Chrome · WebRTC
CVE-2026-11003
UAF in WebRTC
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
Contextthird_party/blink/renderer/platform/webrtc/webrtc_video_frame_adapter.cc |
modified | |
ifthird_party/blink/renderer/platform/webrtc/webrtc_video_frame_adapter.cc |
modified |
Files Changed
third_party/blink/renderer/platform/webrtc/webrtc_video_frame_adapter.cc
Patch
From 71feade96b744446b818ef9687ffe1dfc04e357f Mon Sep 17 00:00:00 2001 From: Ilya Nikolaevskiy <[email protected]> Date: Tue, 14 Apr 2026 02:38:52 -0700 Subject: [PATCH] Remove accelerated pool for RGB texture readback in webrtc. That pool can't be used in multithreaded webrtc environment. It's full of UAF, race conditions and other security issues. The removal will not noticeably impact the performance because this conversion here is a backup, happening only if feedback isn't acted upon yet in the canvas capture, where the same accelerated pool performs efficient conversion. Bug: 494823867 Change-Id: I8895838bec35f089b363cb4179a204f55fdc3096 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7748044 Commit-Queue: Ilya Nikolaevskiy <[email protected]> Reviewed-by: Dale Curtis <[email protected]> Cr-Commit-Position: refs/heads/main@{#1614335} --- diff --git a/third_party/blink/renderer/platform/webrtc/webrtc_video_frame_adapter.cc b/third_party/blink/renderer/platform/webrtc/webrtc_video_frame_adapter.cc index a9689c737..cfca8cb 100644 --- a/third_party/blink/renderer/platform/webrtc/webrtc_video_frame_adapter.cc +++ b/third_party/blink/renderer/platform/webrtc/webrtc_video_frame_adapter.cc @@ -29,7 +29,6 @@ #include "media/renderers/video_frame_rgba_to_yuva_converter.h" #include "mojo/public/cpp/bindings/callback_helpers.h" #include "third_party/blink/public/platform/platform.h" -#include "third_party/blink/renderer/platform/graphics/web_graphics_context_3d_video_frame_pool.h" #include "third_party/blink/renderer/platform/scheduler/public/main_thread.h" #include "third_party/blink/renderer/platform/scheduler/public/post_cross_thread_task.h" #include "third_party/blink/renderer/platform/webrtc/convert_to_webrtc_video_frame_buffer.h" @@ -53,54 +52,6 @@ IsApproxEquals(a.width(), b.width()) && IsApproxEquals(a.height(), b.height()); } - -class Context - : public media::RenderableMappableSharedImageVideoFramePool::Context { - public: - explicit Context( - scoped_refptr<viz::RasterContextProvider> raster_context_provider) - : raster_context_provider_(std::move(raster_context_provider)) {} - - scoped_refptr<gpu::ClientSharedImage> CreateSharedImage( - const gfx::Size& size, - gfx::BufferUsage buffer_usage, - const viz::SharedImageFormat& si_format, - const gfx::ColorSpace& color_space, - gpu::SharedImageUsageSet usage, - gpu::SyncToken& sync_token) override { - auto* sii = SharedImageInterface(); - if (!sii) { - return nullptr; - } - auto client_shared_image = sii->CreateSharedImage( - {si_format, size, color_space, usage, "WebRTCVideoFramePool"}, - gpu::kNullSurfaceHandle, buffer_usage); - if (!client_shared_image) { - return nullptr; - } - sync_token = sii->GenVerifiedSyncToken(); - return client_shared_image; - } - - void DestroySharedImage( - const gpu::SyncToken& sync_token, - scoped_refptr<gpu::ClientSharedImage> shared_image) override { - CHECK(shared_image); - shared_image->UpdateDestructionSyncToken(sync_token); - } - - const gpu::SharedImageCapabilities& GetCapabilities() override { - return SharedImageInterface()->GetCapabilities(); - } - - private: - gpu::SharedImageInterface* SharedImageInterface() const { - return raster_context_provider_->SharedImageInterface(); - } - - scoped_refptr<viz::RasterContextProvider> raster_context_provider_; -}; - } // namespace void WebRtcVideoFrameAdapter::SharedResources::SetRasterContextProvider( @@ -155,10 +106,6 @@ } else { // Provider exists but is not alive. Try to fetch a new one. SetRasterContextProvider(nullptr); - - // Since the accelerated frame pool is attached to the old provider, we - // need to release it here. - accelerated_frame_pool_.reset(); } } @@ -202,37 +149,6 @@ } } -bool CanUseGpuMemoryBufferReadback(media::VideoPixelFormat format, - gpu::SharedImageInterface* sii, - const gpu::Capabilities& caps) { - // Since ConvertToWebRtcVideoFrameBuffer will always produce an opaque frame - // (unless the input is already I420A), we allow using GMB readback from - // ABGR/ARGB/NV12 to NV12. - if (format != media::PIXEL_FORMAT_XBGR && - format != media::PIXEL_FORMAT_XRGB && - format != media::PIXEL_FORMAT_ABGR && - format != media::PIXEL_FORMAT_ARGB && - format != media::PIXEL_FORMAT_NV12) { - return false; - } - if (!sii) { - return false; - } - if (!caps.supports_rgb_to_yuv_conversion || !caps.supports_yuv_readback) { - DVLOG(1) << "YUV readback not supported."; - return false; - } -#if BUILDFLAG(IS_WIN) - // CopyToGpuMemoryBuffer is only supported for D3D shared images on Windows. - if (!sii->GetCapabilities().shared_image_d3d) { - DVLOG(1) << "CopyToGpuMemoryBuffer not supported."; - return false; - } -#endif // BUILDFLAG(IS_WIN) - return WebGraphicsContext3DVideoFramePool:: - IsGpuMemoryBufferReadbackFromTextureEnabled(); -} - scoped_refptr<media::VideoFrame> WebRtcVideoFrameAdapter::SharedResources::ConstructVideoFrameFromTexture( scoped_refptr<media::VideoFrame> source_frame) { @@ -252,93 +168,6 @@ viz::RasterContextProvider::ScopedRasterContextLock scoped_context( raster_context_provider.get()); - // NV12 textures shouldn't be readback via conversion to NV12. - if (!disable_gmb_frames_ && - CanUseGpuMemoryBufferReadback( - source_frame->format(), - raster_context_provider->SharedImageInterface(), - raster_context_provider->ContextCapabilities()) && - source_frame->format() != media::PIXEL_FORMAT_NV12) { - if (!accelerated_frame_pool_) { - accelerated_frame_pool_ = - media::RenderableMappableSharedImageVideoFramePool::Create( - std::make_unique<Context>(raster_context_provider)); - } - - scoped_refptr<media::VideoFrame> dst_frame; - { - // Blocking is necessary to create the GpuMemoryBuffer from this thread. - base::ScopedAllowBaseSyncPrimitivesOutsideBlockingScope allow_wait; - dst_frame = accelerated_frame_pool_->MaybeCreateVideoFrame( - source_frame->coded_size(), gfx::ColorSpace::CreateREC709()); - } - - if (dst_frame) { - CHECK(dst_frame->HasSharedImage()); - std::optional<gpu::SyncToken> blit_done_sync_token = - media::CopyRGBATextureToVideoFrame( - raster_context_provider.get(), source_frame->coded_size(), - source_frame->shared_image(), source_frame->acquire_sync_token(), - dst_frame.get()); - if (blit_done_sync_token) { - // CopyRGBATextureToVideoFrame() operates on mailboxes and not frames, - // so we must manually copy over properties relevant to the encoder. - // TODO(https://crbug.com/1272852): Consider bailing out of this path if - // visible_rect or natural_size is much smaller than coded_size, or - // copying only the necessary part. - if (dst_frame->visible_rect() != source_frame->visible_rect() || - dst_frame->natural_size() != source_frame->natural_size()) { - const auto dst_format = dst_frame->format(); - dst_frame = media::VideoFrame::WrapVideoFrame( - std::move(dst_frame), dst_format, source_frame->visible_rect(), - source_frame->natural_size()); - DCHECK(dst_frame); - } - dst_frame->set_timestamp(source_frame->timestamp()); - dst_frame->set_metadata(source_frame->metadata()); - - auto* ri = raster_context_provider->RasterInterface(); - DCHECK(ri); - -#if BUILDFLAG(IS_WIN) - // For shared memory GMBs on Windows we needed to explicitly request a - // copy from the shared image GPU texture to the GMB. - CHECK(dst_frame->HasMappableSharedImage()); - CHECK(!dst_frame->HasNativeMappableSharedImage()); - - auto* sii = raster_context_provider->SharedImageInterface(); - - const auto& mailbox = dst_frame->shared_image()->mailbox(); - sii->CopyToGpuMemoryBuffer(*blit_done_sync_token, mailbox); - - // Synchronize RasterInterface with SharedImageInterface.
Loading diff…
Original Bug Report
reported by [email protected]
Security: double-free in blink::WebRtcVideoFrameAdapter::SharedResources::ScaleAndMapFrameAsync
Steps to reproduce the problem
git checkout d9b172d77d035686b97163805763270e2790866e gn gen out/asan-0321 –args=“is_component_build=true is_debug=false is_asan=true symbol_level=2 dcheck_always_on=false treat_warnings_as_errors=false” ./out/asan-0321/Chromium.app/Contents/MacOS/Chromium –no-sandbox –user-data-dir=/tmp/userdata/t1 –enable-features=WebMachineLearningNeuralNetwork,WebrtcAcceleratedScaling –enable-unsafe-webgpu –js-flags=–expose-gc –enable-logging –v=1 http://127.0.0.1/poc.html?senders=3&rounds=32&hold_ms=4000 http://127.0.0.1/poc.html?senders=3&rounds=32&hold_ms=4000 http://127.0.0.1/poc.html?senders=3&rounds=32&hold_ms=4000 http://127.0.0.1/poc.html?senders=3&rounds=32&hold_ms=4000 –autoplay-policy=no-user-gesture-required
Problem Description
RCA and Bisect coming soon!
Summary
Security: double-free in blink::WebRtcVideoFrameAdapter::SharedResources::ScaleAndMapFrameAsync
Custom Questions
Type of crash:
–type=renderer
Crash state:
=================================================================
[1m[31m==95002==ERROR: AddressSanitizer: attempting double-free on 0x60300048d690 in thread T8:
[1m[0m==95002==WARNING: invalid path to external symbolizer!
==95002==WARNING: Failed to use and restart external symbolizer!
#0 0x000102c5d7b4 in __sanitizer_finish_switch_fiber+0xa14 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x657b4)
#1 0x000111ad6c80 in media::(anonymous namespace)::RenderableMappableSharedImageVideoFramePoolImpl::MaybeCreateVideoFrame(gfx::Size const&, gfx::ColorSpace const&)+0x1c0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libmedia.dylib:arm64+0x6dac80)
#2 0x00014beede9c in blink::WebRtcVideoFrameAdapter::SharedResources::ScaleAndMapFrameAsync(scoped_refptr<media::VideoFrame>, base::OnceCallback<void (scoped_refptr<media::VideoFrame>)>)+0x86c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_platform.dylib:arm64+0x8b9e9c)
#3 0x00014bef67bc in blink::WebRtcVideoFrameAdapter::PrepareMappedBufferAsync(unsigned long, unsigned long, webrtc::scoped_refptr<webrtc::VideoFrameBuffer::PreparedFrameHandler>, unsigned long)+0x378 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_platform.dylib:arm64+0x8c27bc)
#4 0x00013360bf14 in webrtc::VideoStreamEncoder::MaybePrepareVideoFrame(webrtc::VideoFrame const&, long long)+0x544 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libthird_party_webrtc_overrides_webrtc_component.dylib:arm64+0xabbf14)
#5 0x00013360b414 in webrtc::VideoStreamEncoder::OnFrame(webrtc::Timestamp, bool, webrtc::VideoFrame const&)+0x688 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libthird_party_webrtc_overrides_webrtc_component.dylib:arm64+0xabb414)
#6 0x000132b721cc in blink::WebRtcTaskQueue::RunTask(absl::AnyInvocable<void () &&>)+0x118 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libthird_party_webrtc_overrides_webrtc_component.dylib:arm64+0x221cc)
#7 0x000132b737e0 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::WebRtcTaskQueue::*&&)(absl::AnyInvocable<void () &&>), blink::WebRtcTaskQueue*, absl::AnyInvocable<void () &&>&&>, base::internal::BindState<true, true, false, void (blink::WebRtcTaskQueue::*)(absl::AnyInvocable<void () &&>), base::internal::RetainedRefWrapper<blink::WebRtcTaskQueue>, absl::AnyInvocable<void () &&>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x190 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libthird_party_webrtc_overrides_webrtc_component.dylib:arm64+0x237e0)
#8 0x000104bfb674 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x1ff674)
#9 0x000104cc1880 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0x1f0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c5880)
#10 0x000104cc1acc in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0xec (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c5acc)
#11 0x000104cc022c in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType)+0x3fc (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c422c)
#12 0x000104cbf4f4 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource)+0x548 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c34f4)
#13 0x000104ce5974 in base::internal::WorkerThread::RunWorker()+0x834 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e9974)
#14 0x000104ce4e2c in base::internal::WorkerThread::RunPooledWorker()+0xac (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e8e2c)
#15 0x000104ce47e4 in base::internal::WorkerThread::ThreadMain()+0x1e0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e87e4)
#16 0x000104d86284 in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x38a284)
#17 0x000102c49870 in __sanitizer_weak_hook_memcmp+0x36750 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x51870)
#18 0x00010235d088 in _pthread_start+0x84 (/usr/lib/system/introspection/libsystem_pthread.dylib:arm64e+0x1088)
#19 0x000102366f4c in thread_start+0x4 (/usr/lib/system/introspection/libsystem_pthread.dylib:arm64e+0xaf4c)
[1m[32m0x60300048d690 is located 0 bytes inside of 24-byte region [0x60300048d690,0x60300048d6a8)
[1m[0m[1m[35mfreed by thread T29 here:[1m[0m
#0 0x000102c5d7b4 in __sanitizer_finish_switch_fiber+0xa14 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x657b4)
#1 0x000111ad8198 in media::(anonymous namespace)::InternalRefCountedPool::OnVideoFrameDestroyed(std::__Cr::unique_ptr<media::(anonymous namespace)::FrameResources, std::__Cr::default_delete<media::(anonymous namespace)::FrameResources>>, gpu::SyncToken const&, bool)+0x118 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libmedia.dylib:arm64+0x6dc198)
#2 0x000111ad8fbc in base::internal::Invoker<base::internal::FunctorTraits<void (media::(anonymous namespace)::InternalRefCountedPool::*&&)(std::__Cr::unique_ptr<media::(anonymous namespace)::FrameResources, std::__Cr::default_delete<media::(anonymous namespace)::FrameResources>>, gpu::SyncToken const&, bool), media::(anonymous namespace)::InternalRefCountedPool*&&, std::__Cr::unique_ptr<media::(anonymous namespace)::FrameResources, std::__Cr::default_delete<media::(anonymous namespace)::FrameResources>>&&>, base::internal::BindState<true, true, false, void (media::(anonymous namespace)::InternalRefCountedPool::*)(std::__Cr::unique_ptr<media::(anonymous namespace)::FrameResources, std::__Cr::default_delete<media::(anonymous namespace)::FrameResources>>, gpu::SyncToken const&, bool), scoped_refptr<media::(anonymous namespace)::InternalRefCountedPool>, std::__Cr::unique_ptr<media::(anonymous namespace)::FrameResources, std::__Cr::default_delete<media::(anonymous namespace)::FrameResources>>>, void (gpu::SyncToken const&, bool)>::RunOnce(base::internal::BindStateBase*, gpu::SyncToken const&, bool)+0x148 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libmedia.dylib:arm64+0x6dcfbc)
#3 0x000111ad9b30 in base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::SyncToken const&, bool)>&&, gpu::SyncToken&&, bool&&>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::SyncToken const&, bool)>, gpu::SyncToken, bool>, void ()>::RunOnce(base::internal::BindStateBase*)+0x16c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libmedia.dylib:arm64+0x6ddb30)
#4 0x000104bfb674 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x1ff674)
#5 0x000104cc1880 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0x1f0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c5880)
#6 0x000104cc1acc in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0xec (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c5acc)
#7 0x000104cc022c in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType)+0x3fc (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c422c)
#8 0x000104cbf4f4 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource)+0x548 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c34f4)
#9 0x000104ce5974 in base::internal::WorkerThread::RunWorker()+0x834 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e9974)
#10 0x000104ce4e2c in base::internal::WorkerThread::RunPooledWorker()+0xac (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e8e2c)
#11 0x000104ce47e4 in base::internal::WorkerThread::ThreadMain()+0x1e0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e87e4)
#12 0x000104d86284 in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x38a284)
#13 0x000102c49870 in __sanitizer_weak_hook_memcmp+0x36750 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x51870)
#14 0x00010235d088 in _pthread_start+0x84 (/usr/lib/system/introspection/libsystem_pthread.dylib:arm64e+0x1088)
#15 0x000102366f4c in thread_start+0x4 (/usr/lib/system/introspection/libsystem_pthread.dylib:arm64e+0xaf4c)
[1m[35mpreviously allocated by thread T28 here:[1m[0m
#0 0x000102c5d3bc in __sanitizer_finish_switch_fiber+0x61c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x653bc)
#1 0x000111ad80ec in media::(anonymous namespace)::InternalRefCountedPool::OnVideoFrameDestroyed(std::__Cr::unique_ptr<media::(anonymous namespace)::FrameResources, std::__Cr::default_delete<media::(anonymous namespace)::FrameResources>>, gpu::SyncToken const&, bool)+0x6c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libmedia.dylib:arm64+0x6dc0ec)
#2 0x000111ad8fbc in base::internal::Invoker<base::internal::FunctorTraits<void (media::(anonymous namespace)::InternalRefCountedPool::*&&)(std::__Cr::unique_ptr<media::(anonymous namespace)::FrameResources, std::__Cr::default_delete<media::(anonymous namespace)::FrameResources>>, gpu::SyncToken const&, bool), media::(anonymous namespace)::InternalRefCountedPool*&&, std::__Cr::unique_ptr<media::(anonymous namespace)::FrameResources, std::__Cr::default_delete<media::(anonymous namespace)::FrameResources>>&&>, base::internal::BindState<true, true, false, void (media::(anonymous namespace)::InternalRefCountedPool::*)(std::__Cr::unique_ptr<media::(anonymous namespace)::FrameResources, std::__Cr::default_delete<media::(anonymous namespace)::FrameResources>>, gpu::SyncToken const&, bool), scoped_refptr<media::(anonymous namespace)::InternalRefCountedPool>, std::__Cr::unique_ptr<media::(anonymous namespace)::FrameResources, std::__Cr::default_delete<media::(anonymous namespace)::FrameResources>>>, void (gpu::SyncToken const&, bool)>::RunOnce(base::internal::BindStateBase*, gpu::SyncToken const&, bool)+0x148 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libmedia.dylib:arm64+0x6dcfbc)
#3 0x000111ad9b30 in base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::SyncToken const&, bool)>&&, gpu::SyncToken&&, bool&&>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::SyncToken const&, bool)>, gpu::SyncToken, bool>, void ()>::RunOnce(base::internal::BindStateBase*)+0x16c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libmedia.dylib:arm64+0x6ddb30)
#4 0x000104bfb674 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x1ff674)
#5 0x000104cc1880 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0x1f0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c5880)
#6 0x000104cc1acc in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0xec (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c5acc)
#7 0x000104cc022c in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType)+0x3fc (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c422c)
#8 0x000104cbf4f4 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource)+0x548 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c34f4)
#9 0x000104ce5974 in base::internal::WorkerThread::RunWorker()+0x834 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e9974)
#10 0x000104ce4e2c in base::internal::WorkerThread::RunPooledWorker()+0xac (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e8e2c)
#11 0x000104ce47e4 in base::internal::WorkerThread::ThreadMain()+0x1e0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e87e4)
#12 0x000104d86284 in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x38a284)
#13 0x000102c49870 in __sanitizer_weak_hook_memcmp+0x36750 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x51870)
#14 0x00010235d088 in _pthread_start+0x84 (/usr/lib/system/introspection/libsystem_pthread.dylib:arm64e+0x1088)
#15 0x000102366f4c in thread_start+0x4 (/usr/lib/system/introspection/libsystem_pthread.dylib:arm64e+0xaf4c)
Thread T8 created by T0 here:
#0 0x000102c4395c in __sanitizer_weak_hook_memcmp+0x3083c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4b95c)
#1 0x000104d85848 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType)+0x26c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x389848)
#2 0x000104ce3568 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*)+0x27c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e7568)
#3 0x000104cc4128 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush()+0x244 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c8128)
#4 0x000104cc3e84 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor()+0x44 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c7e84)
#5 0x000104ccb0a4 in base::internal::ThreadGroupImpl::Start(unsigned long, unsigned long, base::TimeDelta, scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*, base::internal::ThreadGroup::WorkerEnvironment, bool, std::__Cr::optional<base::TimeDelta>)+0x3b0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2cf0a4)
#6 0x000104cd745c in base::internal::ThreadPoolImpl::Start(base::ThreadPoolInstance::InitParams const&, base::WorkerThreadObserver*)+0x125c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2db45c)
#7 0x00013d67171c in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>, bool)+0x314 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0xb971c)
#8 0x000141156504 in content::RenderProcess::RenderProcess(std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>)+0x24 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3b9e504)
#9 0x0001411565b4 in content::RenderProcessImpl::RenderProcessImpl()+0x4c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3b9e5b4)
#10 0x000141184bf0 in content::RendererMain(content::MainFunctionParams)+0x5ac (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3bccbf0)
#11 0x0001413c6748 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*)+0x420 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3e0e748)
#12 0x0001413c88c8 in content::ContentMainRunnerImpl::Run()+0x53c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3e108c8)
#13 0x0001413c41d8 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x858 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3e0c1d8)
#14 0x0001413c46c8 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3e0c6c8)
#15 0x00011a81f7b4 in ChromeMain+0x490 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libchrome_dll.dylib:arm64+0xb7b4)
#16 0x0001022c0b94 in main+0x254 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7745.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer):arm64+0x100000b94)
#17 0x00019f3e1d50 in start+0x1c0c (/usr/lib/dyld:arm64e+0x8d50)
Thread T29 created by T25 here:
#0 0x000102c4395c in __sanitizer_weak_hook_memcmp+0x3083c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4b95c)
#1 0x000104d85848 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType)+0x26c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x389848)
#2 0x000104ce3568 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*)+0x27c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e7568)
#3 0x000104cc4128 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush()+0x244 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c8128)
#4 0x000104cc3e84 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor()+0x44 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c7e84)
#5 0x000104ccb99c in base::internal::ThreadGroupImpl::PushTaskSourceAndWakeUpWorkers(base::internal::RegisteredTaskSourceAndTransaction)+0x18c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2cf99c)
#6 0x000104cdca88 in base::internal::ThreadPoolImpl::PostTaskWithSequenceNow(base::internal::Task, scoped_refptr<base::internal::Sequence>)+0x358 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e0a88)
#7 0x000104cdd228 in base::internal::ThreadPoolImpl::PostTaskWithSequence(base::internal::Task, scoped_refptr<base::internal::Sequence>)+0x4dc (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e1228)
#8 0x000104ca36dc in base::internal::PooledSequencedTaskRunner::PostDelayedTask(base::Location const&, base::OnceCallback<void ()>, base::TimeDelta)+0x290 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2a76dc)
#9 0x000104c91440 in base::TaskRunner::PostTask(base::Location const&, base::OnceCallback<void ()>)+0x130 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x295440)
#10 0x000132b72584 in blink::WebRtcTaskQueue::PostTaskImpl(absl::AnyInvocable<void () &&>, webrtc::TaskQueueBase::PostTaskTraits const&, base::Location const&)+0x2a8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libthird_party_webrtc_overrides_webrtc_component.dylib:arm64+0x22584)
#11 0x0001335cfb88 in webrtc::(anonymous namespace)::FrameCadenceAdapterImpl::OnFrame(webrtc::VideoFrame const&)+0x31c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libthird_party_webrtc_overrides_webrtc_component.dylib:arm64+0xa7fb88)
#12 0x00013321ca5c in webrtc::VideoBroadcaster::OnFrame(webrtc::VideoFrame const&)+0x4e4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libthird_party_webrtc_overrides_webrtc_component.dylib:arm64+0x6cca5c)
#13 0x000133214fb0 in webrtc::AdaptedVideoTrackSource::OnFrame(webrtc::VideoFrame const&)+0x2b4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libthird_party_webrtc_overrides_webrtc_component.dylib:arm64+0x6c4fb0)
#14 0x00014be07150 in blink::WebRtcVideoTrackSource::DeliverFrame(scoped_refptr<media::VideoFrame>, std::__Cr::optional<gfx::Rect>, long long, std::__Cr::optional<webrtc::Timestamp>, std::__Cr::optional<webrtc::Timestamp>)+0x93c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_platform.dylib:arm64+0x7d3150)
#15 0x00014be05cfc in blink::WebRtcVideoTrackSource::ComputeMetadataAndDeliverFrame(scoped_refptr<media::VideoFrame>, long long)+0xd28 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_platform.dylib:arm64+0x7d1cfc)
#16 0x00014be04d9c in blink::WebRtcVideoTrackSource::TryProcessPendingFrames()+0x214 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_platform.dylib:arm64+0x7d0d9c)
#17 0x00014be03b3c in blink::WebRtcVideoTrackSource::OnFrameCaptured(scoped_refptr<media::VideoFrame>)+0x9b0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_platform.dylib:arm64+0x7cfb3c)
#18 0x00017002421c in blink::MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter::OnVideoFrameOnNetworkThread(scoped_refptr<media::VideoFrame>)+0x134 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_modules.dylib:arm64+0x24e421c)
#19 0x0001700275c0 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter::*&&)(scoped_refptr<media::VideoFrame>), scoped_refptr<blink::MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter>&&, scoped_refptr<media::VideoFrame>&&>, base::internal::BindState<true, true, false, void (blink::MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter::*)(scoped_refptr<media::VideoFrame>), scoped_refptr<blink::MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter>, scoped_refptr<media::VideoFrame>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x160 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_modules.dylib:arm64+0x24e75c0)
#20 0x000104bfb674 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x1ff674)
#21 0x000104c791ac in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x88c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x27d1ac)
#22 0x000104c78564 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x27c564)
#23 0x000104a9cab4 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+0x228 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0xa0ab4)
#24 0x000104c7a568 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x32c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x27e568)
#25 0x000104b669e4 in base::RunLoop::Run(base::Location const&)+0x430 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x16a9e4)
#26 0x000104d13a3c in base::Thread::Run(base::RunLoop*)+0xd8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x317a3c)
#27 0x000104d13e9c in base::Thread::ThreadMain()+0x3d8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x317e9c)
#28 0x000104d86284 in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x38a284)
#29 0x000102c49870 in __sanitizer_weak_hook_memcmp+0x36750 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x51870)
#30 0x00010235d088 in _pthread_start+0x84 (/usr/lib/system/introspection/libsystem_pthread.dylib:arm64e+0x1088)
#31 0x000102366f4c in thread_start+0x4 (/usr/lib/system/introspection/libsystem_pthread.dylib:arm64e+0xaf4c)
Thread T25 created by T0 here:
#0 0x000102c4395c in __sanitizer_weak_hook_memcmp+0x3083c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4b95c)
#1 0x000104d85848 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType)+0x26c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x389848)
#2 0x000104d1271c in base::Thread::StartWithOptions(base::Thread::Options)+0x498 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x31671c)
#3 0x00017002c408 in blink::PeerConnectionDependencyFactory::CreatePeerConnectionFactory()+0x33c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_modules.dylib:arm64+0x24ec408)
#4 0x00017002c014 in blink::PeerConnectionDependencyFactory::GetPcFactory()+0xc8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_modules.dylib:arm64+0x24ec014)
#5 0x00017003360c in blink::PeerConnectionDependencyFactory::CreatePeerConnection(webrtc::PeerConnectionInterface::RTCConfiguration const&, blink::WebLocalFrame*, webrtc::PeerConnectionObserver*, blink::ExceptionState&)+0x124 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_modules.dylib:arm64+0x24f360c)
#6 0x0001701027b4 in blink::RTCPeerConnectionHandler::Initialize(blink::ExecutionContext*, webrtc::PeerConnectionInterface::RTCConfiguration const&, blink::WebLocalFrame*, blink::ExceptionState&)+0x600 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_modules.dylib:arm64+0x25c27b4)
#7 0x0001700bf0c0 in blink::RTCPeerConnection::RTCPeerConnection(blink::ExecutionContext*, webrtc::PeerConnectionInterface::RTCConfiguration, bool, blink::ExceptionState&)+0x794 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_modules.dylib:arm64+0x257f0c0)
#8 0x0001700be7c0 in blink::RTCPeerConnection* blink::MakeGarbageCollected<blink::RTCPeerConnection, blink::ExecutionContext*&, webrtc::PeerConnectionInterface::RTCConfiguration, bool, blink::ExceptionState&>(blink::ExecutionContext*&, webrtc::PeerConnectionInterface::RTCConfiguration&&, bool&&, blink::ExceptionState&)+0x1a8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_modules.dylib:arm64+0x257e7c0)
#9 0x0001700bc5bc in blink::RTCPeerConnection::Create(blink::ExecutionContext*, blink::RTCConfiguration const*, blink::ExceptionState&)+0x46c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_modules.dylib:arm64+0x257c5bc)
#10 0x00016e842520 in blink::(anonymous namespace)::v8_rtc_peer_connection::ConstructorCallback(v8::FunctionCallbackInfo<v8::Value> const&)+0x3ac (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_modules.dylib:arm64+0xd02520)
#11 0x000160fafb24 in v8::internal::FunctionCallbackArguments::CallOrConstruct(v8::internal::Isolate*, v8::internal::Tagged<v8::internal::FunctionTemplateInfo>, bool)+0x284 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libv8.dylib:arm64+0x353b24)
#12 0x000160fac840 in v8::internal::Builtin_Impl_HandleApiConstruct(v8::internal::BuiltinArguments, v8::internal::Isolate*)+0x76c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libv8.dylib:arm64+0x350840)
#13 0x0003233fb5e8 (<unknown module>)
#14 0x00032334ede0 (<unknown module>)
#15 0x0003234fcfb0 (<unknown module>)
#16 0x00032334e33c (<unknown module>)
#17 0x00032334e33c (<unknown module>)
#18 0x00032334e33c (<unknown module>)
#19 0x00032334b340 (<unknown module>)
#20 0x00032334b038 (<unknown module>)
#21 0x000161299d54 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&)+0x1c7c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libv8.dylib:arm64+0x63dd54)
#22 0x00016129b448 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>)+0x204 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libv8.dylib:arm64+0x63f448)
#23 0x000160e83e88 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>)+0x5a4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libv8.dylib:arm64+0x227e88)
#24 0x0001504b6b84 in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local<v8::Script>, v8::Local<v8::Data>, blink::ExecutionContext*)+0x628 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x19ab84)
#25 0x0001504b7f84 in blink::V8ScriptRunner::CompileAndRunScript(blink::ScriptState*, blink::ClassicScript*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption)+0x8e4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x19bf84)
#26 0x00015374e85c in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption)+0x1a0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x343285c)
#27 0x0001537a937c in blink::Script::RunScriptOnScriptState(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption)+0x1f8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x348d37c)
#28 0x0001537a9760 in blink::Script::RunScript(blink::LocalDOMWindow*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption)+0x140 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x348d760)
#29 0x0001537a8864 in blink::PendingScript::ExecuteScriptBlockInternal(blink::Script*, blink::ScriptElementBase*, bool, bool, bool, base::TimeTicks, bool)+0x420 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x348c864)
#30 0x0001537a78bc in blink::PendingScript::ExecuteScriptBlock()+0xb94 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x348b8bc)
#31 0x0001537aeb44 in blink::ScriptLoader::PrepareScript(blink::ScriptLoader::ParserBlockingInlineOption, blink::TextPosition const&)+0x2c70 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x3492b44)
#32 0x000153760aa4 in blink::HTMLParserScriptRunner::ProcessScriptElementInternal(blink::Element*, blink::TextPosition const&)+0x3ec (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x3444aa4)
#33 0x0001537603fc in blink::HTMLParserScriptRunner::ProcessScriptElement(blink::Element*, blink::TextPosition const&)+0xac (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x34443fc)
#34 0x000154281d1c in blink::HTMLDocumentParser::RunScriptsForPausedTreeBuilder()+0x1a4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x3f65d1c)
#35 0x00015427e9a8 in blink::HTMLDocumentParser::PumpTokenizer()+0x5e8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x3f629a8)
#36 0x00015427d1ec in blink::HTMLDocumentParser::PumpTokenizerIfPossible()+0x350 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x3f611ec)
#37 0x0001542866c0 in blink::HTMLDocumentParser::FinishAppend()+0x134 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x3f6a6c0)
#38 0x000154286cf0 in blink::HTMLDocumentParser::CommitPreloadedData()+0x1c4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x3f6acf0)
#39 0x00015308f180 in blink::DocumentLoader::StartLoadingResponse()+0x4c4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x2d73180)
#40 0x00015309be90 in blink::DocumentLoader::CommitNavigation()+0x1b98 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x2d7fe90)
#41 0x0001530f857c in blink::FrameLoader::CommitDocumentLoader(blink::DocumentLoader*, blink::HistoryItem*, blink::CommitReason)+0x508 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x2ddc57c)
#42 0x00015310214c in blink::FrameLoader::CommitNavigation(std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>, std::__Cr::unique_ptr<blink::WebDocumentLoader::ExtraData, std::__Cr::default_delete<blink::WebDocumentLoader::ExtraData>>, blink::CommitReason)+0x13b4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x2de614c)
#43 0x000151c0e0dc in blink::WebLocalFrameImpl::CommitNavigation(std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>, std::__Cr::unique_ptr<blink::WebDocumentLoader::ExtraData, std::__Cr::default_delete<blink::WebDocumentLoader::ExtraData>>)+0x4f4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_core.dylib:arm64+0x18f20dc)
#44 0x0001410ecdb8 in content::RenderFrameImpl::CommitNavigationWithParams(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>)+0xe24 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3b34db8)
#45 0x000141139550 in void base::internal::DecayedFunctorTraits<void (content::RenderFrameImpl::*)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>), base::WeakPtr<content::RenderFrameImpl>&&, mojo::StructPtr<blink::mojom::CommonNavigationParams>&&, mojo::StructPtr<blink::mojom::CommitNavigationParams>&&, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>&&, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>&&, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>&&, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::StructPtr<content::mojom::CookieManagerInfo>&&, mojo::StructPtr<content::mojom::StorageInfo>&&, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>&&>::Invoke<void (content::RenderFrameImpl::*)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>), base::WeakPtr<content::RenderFrameImpl> const&, mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>>(void (content::RenderFrameImpl::*)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>), base::WeakPtr<content::RenderFrameImpl> const&, mojo::StructPtr<blink::mojom::CommonNavigationParams>&&, mojo::StructPtr<blink::mojom::CommitNavigationParams>&&, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>&&, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>&&, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>&&, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::StructPtr<content::mojom::CookieManagerInfo>&&, mojo::StructPtr<content::mojom::StorageInfo>&&, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>&&, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>&&)+0x384 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3b81550)
#46 0x000141139120 in base::internal::Invoker<base::internal::FunctorTraits<void (content::RenderFrameImpl::*&&)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>), base::WeakPtr<content::RenderFrameImpl>&&, mojo::StructPtr<blink::mojom::CommonNavigationParams>&&, mojo::StructPtr<blink::mojom::CommitNavigationParams>&&, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>&&, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>&&, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>&&, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::StructPtr<content::mojom::CookieManagerInfo>&&, mojo::StructPtr<content::mojom::StorageInfo>&&, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>&&>, base::internal::BindState<true, true, false, void (content::RenderFrameImpl::*)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>), base::WeakPtr<content::RenderFrameImpl>, mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>>, void (std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>)>::RunOnce(base::internal::BindStateBase*, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>&&)+0x164 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3b81120)
#47 0x0001410edbe8 in base::OnceCallback<void (std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>)>::Run(std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>) &&+0x148 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3b35be8)
#48 0x0001410e86cc in content::RenderFrameImpl::CommitNavigation(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, base::TokenType<blink::DocumentTokenTypeMarker> const&, base::UnguessableToken const&, base::Uuid const&, mojo::StructPtr<blink::mojom::PolicyContainer>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, base::OnceCallback<void (mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>)>)+0x2960 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3b306cc)
#49 0x0001410c8860 in content::NavigationClient::CommitNavigation(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, base::TokenType<blink::DocumentTokenTypeMarker> const&, base::UnguessableToken const&, base::Uuid const&, mojo::StructPtr<blink::mojom::PolicyContainer>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, base::OnceCallback<void (mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>)>)+0x510 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3b10860)
#50 0x00013dbaf708 in content::mojom::NavigationClientStubDispatch::AcceptWithResponder(content::mojom::NavigationClient*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_delete<mojo::MessageReceiverWithStatus>>)+0xe28 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x5f7708)
#51 0x000102745de0 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*)+0x8b8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libmojo_public_cpp_bindings.dylib:arm64+0x25de0)
#52 0x00010275c090 in mojo::MessageDispatcher::Accept(mojo::Message*)+0x2f0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libmojo_public_cpp_bindings.dylib:arm64+0x3c090)
#53 0x00010274b018 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*)+0x148 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libmojo_public_cpp_bindings.dylib:arm64+0x2b018)
#54 0x0001093e9c80 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification)+0x3e8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libipc.dylib:arm64+0x39c80)
#55 0x0001093ebcf8 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*)+0x1b8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libipc.dylib:arm64+0x3bcf8)
#56 0x000104bfb674 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x1ff674)
#57 0x000104c791ac in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x88c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x27d1ac)
#58 0x000104c78564 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x27c564)
#59 0x000104a9cab4 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+0x228 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0xa0ab4)
#60 0x000104c7a568 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x32c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x27e568)
#61 0x000104b669e4 in base::RunLoop::Run(base::Location const&)+0x430 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x16a9e4)
#62 0x000141184ed0 in content::RendererMain(content::MainFunctionParams)+0x88c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3bcced0)
#63 0x0001413c6748 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*)+0x420 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3e0e748)
#64 0x0001413c88c8 in content::ContentMainRunnerImpl::Run()+0x53c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3e108c8)
#65 0x0001413c41d8 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x858 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3e0c1d8)
#66 0x0001413c46c8 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libcontent.dylib:arm64+0x3e0c6c8)
#67 0x00011a81f7b4 in ChromeMain+0x490 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libchrome_dll.dylib:arm64+0xb7b4)
#68 0x0001022c0b94 in main+0x254 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7745.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer):arm64+0x100000b94)
#69 0x00019f3e1d50 in start+0x1c0c (/usr/lib/dyld:arm64e+0x8d50)
Thread T28 created by T8 here:
#0 0x000102c4395c in __sanitizer_weak_hook_memcmp+0x3083c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4b95c)
#1 0x000104d85848 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType)+0x26c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x389848)
#2 0x000104ce3568 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*)+0x27c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e7568)
#3 0x000104cc4128 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush()+0x244 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c8128)
#4 0x000104cc3e84 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor()+0x44 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2c7e84)
#5 0x000104ccd9c8 in base::internal::ThreadGroupImpl::WorkerDelegate::GetWork(base::internal::WorkerThread*)+0x2cc (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2d19c8)
#6 0x000104ce5838 in base::internal::WorkerThread::RunWorker()+0x6f8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e9838)
#7 0x000104ce4e2c in base::internal::WorkerThread::RunPooledWorker()+0xac (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e8e2c)
#8 0x000104ce47e4 in base::internal::WorkerThread::ThreadMain()+0x1e0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x2e87e4)
#9 0x000104d86284 in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libbase.dylib:arm64+0x38a284)
#10 0x000102c49870 in __sanitizer_weak_hook_memcmp+0x36750 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libclang_rt.asan_osx_dynamic.dylib:arm64+0x51870)
#11 0x00010235d088 in _pthread_start+0x84 (/usr/lib/system/introspection/libsystem_pthread.dylib:arm64e+0x1088)
#12 0x000102366f4c in thread_start+0x4 (/usr/lib/system/introspection/libsystem_pthread.dylib:arm64e+0xaf4c)
SUMMARY: AddressSanitizer: double-free (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libmedia.dylib:arm64+0x6dac80) in media::(anonymous namespace)::RenderableMappableSharedImageVideoFramePoolImpl::MaybeCreateVideoFrame(gfx::Size const&, gfx::ColorSpace const&)+0x1c0
==95002==ADDITIONAL INFO
==95002==Note: Please include this section with the ASan report.
Task trace:
#0 0x0001335db918 in webrtc::(anonymous namespace)::VSyncEncodeAdapterMode::EncodeAllEnqueuedFrames()+0x4ec (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libthird_party_webrtc_overrides_webrtc_component.dylib:arm64+0xa8b918)
#1 0x0001335dac14 in webrtc::(anonymous namespace)::VSyncEncodeAdapterMode::OnFrame(webrtc::Timestamp, bool, webrtc::VideoFrame const&)+0x278 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libthird_party_webrtc_overrides_webrtc_component.dylib:arm64+0xa8ac14)
#2 0x0001335cfb2c in webrtc::(anonymous namespace)::FrameCadenceAdapterImpl::OnFrame(webrtc::VideoFrame const&)+0x2c0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libthird_party_webrtc_overrides_webrtc_component.dylib:arm64+0xa7fb2c)
#3 0x000170023b3c in blink::MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter::OnVideoFrameOnIO(scoped_refptr<media::VideoFrame>, base::TimeTicks)+0x12c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0321/libblink_modules.dylib:arm64+0x24e3b3c)
Additional Data
Category: Security
Chrome Channel: Not sure
Regression: N/A \
References
On This Page