<extensions::ExtensionThrottleManager> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:287 #4 0x7ffbe85fcc6c in std::__Cr::unique_ptr<extensions::ExtensionThrottleManager,std::__Cr::default_delete<extensions::ExtensionThrottleManager> >::~unique_ptr C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:256 #5 0x7ffbe85fcc6c in URLLoaderThrottleProviderImpl::~URLLoaderThrottleProviderImpl(void) C:\b\s\w\ir\cache\builder\src\chrome\renderer\url_loader_throttle_provider_impl.cc:152:1 #6 0x7ffbe85ff82f in URLLoaderThrottleProviderImpl::scalar deleting dtor’(unsigned int) C:\b\s\w\ir\cache\builder\src\chrome\renderer\url_loader_throttle_provider_impl.cc:150:65
#7 0x7ffbd2285cb7 in base::internal::DecayedFunctorTraits<void (*)(const void *),const void &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:664
#8 0x7ffbd2285cb7 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (&&)(const void *),const void &&>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
#9 0x7ffbd2285cb7 in base::internal::Invoker<base::internal::FunctorTraits<void (&&)(const void *),const void &&>,base::internal::BindState<0,1,0,void ()(const void *),base::internal::UnretainedWrapper<const void,base::unretained_traits::MayNotDangle,0> >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
#10 0x7ffbd2285cb7 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl *&&)(void const *), void const *&&>, struct base::internal::BindState<0, 1, 0, void (__cdecl *)(void const *), class base::internal::UnretainedWrapper<void const, struct base::unretained_traits::MayNotDangle, 0>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
#11 0x7ffbd23025d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
#12 0x7ffbd23025d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
#13 0x7ffbd225728c in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
#14 0x7ffbd225728c in base::internal::TaskTracker::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:691
#15 0x7ffbd225728c in base::internal::TaskTracker::RunSkipOnShutdown(struct base::internal::Task &, class base::TaskTraits const &, class base::internal::TaskSource *, class base::internal::SequenceToken const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:676:3
#16 0x7ffbd225589a in base::internal::TaskTracker::RunTaskWithShutdownBehavior C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:706
#17 0x7ffbd225589a in base::internal::TaskTracker::RunTask(struct base::internal::Task, class base::internal::TaskSource *, class base::TaskTraits const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:504:5
#18 0x7ffbd225494e in base::internal::TaskTracker::RunAndPopNextTask(class base::internal::RegisteredTaskSource) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:394:5
#19 0x7ffbd223df85 in base::internal::WorkerThread::RunWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:473:36
#20 0x7ffbd223cd9f in base::internal::WorkerThread::RunPooledWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:359:3
#21 0x7ffbd214b9f3 in base::`anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:114:13
#22 0x7ffc78de9a6c (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x180059a6c)
#23 0x7ffccde7e8d6 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
#24 0x7ffccee51d1b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180011d1b)
previously allocated by thread T4 here:
#0 0x7ffc78dea28d (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x18005a28d)
#1 0x7ffbe85fe4ca in std::__Cr::make_unique C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include__memory\unique_ptr.h:754
#2 0x7ffbe85fe4ca in anonymous namespace'::CreateExtensionThrottleManager C:\b\s\w\ir\cache\builder\src\chrome\renderer\url_loader_throttle_provider_impl.cc:64 #3 0x7ffbe85fe4ca in URLLoaderThrottleProviderImpl::CreateThrottles(class base::optional_ref<class base::TokenType<class blink::LocalFrameTokenTypeMarker> const>, struct network::ResourceRequest const &) C:\b\s\w\ir\cache\builder\src\chrome\renderer\url_loader_throttle_provider_impl.cc:241:35 #4 0x7ffbcdf784c2 in blink::BackgroundURLLoader::Context::StartOnBackground(class scoped_refptr<class blink::WebBackgroundResourceFetchAssets>, class std::__Cr::unique_ptr<struct network::ResourceRequest, struct std::__Cr::default_delete<struct network::ResourceRequest>>, class url::Origin const &, bool, class WTF::Vector<class WTF::String, 0, class WTF::PartitionAllocator> const &, class std::__Cr::unique_ptr<class blink::ResourceLoadInfoNotifierWrapper, struct std::__Cr::default_delete<class blink::ResourceLoadInfoNotifierWrapper>>, bool, class std::__Cr::unique_ptr<class blink::BackgroundResponseProcessorFactory, struct std::__Cr::default_delete<class blink::BackgroundResponseProcessorFactory>>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\loader\fetch\url_loader\background_url_loader.cc:423:30 #5 0x7ffbcdf79950 in base::internal::DecayedFunctorTraits<void (Context::*)(scoped_refptr<blink::WebBackgroundResourceFetchAssets>, std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_delete<network::ResourceRequest> >, const url::Origin &, bool, const WTF::Vector<WTF::String,0,WTF::PartitionAllocator> &, std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_delete<blink::ResourceLoadInfoNotifierWrapper> >, bool, std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_delete<blink::BackgroundResponseProcessorFactory> >),scoped_refptr<blink::BackgroundURLLoader::Context> &&,scoped_refptr<blink::WebBackgroundResourceFetchAssets> &&,std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_delete<network::ResourceRequest> > &&,url::Origin &&,bool &&,WTF::Vector<WTF::String,0,WTF::PartitionAllocator> &&,std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_delete<blink::ResourceLoadInfoNotifierWrapper> > &&,bool &&,std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_delete<blink::BackgroundResponseProcessorFactory> > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731 #6 0x7ffbcdf79950 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (Context::*&&)(scoped_refptr<blink::WebBackgroundResourceFetchAssets>, std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_delete<network::ResourceRequest> >, const url::Origin &, bool, const WTF::Vector<WTF::String,0,WTF::PartitionAllocator> &, std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_delete<blink::ResourceLoadInfoNotifierWrapper> >, bool, std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_delete<blink::BackgroundResponseProcessorFactory> >),scoped_refptr<blink::BackgroundURLLoader::Context> &&,scoped_refptr<blink::WebBackgroundResourceFetchAssets> &&,std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_delete<network::ResourceRequest> > &&,url::Origin &&,bool &&,WTF::Vector<WTF::String,0,WTF::PartitionAllocator> &&,std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_delete<blink::ResourceLoadInfoNotifierWrapper> > &&,bool &&,std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_delete<blink::BackgroundResponseProcessorFactory> > &&>,void,0,1,2,3,4,5,6,7,8>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923 #7 0x7ffbcdf79950 in base::internal::Invoker<base::internal::FunctorTraits<void (Context::*&&)(scoped_refptr<blink::WebBackgroundResourceFetchAssets>, std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_delete<network::ResourceRequest> >, const url::Origin &, bool, const WTF::Vector<WTF::String,0,WTF::PartitionAllocator> &, std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_delete<blink::ResourceLoadInfoNotifierWrapper> >, bool, std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_delete<blink::BackgroundResponseProcessorFactory> >),scoped_refptr<blink::BackgroundURLLoader::Context> &&,scoped_refptr<blink::WebBackgroundResourceFetchAssets> &&,std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_delete<network::ResourceRequest> > &&,url::Origin &&,bool &&,WTF::Vector<WTF::String,0,WTF::PartitionAllocator> &&,std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_delete<blink::ResourceLoadInfoNotifierWrapper> > &&,bool &&,std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_delete<blink::BackgroundResponseProcessorFactory> > &&>,base::internal::BindState<1,1,0,void (Context::*)(scoped_refptr<blink::WebBackgroundResourceFetchAssets>, std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_delete<network::ResourceRequest> >, const url::Origin &, bool, const WTF::Vector<WTF::String,0,WTF::PartitionAllocator> &, std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_delete<blink::ResourceLoadInfoNotifierWrapper> >, bool, std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_delete<blink::BackgroundResponseProcessorFactory> >),scoped_refptr<blink::BackgroundURLLoader::Context>,scoped_refptr<blink::WebBackgroundResourceFetchAssets>,std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_delete<network::ResourceRequest> >,url::Origin,bool,WTF::Vector<WTF::String,0,WTF::PartitionAllocator>,std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_delete<blink::ResourceLoadInfoNotifierWrapper> >,bool,std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_delete<blink::BackgroundResponseProcessorFactory> > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060 #8 0x7ffbcdf79950 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl blink::BackgroundURLLoader::Context::*&&)(class scoped_refptr<class blink::WebBackgroundResourceFetchAssets>, class std::__Cr::unique_ptr<struct network::ResourceRequest, struct std::__Cr::default_delete<struct network::ResourceRequest>>, class url::Origin const &, bool, class WTF::Vector<class WTF::String, 0, class WTF::PartitionAllocator> const &, class std::__Cr::unique_ptr<class blink::ResourceLoadInfoNotifierWrapper, struct std::__Cr::default_delete<class blink::ResourceLoadInfoNotifierWrapper>>, bool, class std::__Cr::unique_ptr<class blink::BackgroundResponseProcessorFactory, struct std::__Cr::default_delete<class blink::BackgroundResponseProcessorFactory>>), class scoped_refptr<class blink::BackgroundURLLoader::Context> &&, class scoped_refptr<class blink::WebBackgroundResourceFetchAssets> &&, class std::__Cr::unique_ptr<struct network::ResourceRequest, struct std::__Cr::default_delete<struct network::ResourceRequest>> &&, class url::Origin &&, bool &&, class WTF::Vector<class WTF::String, 0, class WTF::PartitionAllocator> &&, class std::__Cr::unique_ptr<class blink::ResourceLoadInfoNotifierWrapper, struct std::__Cr::default_delete<class blink::ResourceLoadInfoNotifierWrapper>> &&, bool &&, class std::__Cr::unique_ptr<class blink::BackgroundResponseProcessorFactory, struct std::__Cr::default_delete<class blink::BackgroundResponseProcessorFactory>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl blink::BackgroundURLLoader::Context::*)(class scoped_refptr<class blink::WebBackgroundResourceFetchAssets>, class std::__Cr::unique_ptr<struct network::ResourceRequest, struct std::__Cr::default_delete<struct network::ResourceRequest>>, class url::Origin const &, bool, class WTF::Vector<class WTF::String, 0, class WTF::PartitionAllocator> const &, class std::__Cr::unique_ptr<class blink::ResourceLoadInfoNotifierWrapper, struct std::__Cr::default_delete<class blink::ResourceLoadInfoNotifierWrapper>>, bool, class std::__Cr::unique_ptr<class blink::BackgroundResponseProcessorFactory, struct std::__Cr::default_delete<class blink::BackgroundResponseProcessorFactory>>), class scoped_refptr<class blink::BackgroundURLLoader::Context>, class scoped_refptr<class blink::WebBackgroundResourceFetchAssets>, class std::__Cr::unique_ptr<struct network::ResourceRequest, struct std::__Cr::default_delete<struct network::ResourceRequest>>, class url::Origin, bool, class WTF::Vector<class WTF::String, 0, class WTF::PartitionAllocator>, class std::__Cr::unique_ptr<class blink::ResourceLoadInfoNotifierWrapper, struct std::__Cr::default_delete<class blink::ResourceLoadInfoNotifierWrapper>>, bool, class std::__Cr::unique_ptr<class blink::BackgroundResponseProcessorFactory, struct std::__Cr::default_delete<class blink::BackgroundResponseProcessorFactory>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12 #9 0x7ffbd23025d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156 #10 0x7ffbd23025d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34 #11 0x7ffbd225728c in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106 #12 0x7ffbd225728c in base::internal::TaskTracker::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:691 #13 0x7ffbd225728c in base::internal::TaskTracker::RunSkipOnShutdown(struct base::internal::Task &, class base::TaskTraits const &, class base::internal::TaskSource *, class base::internal::SequenceToken const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:676:3 #14 0x7ffbd225589a in base::internal::TaskTracker::RunTaskWithShutdownBehavior C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:706 #15 0x7ffbd225589a in base::internal::TaskTracker::RunTask(struct base::internal::Task, class base::internal::TaskSource *, class base::TaskTraits const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:504:5 #16 0x7ffbd225494e in base::internal::TaskTracker::RunAndPopNextTask(class base::internal::RegisteredTaskSource) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:394:5 #17 0x7ffbd223df85 in base::internal::WorkerThread::RunWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:473:36 #18 0x7ffbd223cd9f in base::internal::WorkerThread::RunPooledWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:359:3 #19 0x7ffbd214b9f3 in base::anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:114:13
#20 0x7ffc78de9a6c (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x180059a6c)
#21 0x7ffccde7e8d6 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
#22 0x7ffccee51d1b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180011d1b)
Thread T4 created by T0 here: #0 0x7ffc78de9982 (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x180059982) #1 0x7ffbd214aaf9 in base::`anonymous namespace’::CreateThreadInternal C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:182:7 #2 0x7ffbd223b37f in base::internal::WorkerThread::Start(class scoped_refptr<class base::SingleThreadTaskRunner>, class base::WorkerThreadObserver *) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:185:3 #3 0x7ffbd224d076 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group.cc:89:13 #4 0x7ffbd224cd5d in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group.cc:80:3 #5 0x7ffbd22416f7 in base::internal::ThreadGroupImpl::ScopedCommandsExecutor::~ScopedCommandsExecutor C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group_impl.cc:42 #6 0x7ffbd22416f7 in base::internal::ThreadGroupImpl::Start(unsigned __int64, unsigned __int64, class base::TimeDelta, class scoped_refptr<class base::SingleThreadTaskRunner>, class base::WorkerThreadObserver *, enum base::internal::ThreadGroup::WorkerEnvironment, bool, class std::__Cr::optional<class base::TimeDelta>) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group_impl.cc:249:3 #7 0x7ffbd22318f2 in base::internal::ThreadPoolImpl::Start(struct base::ThreadPoolInstance::InitParams const &, class base::WorkerThreadObserver ) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_pool_impl.cc:196:35 #8 0x7ffbdcc83600 in content::ChildProcess::ChildProcess(enum base::ThreadType, class std::__Cr::unique_ptr<struct base::ThreadPoolInstance::InitParams, struct std::__Cr::default_delete<struct base::ThreadPoolInstance::InitParams>>) C:\b\s\w\ir\cache\builder\src\content\child\child_process.h:117:38 #9 0x7ffbe7dd0f38 in content::RenderProcess::RenderProcess(class std::__Cr::unique_ptr<struct base::ThreadPoolInstance::InitParams, struct std::__Cr::default_delete<struct base::ThreadPoolInstance::InitParams>>) C:\b\s\w\ir\cache\builder\src\content\renderer\render_process.cc:18:7 #10 0x7ffbe7dd0601 in content::RenderProcessImpl::RenderProcessImpl(void) C:\b\s\w\ir\cache\builder\src\content\renderer\render_process_impl.cc:112:7 #11 0x7ffbe7dd0bd5 in content::RenderProcessImpl::Create(void) C:\b\s\w\ir\cache\builder\src\content\renderer\render_process_impl.cc:227:31 #12 0x7ffbe7cfeb1a in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:287:53 #13 0x7ffbcedc7fe6 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:783:14 #14 0x7ffbcedca381 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1157:10 #15 0x7ffbcedbe3f3 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359:36 #16 0x7ffbcedbefad in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:372:10 #17 0x7ffbbf632b0b in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12 #18 0x7ff693a047bb in MainDllLoader::Launch(struct HINSTANCE, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12 #19 0x7ff693a02021 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20 #20 0x7ff693eb896b in invoke_main D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78 #21 0x7ff693eb896b in __scrt_common_main_seh D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #22 0x7ffccde7e8d6 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6) #23 0x7ffccee51d1b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180011d1b)
SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\base\memory\raw_ptr_asan_hooks.cc:54:17 in base::internal::`anonymous namespace’::CrashImmediatelyOnUseAfterFree Shadow bytes around the buggy address: 0x116457cb4000: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 00 0x116457cb4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x116457cb4100: 00 fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x116457cb4180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x116457cb4200: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa =>0x116457cb4280: fa fa fa fa fa fa f7 fa[fd]fd fd fd fd fd fd fd 0x116457cb4300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x116457cb4380: fd fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x116457cb4400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x116457cb4480: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x116457cb4500: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb
==37512==ADDITIONAL INFO
==37512==Note: Please include this section with the ASan report. Task trace: #0 0x7ffbd281a6f8 in mojo::SimpleWatcher::Context::Notify(unsigned int, struct MojoHandleSignalsState, unsigned int) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc:102:13
Command line: "chrome.exe" --type=renderer --user-data-dir=c:/tmp/test --extension-process --no-pre-read-main-dll --no-sandbox --file-url-path-alias="/gen=C:\chromium_version\latest_asan\gen" --video-capture-use-gpu-memory-buffer --lang=zh-CN --device-scale-factor=1.75 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1745603129273034 --launch-time-ticks=399984962880 --metrics-shmem-handle=3088,i,10853463304360795435,6088019744846484161,2097152 --field-trial-handle=1964,i,14414722279579164423,17627674527126514385,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
MiraclePtr Status: MANUAL ANALYSIS REQUIRED This crash occurred while a raw_ptr<T> object containing a dangling pointer was being dereferenced. This crash occurred in the thread pool. The sequence which invoked the “free” is unknown, so the crash may have been caused by a race condition that is mislabeled as a use-after-free. Make sure that the “free” is sequenced after the “use” (e.g. both are on the same sequence, or the “free” is in a task posted after the “use”). Otherwise, the crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.
==37512==END OF ADDITIONAL INFO ==37512==ABORTING