=================================================================
==39432==ERROR: AddressSanitizer: heap-use-after-free on address 0x12a6a8aec854 at pc 0x7ff8e93af82a bp 0x00d6d49fa030 sp 0x00d6d49fa078
READ of size 4 at 0x12a6a8aec854 thread T0
    #0 0x7ff8e93af829 in dawn::native::d3d12::Pageable::IsResidencyLocked(void) const C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\PageableD3D12.cpp:86:12
    #1 0x7ff8e93c8159 in dawn::native::d3d12::ResidencyManager::EnsureHeapsAreResident(class dawn::native::d3d12::Heap **, unsigned __int64) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\ResidencyManagerD3D12.cpp:263:19
    #2 0x7ff8e9398acf in dawn::native::d3d12::CommandRecordingContext::ExecuteCommandList(class dawn::native::d3d12::Device *, struct ID3D12CommandQueue *) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\CommandRecordingContext.cpp:77:5
    #3 0x7ff8e93bee55 in dawn::native::d3d12::Queue::SubmitPendingCommandsImpl(void) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\QueueD3D12.cpp:133:5
    #4 0x7ff8e9163d98 in dawn::native::ExecutionQueueBase::SubmitPendingCommands(void) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\ExecutionQueue.cpp:112:19
    #5 0x7ff8e93a4938 in dawn::native::d3d12::Device::TickImpl(void) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\DeviceD3D12.cpp:366:5
    #6 0x7ff8e90c37d9 in dawn::native::DeviceBase::Destroy(void) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:665:22
    #7 0x7ff8e8fa2258 in dawn::native::NativeDeviceDestroy(struct WGPUDeviceImpl *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\native\ProcTable.cpp:921:15
    #8 0x7ff8fe9c77c1 in wgpu::Device::Destroy C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\include\dawn\webgpu_cpp.h:8726
    #9 0x7ff8fe9c77c1 in gpu::webgpu::`anonymous namespace'::WebGPUDecoderImpl::Destroy C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1235:21
    #10 0x7ff8fe9e1095 in gpu::WebGPUCommandBufferStub::~WebGPUCommandBufferStub C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\webgpu_command_buffer_stub.cc:59
    #11 0x7ff8fe9e1095 in gpu::WebGPUCommandBufferStub::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\webgpu_command_buffer_stub.cc:57:53
    #12 0x7ff8fea303c9 in std::__Cr::default_delete<gpu::CommandBufferStub>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:77
    #13 0x7ff8fea303c9 in std::__Cr::unique_ptr<gpu::CommandBufferStub,std::__Cr::default_delete<gpu::CommandBufferStub> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:290
    #14 0x7ff8fea303c9 in std::__Cr::unique_ptr<gpu::CommandBufferStub,std::__Cr::default_delete<gpu::CommandBufferStub> >::~unique_ptr C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:259
    #15 0x7ff8fea303c9 in gpu::GpuChannel::DestroyCommandBuffer(int) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\gpu_channel.cc:1095:1
    #16 0x7ff8fea3be0e in base::internal::DecayedFunctorTraits<void (GpuChannel::*)(int),base::WeakPtr<gpu::GpuChannel> &&,int &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #17 0x7ff8fea3be0e in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (GpuChannel::*&&)(int),base::WeakPtr<gpu::GpuChannel> &&,int &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #18 0x7ff8fea3be0e in base::internal::Invoker<base::internal::FunctorTraits<void (GpuChannel::*&&)(int),base::WeakPtr<gpu::GpuChannel> &&,int &&>,base::internal::BindState<1,1,0,void (GpuChannel::*)(int),base::WeakPtr<gpu::GpuChannel>,int>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #19 0x7ff8fea3be0e in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl gpu::GpuChannel::*&&)(int), class base::WeakPtr<class gpu::GpuChannel> &&, int &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl gpu::GpuChannel::*)(int), class base::WeakPtr<class gpu::GpuChannel>, int>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #20 0x7ff8f9bac2c9 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #21 0x7ff8f9bac2c9 in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(class base::internal::PostTaskAndReplyRelay) C:\b\s\w\ir\cache\builder\src\base\threading\post_task_and_reply_impl.h:45:28
    #22 0x7ff8f9bac7c8 in base::internal::DecayedFunctorTraits<void (*)(base::internal::PostTaskAndReplyRelay),base::internal::PostTaskAndReplyRelay &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:664
    #23 0x7ff8f9bac7c8 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay),base::internal::PostTaskAndReplyRelay &&>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
    #24 0x7ff8f9bac7c8 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay),base::internal::PostTaskAndReplyRelay &&>,base::internal::BindState<0,1,0,void (*)(base::internal::PostTaskAndReplyRelay),base::internal::PostTaskAndReplyRelay>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #25 0x7ff8f9bac7c8 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl *&&)(class base::internal::PostTaskAndReplyRelay), class base::internal::PostTaskAndReplyRelay &&>, struct base::internal::BindState<0, 1, 0, void (__cdecl *)(class base::internal::PostTaskAndReplyRelay), class base::internal::PostTaskAndReplyRelay>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #26 0x7ff8f9c2d7b3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #27 0x7ff8f9c2d7b3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34
    #28 0x7ff8f9c00b79 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:104
    #29 0x7ff8f9c00b79 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #30 0x7ff8f9bffa1f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #31 0x7ff8f9d611a2 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #32 0x7ff8f9c028b1 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
    #33 0x7ff8f9c9f46e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #34 0x7ff902fc68e2 in content::GpuMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\gpu\gpu_main.cc:472:14
    #35 0x7ff8f6361eb0 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:763:14
    #36 0x7ff8f63642e3 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1129:10
    #37 0x7ff8f6358208 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:361:36
    #38 0x7ff8f6358dcd in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:374:10
    #39 0x7ff8e6e82b0b in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
    #40 0x7ff66964479b in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
    #41 0x7ff66964200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20
    #42 0x7ff669afe47b in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #43 0x7ff669afe47b in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #44 0x7ff9f272e8d6  (C:\Windows\System32\KERNEL32.DLL+0x18002e8d6)
    #45 0x7ff9f2ffc34b  (C:\Windows\SYSTEM32\ntdll.dll+0x18003c34b)

0x12a6a8aec854 is located 52 bytes inside of 72-byte region [0x12a6a8aec820,0x12a6a8aec868)
freed by thread T0 here:
    #0 0x7ff96150c584  (C:\Users\wlsrb\Desktop\bugs\chromium-140.0.7317.0-win64-asan\clang_rt.asan_dynamic-x86_64.dll+0x18005c584)
    #1 0x7ff8e93af1ce in dawn::native::d3d12::Heap::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\HeapD3D12.h:42:7
    #2 0x7ff8e6f83124 in std::__Cr::default_delete<perfetto::internal::TracingMuxerImpl::ConsumerImpl>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:77
    #3 0x7ff8e6f83124 in std::__Cr::unique_ptr<perfetto::internal::TracingMuxerImpl::ConsumerImpl,std::__Cr::default_delete<perfetto::internal::TracingMuxerImpl::ConsumerImpl> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:290
    #4 0x7ff8e6f83124 in std::__Cr::unique_ptr<perfetto::internal::TracingMuxerImpl::ConsumerImpl,std::__Cr::default_delete<perfetto::internal::TracingMuxerImpl::ConsumerImpl> >::~unique_ptr C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:259
    #5 0x7ff8e6f83124 in std::__Cr::__destroy_at C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\construct_at.h:61
    #6 0x7ff8e6f83124 in std::__Cr::allocator_traits<std::__Cr::allocator<std::__Cr::unique_ptr<perfetto::internal::TracingMuxerImpl::ConsumerImpl,std::__Cr::default_delete<perfetto::internal::TracingMuxerImpl::ConsumerImpl> > > >::destroy C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocator_traits.h:313
    #7 0x7ff8e6f83124 in std::__Cr::vector<std::__Cr::unique_ptr<perfetto::internal::TracingMuxerImpl::ConsumerImpl,std::__Cr::default_delete<perfetto::internal::TracingMuxerImpl::ConsumerImpl> >,std::__Cr::allocator<std::__Cr::unique_ptr<perfetto::internal::TracingMuxerImpl::ConsumerImpl,std::__Cr::default_delete<perfetto::internal::TracingMuxerImpl::ConsumerImpl> > > >::__base_destruct_at_end C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:763
    #8 0x7ff8e6f83124 in std::__Cr::vector<std::__Cr::unique_ptr<perfetto::internal::TracingMuxerImpl::ConsumerImpl,std::__Cr::default_delete<perfetto::internal::TracingMuxerImpl::ConsumerImpl> >,std::__Cr::allocator<std::__Cr::unique_ptr<perfetto::internal::TracingMuxerImpl::ConsumerImpl,std::__Cr::default_delete<perfetto::internal::TracingMuxerImpl::ConsumerImpl> > > >::clear C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:543
    #9 0x7ff8e6f83124 in std::__Cr::vector<class std::__Cr::unique_ptr<class v8::internal::CppGraphBuilderImpl::WorkstackItemBase, struct std::__Cr::default_delete<class v8::internal::CppGraphBuilderImpl::WorkstackItemBase>>, class std::__Cr::allocator<class std::__Cr::unique_ptr<class v8::internal::CppGraphBuilderImpl::WorkstackItemBase, struct std::__Cr::default_delete<class v8::internal::CppGraphBuilderImpl::WorkstackItemBase>>>>::__destroy_vector::operator()(void) C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:251:16
    #10 0x7ff8e93cff0a in std::__Cr::vector<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> >,std::__Cr::allocator<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> > > >::~vector C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:262
    #11 0x7ff8e93cff0a in std::__Cr::pair<unsigned long long,std::__Cr::vector<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> >,std::__Cr::allocator<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> > > > >::~pair C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__utility\pair.h:90
    #12 0x7ff8e93cff0a in std::__Cr::__destroy_at C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\construct_at.h:61
    #13 0x7ff8e93cff0a in std::__Cr::allocator_traits<std::__Cr::allocator<std::__Cr::pair<unsigned long long,std::__Cr::vector<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> >,std::__Cr::allocator<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> > > > > > >::destroy C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocator_traits.h:313
    #14 0x7ff8e93cff0a in std::__Cr::vector<std::__Cr::pair<unsigned long long,std::__Cr::vector<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> >,std::__Cr::allocator<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> > > > >,std::__Cr::allocator<std::__Cr::pair<unsigned long long,std::__Cr::vector<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> >,std::__Cr::allocator<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> > > > > > >::__base_destruct_at_end C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:763
    #15 0x7ff8e93cff0a in std::__Cr::vector<std::__Cr::pair<unsigned long long,std::__Cr::vector<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> >,std::__Cr::allocator<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> > > > >,std::__Cr::allocator<std::__Cr::pair<unsigned long long,std::__Cr::vector<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> >,std::__Cr::allocator<std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> > > > > > >::__destruct_at_end C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:703
    #16 0x7ff8e93cff0a in std::__Cr::vector<struct std::__Cr::pair<unsigned __int64, class std::__Cr::vector<class std::__Cr::unique_ptr<class dawn::native::ResourceHeapBase, struct std::__Cr::default_delete<class dawn::native::ResourceHeapBase>>, class std::__Cr::allocator<class std::__Cr::unique_ptr<class dawn::native::ResourceHeapBase, struct std::__Cr::default_delete<class dawn::native::ResourceHeapBase>>>>>, class std::__Cr::allocator<struct std::__Cr::pair<unsigned __int64, class std::__Cr::vector<class std::__Cr::unique_ptr<class dawn::native::ResourceHeapBase, struct std::__Cr::default_delete<class dawn::native::ResourceHeapBase>>, class std::__Cr::allocator<class std::__Cr::unique_ptr<class dawn::native::ResourceHeapBase, struct std::__Cr::default_delete<class dawn::native::ResourceHeapBase>>>>>>>::erase(class std::__Cr::__wrap_iter<struct std::__Cr::pair<unsigned __int64, class std::__Cr::vector<class std::__Cr::unique_ptr<class dawn::native::ResourceHeapBase, struct std::__Cr::default_delete<class dawn::native::ResourceHeapBase>>, class std::__Cr::allocator<class std::__Cr::unique_ptr<class dawn::native::ResourceHeapBase, struct std::__Cr::default_delete<class dawn::native::ResourceHeapBase>>>>> const *>, class std::__Cr::__wrap_iter<struct std::__Cr::pair<unsigned __int64, class std::__Cr::vector<class std::__Cr::unique_ptr<class dawn::native::ResourceHeapBase, struct std::__Cr::default_delete<class dawn::native::ResourceHeapBase>>, class std::__Cr::allocator<class std::__Cr::unique_ptr<class dawn::native::ResourceHeapBase, struct std::__Cr::default_delete<class dawn::native::ResourceHeapBase>>>>> const *>) C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:1175:11
    #17 0x7ff8e93c9763 in dawn::SerialStorage<dawn::SerialQueue<unsigned long long,std::__Cr::unique_ptr<dawn::native::ResourceHeapBase,std::__Cr::default_delete<dawn::native::ResourceHeapBase> > > >::ClearUpTo C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\common\SerialStorage.h:171
    #18 0x7ff8e93c9763 in dawn::native::d3d12::ResourceAllocatorManager::Tick(unsigned __int64) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\ResourceAllocatorManagerD3D12.cpp:396:20
    #19 0x7ff8e93a4378 in dawn::native::d3d12::Device::TickImpl(void) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\DeviceD3D12.cpp:359:35
    #20 0x7ff8e90c37d9 in dawn::native::DeviceBase::Destroy(void) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:665:22
    #21 0x7ff8e8fa2258 in dawn::native::NativeDeviceDestroy(struct WGPUDeviceImpl *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\native\ProcTable.cpp:921:15
    #22 0x7ff8fe9c77c1 in wgpu::Device::Destroy C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\include\dawn\webgpu_cpp.h:8726
    #23 0x7ff8fe9c77c1 in gpu::webgpu::`anonymous namespace'::WebGPUDecoderImpl::Destroy C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1235:21
    #24 0x7ff8fe9e1095 in gpu::WebGPUCommandBufferStub::~WebGPUCommandBufferStub C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\webgpu_command_buffer_stub.cc:59
    #25 0x7ff8fe9e1095 in gpu::WebGPUCommandBufferStub::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\webgpu_command_buffer_stub.cc:57:53
    #26 0x7ff8fea303c9 in std::__Cr::default_delete<gpu::CommandBufferStub>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:77
    #27 0x7ff8fea303c9 in std::__Cr::unique_ptr<gpu::CommandBufferStub,std::__Cr::default_delete<gpu::CommandBufferStub> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:290
    #28 0x7ff8fea303c9 in std::__Cr::unique_ptr<gpu::CommandBufferStub,std::__Cr::default_delete<gpu::CommandBufferStub> >::~unique_ptr C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:259
    #29 0x7ff8fea303c9 in gpu::GpuChannel::DestroyCommandBuffer(int) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\gpu_channel.cc:1095:1
    #30 0x7ff8fea3be0e in base::internal::DecayedFunctorTraits<void (GpuChannel::*)(int),base::WeakPtr<gpu::GpuChannel> &&,int &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #31 0x7ff8fea3be0e in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (GpuChannel::*&&)(int),base::WeakPtr<gpu::GpuChannel> &&,int &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #32 0x7ff8fea3be0e in base::internal::Invoker<base::internal::FunctorTraits<void (GpuChannel::*&&)(int),base::WeakPtr<gpu::GpuChannel> &&,int &&>,base::internal::BindState<1,1,0,void (GpuChannel::*)(int),base::WeakPtr<gpu::GpuChannel>,int>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #33 0x7ff8fea3be0e in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl gpu::GpuChannel::*&&)(int), class base::WeakPtr<class gpu::GpuChannel> &&, int &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl gpu::GpuChannel::*)(int), class base::WeakPtr<class gpu::GpuChannel>, int>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #34 0x7ff8f9bac2c9 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #35 0x7ff8f9bac2c9 in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(class base::internal::PostTaskAndReplyRelay) C:\b\s\w\ir\cache\builder\src\base\threading\post_task_and_reply_impl.h:45:28
    #36 0x7ff8f9bac7c8 in base::internal::DecayedFunctorTraits<void (*)(base::internal::PostTaskAndReplyRelay),base::internal::PostTaskAndReplyRelay &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:664
    #37 0x7ff8f9bac7c8 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay),base::internal::PostTaskAndReplyRelay &&>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
    #38 0x7ff8f9bac7c8 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay),base::internal::PostTaskAndReplyRelay &&>,base::internal::BindState<0,1,0,void (*)(base::internal::PostTaskAndReplyRelay),base::internal::PostTaskAndReplyRelay>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #39 0x7ff8f9bac7c8 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl *&&)(class base::internal::PostTaskAndReplyRelay), class base::internal::PostTaskAndReplyRelay &&>, struct base::internal::BindState<0, 1, 0, void (__cdecl *)(class base::internal::PostTaskAndReplyRelay), class base::internal::PostTaskAndReplyRelay>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #40 0x7ff8f9c2d7b3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #41 0x7ff8f9c2d7b3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34
    #42 0x7ff8f9c00b79 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:104
    #43 0x7ff8f9c00b79 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #44 0x7ff8f9bffa1f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #45 0x7ff8f9d611a2 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #46 0x7ff8f9c028b1 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
    #47 0x7ff8f9c9f46e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #48 0x7ff902fc68e2 in content::GpuMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\gpu\gpu_main.cc:472:14
    #49 0x7ff8f6361eb0 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:763:14
    #50 0x7ff8f63642e3 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1129:10
    #51 0x7ff8f6358208 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:361:36
    #52 0x7ff8f6358dcd in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:374:10
    #53 0x7ff8e6e82b0b in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
    #54 0x7ff66964479b in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
    #55 0x7ff66964200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20

previously allocated by thread T0 here:
    #0 0x7ff96150b99d  (C:\Users\wlsrb\Desktop\bugs\chromium-140.0.7317.0-win64-asan\clang_rt.asan_dynamic-x86_64.dll+0x18005b99d)
    #1 0x7ff8e93cd0fe in dawn::native::d3d12::ResourceAllocatorManager::CreateCommittedResource(enum dawn::native::d3d12::ResourceHeapKind, struct D3D12_RESOURCE_DESC const &, struct D3D12_CLEAR_VALUE const *, enum D3D12_RESOURCE_STATES) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\ResourceAllocatorManagerD3D12.cpp:555:18
    #2 0x7ff8e93ca30c in dawn::native::d3d12::ResourceAllocatorManager::AllocateMemory(enum dawn::native::d3d12::ResourceHeapKind, struct D3D12_RESOURCE_DESC const &, enum D3D12_RESOURCE_STATES, unsigned int, bool) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\ResourceAllocatorManagerD3D12.cpp:379:5
    #3 0x7ff8e93a9e45 in dawn::native::d3d12::Device::AllocateMemory(enum dawn::native::d3d12::ResourceHeapKind, struct D3D12_RESOURCE_DESC const &, enum D3D12_RESOURCE_STATES, unsigned int, bool) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\DeviceD3D12.cpp:581:11
    #4 0x7ff8e93effe0 in dawn::native::d3d12::Texture::InitializeAsInternalTexture(void) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\TextureD3D12.cpp:290:5
    #5 0x7ff8e93ef5b7 in dawn::native::d3d12::Texture::Create(class dawn::native::d3d12::Device *, class dawn::native::UnpackedPtr<struct dawn::native::TextureDescriptor> const &) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\TextureD3D12.cpp:179:5
    #6 0x7ff8e93a68ea in dawn::native::d3d12::Device::CreateTextureImpl(class dawn::native::UnpackedPtr<struct dawn::native::TextureDescriptor> const &) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\DeviceD3D12.cpp:425:12
    #7 0x7ff8e90c9606 in dawn::native::DeviceBase::CreateTexture(struct dawn::native::TextureDescriptor const *) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:2267:12
    #8 0x7ff8e90d7b0d in dawn::native::DeviceBase::APICreateTexture(struct dawn::native::TextureDescriptor const *) C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:1479:23
    #9 0x7ff8e8fa206c in dawn::native::NativeDeviceCreateTexture(struct WGPUDeviceImpl *, struct WGPUTextureDescriptor const *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\native\ProcTable.cpp:911:36
    #10 0x7ff8fe99b92d in dawn::wire::server::Server::DoDeviceCreateTexture(struct WGPUDeviceImpl *, struct WGPUTextureDescriptor const *, struct WGPUTextureImpl **) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\wire\server\ServerDoers_autogen.cpp:329:9
    #11 0x7ff8fe9ae5e4 in dawn::wire::server::Server::HandleDeviceCreateTexture(class dawn::wire::DeserializeBuffer *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\wire\server\ServerHandlers_autogen.cpp:646:9
    #12 0x7ff8fe9b4080 in dawn::wire::server::Server::HandleCommandsImpl(char const volatile *, unsigned __int64) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\wire\server\ServerHandlers_autogen.cpp:1686:30
    #13 0x7ff8fe9d0f72 in gpu::webgpu::`anonymous namespace'::DawnWireServer::HandleCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:156:33
    #14 0x7ff8fe9d13c5 in gpu::webgpu::`anonymous namespace'::WebGPUDecoderImpl::HandleDawnCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1942:22
    #15 0x7ff8fe9c6dc1 in gpu::webgpu::`anonymous namespace'::WebGPUDecoderImpl::DoCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1887:18
    #16 0x7ff8e9d93c83 in gpu::CommandBufferService::Flush(int, class gpu::AsyncAPIInterface *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\command_buffer_service.cc:265:35
    #17 0x7ff8fea5f794 in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, class std::__Cr::vector<struct gpu::SyncToken, class std::__Cr::allocator<struct gpu::SyncToken>> const &) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:495:22
    #18 0x7ff8fea5e695 in gpu::CommandBufferStub::ExecuteDeferredRequest(class gpu::mojom::DeferredCommandBufferRequestParams &, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:162:7
    #19 0x7ff8fea2a89b in gpu::GpuChannel::ExecuteDeferredRequest(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\gpu_channel.cc:851:13
    #20 0x7ff8fea3a7b3 in base::internal::DecayedFunctorTraits<void (GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #21 0x7ff8fea3a7b3 in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #22 0x7ff8fea3a7b3 in base::internal::Invoker<base::internal::FunctorTraits<void (GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,base::internal::BindState<1,1,0,void (GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel>,mojo::StructPtr<gpu::mojom::DeferredRequestParams> >,void (gpu::FenceSyncReleaseDelegate *)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #23 0x7ff8fea3a7b3 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl gpu::GpuChannel::*&&)(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *), class base::WeakPtr<class gpu::GpuChannel> &&, class mojo::StructPtr<class gpu::mojom::DeferredRequestParams> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl gpu::GpuChannel::*)(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *), class base::WeakPtr<class gpu::GpuChannel>, class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>>, (class gpu::FenceSyncReleaseDelegate *)>::RunOnce(class base::internal::BindStateBase *, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #24 0x7ff8e9dd52ad in base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #25 0x7ff8e9dd52ad in base::internal::DecayedFunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,gpu::FenceSyncReleaseDelegate *>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:806
    #26 0x7ff8e9dd52ad in base::internal::InvokeHelper<0,base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)> &&,gpu::FenceSyncReleaseDelegate *>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
    #27 0x7ff8e9dd52ad in base::internal::Invoker<struct base::internal::FunctorTraits<class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)> &&, class gpu::FenceSyncReleaseDelegate *>, struct base::internal::BindState<0, 1, 1, class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)>, class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>>, (void)>::RunImpl<class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)>, class std::__Cr::tuple<class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>>, 0>(class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)> &&, class std::__Cr::tuple<class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>> &&, struct std::__Cr::integer_sequence<unsigned __int64, 0>) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060:14
    #28 0x7ff8e9da7970 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #29 0x7ff8e9da7970 in gpu::Scheduler::ExecuteSequence(class base::IdType<class gpu::SyncPointOrderData, unsigned int, 0, 1>) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:672:29
    #30 0x7ff8e9da55f3 in gpu::Scheduler::RunNextTask(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:594:3
    #31 0x7ff8e9daccd8 in base::internal::DecayedFunctorTraits<void (Scheduler::*)(),gpu::Scheduler *>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #32 0x7ff8e9daccd8 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (Scheduler::*&&)(),gpu::Scheduler *>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
    #33 0x7ff8e9daccd8 in base::internal::Invoker<base::internal::FunctorTraits<void (Scheduler::*&&)(),gpu::Scheduler *>,base::internal::BindState<1,1,0,void (Scheduler::*)(),base::internal::UnretainedWrapper<gpu::Scheduler,base::unretained_traits::MayNotDangle,0> >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #34 0x7ff8e9daccd8 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl gpu::Scheduler::*&&)(void), class gpu::Scheduler *>, struct base::internal::BindState<1, 1, 0, void (__cdecl gpu::Scheduler::*)(void), class base::internal::UnretainedWrapper<class gpu::Scheduler, struct base::unretained_traits::MayNotDangle, 0>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #35 0x7ff8f9c2d7b3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #36 0x7ff8f9c2d7b3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34
    #37 0x7ff8f9c00b79 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:104
    #38 0x7ff8f9c00b79 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #39 0x7ff8f9bffa1f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40

SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\PageableD3D12.cpp:86:12 in dawn::native::d3d12::Pageable::IsResidencyLocked(void) const
Shadow bytes around the buggy address:
  0x12a6a8aec580: 00 00 00 00 00 01 fc 00 00 00 fa fa f7 fa fd fd
  0x12a6a8aec600: fd fd fd fd fd fd fd fa fa fa f7 fa 00 00 00 00
  0x12a6a8aec680: 00 00 00 00 00 fa fa fa f7 fa 00 00 00 00 00 00
  0x12a6a8aec700: 00 00 00 fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x12a6a8aec780: fd fd fa fa f7 fa fd fd fd fd fd fd fd fd fd fa
=>0x12a6a8aec800: fa fa f7 fa fd fd fd fd fd fd[fd]fd fd fa fa fa
  0x12a6a8aec880: f7 fa fd fd fd fd fd fd fd fd fd fd fa fa f7 fa
  0x12a6a8aec900: fd fd fd fd fd fd fd fd fd fd fa fa f7 fa fd fd
  0x12a6a8aec980: fd fd fd fd fd fd fd fa fa fa f7 fa fd fd fd fd
  0x12a6a8aeca00: fd fd fd fd fd fd fa fa f7 fa fd fd fd fd fd fd
  0x12a6a8aeca80: fd fd fd fd fa fa f7 fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==39432==ADDITIONAL INFO

==39432==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7ff8fea2fe0b in gpu::GpuChannelMessageFilter::DestroyCommandBuffer(int, class base::OnceCallback<(void)>) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\gpu_channel.cc:538:7


Command line: `"C:\Users\wlsrb\Desktop\bugs\chromium-140.0.7317.0-win64-asan\chrome.exe" --type=gpu-process --no-sandbox --enable-gpu-rasterization --enable-gpu-service-logging --use-angle=d3d11 --no-pre-read-main-dll --start-stack-profiler --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAQEKAAAAAAAAAAAAAMAAAwAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5076,i,11615202356054380776,15957568803455442459,262144 --field-trial-handle=1948,i,9545074909684797070,2126597719368051664,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==39432==END OF ADDITIONAL INFO
==39432==ABORTING