==8720==ERROR: AddressSanitizer: heap-use-after-free on address 0x125efa03e880 at pc 0x7ff891631220 bp 0x00de3fff9300 sp 0x00de3fff9348 READ of size 8 at 0x125efa03e880 thread T0 ==8720==*** WARNING: Failed to initialize DbgHelp! *** ==8720==*** Most likely this means that the app is already *** ==8720==*** using DbgHelp, possibly with incompatible flags. *** ==8720==*** Due to technical reasons, symbolization might crash *** ==8720==*** or produce wrong results. *** #0 0x7ff89163121f in blink::MediaStreamDescriptor::AddComponent C:\Users\sherkito\chromium\src\third_party\blink\renderer\platform\mediastream\media_stream_descriptor.cc:74 #1 0x7ff894e72b94 in blink::MediaStream::addTrack C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\mediastream\media_stream.cc:320 #2 0x7ff89696604e in blink::`anonymous namespace'::v8_media_stream::AddTrackOperationCallback C:\Users\sherkito\chromium\src\out\Default\gen\third_party\blink\renderer\bindings\modules\v8\v8_media_stream.cc:370 #3 0x7ff898acf504 in Builtins_CallApiCallbackGeneric+0xc4 (C:\Users\sherkito\chromium\src\out\Default\chrome.dll+0x1a99cf504) #4 0x7ff898acd6f4 in Builtins_InterpreterEntryTrampoline+0x134 (C:\Users\sherkito\chromium\src\out\Default\chrome.dll+0x1a99cd6f4) #5 0x7ff898acaadb in Builtins_JSEntryTrampoline+0x5b (C:\Users\sherkito\chromium\src\out\Default\chrome.dll+0x1a99caadb) #6 0x7ff898aca63e in Builtins_JSEntry+0xfe (C:\Users\sherkito\chromium\src\out\Default\chrome.dll+0x1a99ca63e) #7 0x7ff8745d61db in v8::internal::`anonymous namespace'::Invoke C:\Users\sherkito\chromium\src\v8\src\execution\execution.cc:442 #8 0x7ff8745d492d in v8::internal::Execution::Call C:\Users\sherkito\chromium\src\v8\src\execution\execution.cc:532 #9 0x7ff87400d638 in v8::Function::Call C:\Users\sherkito\chromium\src\v8\src\api\api.cc:5433 #10 0x7ff888b19248 in blink::V8ScriptRunner::CallFunction C:\Users\sherkito\chromium\src\third_party\blink\renderer\bindings\core\v8\v8_script_runner.cc:874 #11 0x7ff893267115 in blink::bindings::CallbackInvokeHelper::Call C:\Users\sherkito\chromium\src\third_party\blink\renderer\bindings\core\v8\callback_invoke_helper.cc:166 #12 0x7ff89133873b in blink::V8Function::Invoke C:\Users\sherkito\chromium\src\out\Default\gen\third_party\blink\renderer\bindings\core\v8\v8_function.cc:73 #13 0x7ff8913394b5 in blink::V8Function::InvokeAndReportException C:\Users\sherkito\chromium\src\out\Default\gen\third_party\blink\renderer\bindings\core\v8\v8_function.cc:133 #14 0x7ff897e0cd72 in blink::ScheduledAction::Execute C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\scheduler\scheduled_action.cc:149 #15 0x7ff896a2713b in blink::DOMTimer::Fired C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\scheduler\dom_timer.cc:424 #16 0x7ff8840a4c7b in blink::TimerBase::RunInternal C:\Users\sherkito\chromium\src\third_party\blink\renderer\platform\timer.cc:166 #17 0x7ff8840a5525 in base::internal::Invoker,base::internal::BindState<1,1,0,void (TimerBase::*)(),WTF::UnretainedWrapper >,void ()>::RunOnce C:\Users\sherkito\chromium\src\base\functional\bind_internal.h:973 #18 0x7ff880cf8db3 in base::TaskAnnotator::RunTaskImpl C:\Users\sherkito\chromium\src\base\task\common\task_annotator.cc:209 #19 0x7ff885f54489 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456 #20 0x7ff885f5332f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330 #21 0x7ff885f9acb7 in base::MessagePumpDefault::Run C:\Users\sherkito\chromium\src\base\message_loop\message_pump_default.cc:42 #22 0x7ff885f561d1 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629 #23 0x7ff880d6537e in base::RunLoop::Run C:\Users\sherkito\chromium\src\base\run_loop.cc:134 #24 0x7ff883f3eee7 in content::RendererMain C:\Users\sherkito\chromium\src\content\renderer\renderer_main.cc:356 #25 0x7ff87e8320b6 in content::RunOtherNamedProcessTypeMain C:\Users\sherkito\chromium\src\content\app\content_main_runner_impl.cc:794 #26 0x7ff87e83446c in content::ContentMainRunnerImpl::Run C:\Users\sherkito\chromium\src\content\app\content_main_runner_impl.cc:1183 #27 0x7ff87e8284c3 in content::RunContentProcess C:\Users\sherkito\chromium\src\content\app\content_main.cc:359 #28 0x7ff87e82907d in content::ContentMain C:\Users\sherkito\chromium\src\content\app\content_main.cc:372 #29 0x7ff86f102b0b in ChromeMain C:\Users\sherkito\chromium\src\chrome\app\chrome_main.cc:222 #30 0x7ff6f03447bb in MainDllLoader::Launch C:\Users\sherkito\chromium\src\chrome\app\main_dll_loader_win.cc:201 #31 0x7ff6f0342021 in main C:\Users\sherkito\chromium\src\chrome\app\chrome_exe_main_win.cc:352 #32 0x7ff6f07f9f7b in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #33 0x7ff928847373 in BaseThreadInitThunk+0x13 (C:\Windows\System32\KERNEL32.DLL+0x180017373) #34 0x7ff929fdcc90 in RtlUserThreadStart+0x20 (C:\Windows\SYSTEM32\ntdll.dll+0x18004cc90) 0x125efa03e880 is located 0 bytes inside of 920-byte region [0x125efa03e880,0x125efa03ec18) freed by thread T0 here: #0 0x7ff8f7f6c394 in operator delete+0x94 (C:\Users\sherkito\chromium\src\out\Default\clang_rt.asan_dynamic-x86_64.dll+0x18005c394) #1 0x7ff88c882397 in blink::WebMediaPlayerMS::`vector deleting destructor'+0x27 (C:\Users\sherkito\chromium\src\out\Default\chrome.dll+0x19d782397) #2 0x7ff88cdc1044 in blink::HTMLMediaElement::ClearMediaPlayerAndAudioSourceProviderClientWithoutLocking C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:4053 #3 0x7ff88cdbdf29 in blink::HTMLMediaElement::InvokePreFinalizer C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.h:115 #4 0x7ff876529985 in cppgc::internal::PreFinalizerHandler::InvokePreFinalizers C:\Users\sherkito\chromium\src\v8\src\heap\cppgc\prefinalizer-handler.cc:68 #5 0x7ff8764fe0c0 in cppgc::internal::HeapBase::ExecutePreFinalizers C:\Users\sherkito\chromium\src\v8\src\heap\cppgc\heap-base.cc:169 #6 0x7ff87472e703 in v8::internal::CppHeap::CompactAndSweep C:\Users\sherkito\chromium\src\v8\src\heap\cppgc-js\cpp-heap.cc:990 #7 0x7ff8748275a9 in v8::internal::Heap::PerformGarbageCollection C:\Users\sherkito\chromium\src\v8\src\heap\heap.cc:2305 #8 0x7ff8748794cd in v8::internal::Heap::CollectGarbage::::operator() C:\Users\sherkito\chromium\src\v8\src\heap\heap.cc:1676 #9 0x7ff874878aa8 in heap::base::Stack::SetMarkerAndCallbackImpl<`lambda at ..\..\v8\src\heap\heap.cc:1644:40'> C:\Users\sherkito\chromium\src\v8\src\heap\base\stack.h:174 #10 0x7ff898cb5c6c in PushAllRegistersAndIterateStack+0x6c (C:\Users\sherkito\chromium\src\out\Default\chrome.dll+0x1a9bb5c6c) #11 0x7ff87481a83b in v8::internal::Heap::CollectGarbage C:\Users\sherkito\chromium\src\v8\src\heap\heap.cc:1644 #12 0x7ff87472ebf6 in v8::internal::CppHeap::ReportBufferedAllocationSizeIfPossible C:\Users\sherkito\chromium\src\v8\src\heap\cppgc-js\cpp-heap.cc:1077 #13 0x7ff87652eb1e in cppgc::internal::StatsCollector::AllocatedObjectSizeSafepointImpl C:\Users\sherkito\chromium\src\v8\src\heap\cppgc\stats-collector.cc:83 #14 0x7ff876520d1f in cppgc::internal::ObjectAllocator::OutOfLineAllocateGCSafePoint C:\Users\sherkito\chromium\src\v8\src\heap\cppgc\object-allocator.cc:153 #15 0x7ff8764ee41e in cppgc::internal::MakeGarbageCollectedTraitInternal::Allocate C:\Users\sherkito\chromium\src\v8\src\heap\cppgc\allocation.cc:38 #16 0x7ff88d721002 in blink::SpaceSplitString::Data::Create C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\dom\space_split_string.cc:198 #17 0x7ff88d72307e in blink::SpaceSplitString::Set C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\dom\space_split_string.cc:190 #18 0x7ff888d420de in blink::ElementData::SetClassFoldingCase C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\dom\element_data.h:67 #19 0x7ff888d4043d in blink::Element::ClassAttributeChanged C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\dom\element.cc:3281 #20 0x7ff888d3d67c in blink::Element::AttributeChanged C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\dom\element.cc:3173 #21 0x7ff889129aaa in blink::HTMLElement::AttributeChanged C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\html_element.cc:813 #22 0x7ff888dabcfc in blink::Element::SetAttributeWithoutValidation C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\dom\element.cc:11415 #23 0x7ff88e3e6a3e in blink::DOMTokenList::AddTokens C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\dom\dom_token_list.cc:243 #24 0x7ff88d0e5a69 in blink::MediaControlsImpl::UpdateCSSClassFromState C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\media_controls\media_controls_impl.cc:823 #25 0x7ff88cde0354 in blink::HTMLMediaElement::SetNetworkState C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc #26 0x7ff88c86d5b7 in blink::WebMediaPlayerMS::SetNetworkState C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\mediastream\web_media_player_ms.cc:1380 #27 0x7ff88c877435 in blink::WebMediaPlayerMS::ReloadAudio C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\mediastream\web_media_player_ms.cc:793 previously allocated by thread T0 here: #0 0x7ff8f7f6b7ad in operator new+0x8d (C:\Users\sherkito\chromium\src\out\Default\clang_rt.asan_dynamic-x86_64.dll+0x18005b7ad) #1 0x7ff88860f24d in content::MediaFactory::CreateWebMediaPlayerForMediaStream C:\Users\sherkito\chromium\src\content\renderer\media\media_factory.cc:774 #2 0x7ff88860b913 in content::MediaFactory::CreateMediaPlayer C:\Users\sherkito\chromium\src\content\renderer\media\media_factory.cc:386 #3 0x7ff883f6c2bf in content::RenderFrameImpl::CreateMediaPlayer C:\Users\sherkito\chromium\src\content\renderer\render_frame_impl.cc:3545 #4 0x7ff8887e7da1 in blink::ModulesInitializer::CreateWebMediaPlayer C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\modules_initializer.cc:357 #5 0x7ff888d09aa1 in blink::LocalFrameClientImpl::CreateWebMediaPlayer C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\frame\local_frame_client_impl.cc:1004 #6 0x7ff88cdd5c21 in blink::HTMLMediaElement::StartPlayerLoad C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:1623 #7 0x7ff88cdd2083 in blink::HTMLMediaElement::LoadResource C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:1478 #8 0x7ff88cdcd63d in blink::HTMLMediaElement::LoadSourceFromObject C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:1312 #9 0x7ff88cdcca20 in blink::HTMLMediaElement::SelectMediaResource C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:1262 #10 0x7ff88cdc8147 in blink::HTMLMediaElement::LoadInternal C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:1202 #11 0x7ff88cdbdfc1 in blink::HTMLMediaElement::LoadTimerFired C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:928 #12 0x7ff8840a4c7b in blink::TimerBase::RunInternal C:\Users\sherkito\chromium\src\third_party\blink\renderer\platform\timer.cc:166 #13 0x7ff88ce0367e in base::internal::Invoker *, blink::HTMLMediaElement *),blink::HeapTaskRunnerTimer *,cppgc::internal::BasicPersistent &&>,base::internal::BindState<0,1,0,void (*)(blink::HeapTaskRunnerTimer *, blink::HTMLMediaElement *),WTF::UnretainedWrapper >,cppgc::internal::BasicPersistent >,void ()>::RunOnce C:\Users\sherkito\chromium\src\base\functional\bind_internal.h:973 #14 0x7ff880cf8db3 in base::TaskAnnotator::RunTaskImpl C:\Users\sherkito\chromium\src\base\task\common\task_annotator.cc:209 #15 0x7ff885f54489 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456 #16 0x7ff885f5332f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330 #17 0x7ff885f9acb7 in base::MessagePumpDefault::Run C:\Users\sherkito\chromium\src\base\message_loop\message_pump_default.cc:42 #18 0x7ff885f561d1 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629 #19 0x7ff880d6537e in base::RunLoop::Run C:\Users\sherkito\chromium\src\base\run_loop.cc:134 #20 0x7ff883f3eee7 in content::RendererMain C:\Users\sherkito\chromium\src\content\renderer\renderer_main.cc:356 #21 0x7ff87e8320b6 in content::RunOtherNamedProcessTypeMain C:\Users\sherkito\chromium\src\content\app\content_main_runner_impl.cc:794 #22 0x7ff87e83446c in content::ContentMainRunnerImpl::Run C:\Users\sherkito\chromium\src\content\app\content_main_runner_impl.cc:1183 #23 0x7ff87e8284c3 in content::RunContentProcess C:\Users\sherkito\chromium\src\content\app\content_main.cc:359 #24 0x7ff87e82907d in content::ContentMain C:\Users\sherkito\chromium\src\content\app\content_main.cc:372 #25 0x7ff86f102b0b in ChromeMain C:\Users\sherkito\chromium\src\chrome\app\chrome_main.cc:222 #26 0x7ff6f03447bb in MainDllLoader::Launch C:\Users\sherkito\chromium\src\chrome\app\main_dll_loader_win.cc:201 #27 0x7ff6f0342021 in main C:\Users\sherkito\chromium\src\chrome\app\chrome_exe_main_win.cc:352 SUMMARY: AddressSanitizer: heap-use-after-free C:\Users\sherkito\chromium\src\third_party\blink\renderer\platform\mediastream\media_stream_descriptor.cc:74 in blink::MediaStreamDescriptor::AddComponent Shadow bytes around the buggy address: 0x125efa03e600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x125efa03e680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x125efa03e700: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x125efa03e780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x125efa03e800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa =>0x125efa03e880:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x125efa03e900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x125efa03e980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x125efa03ea00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x125efa03ea80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x125efa03eb00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==8720==ADDITIONAL INFO ==8720==Note: Please include this section with the ASan report. Task trace: #0 0x7ff896a25f40 in blink::DOMTimer::DOMTimer C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\scheduler\dom_timer.cc:318 #1 0x7ff896a25f40 in blink::DOMTimer::DOMTimer C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\scheduler\dom_timer.cc:318 #2 0x7ff896a25f40 in blink::DOMTimer::DOMTimer C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\scheduler\dom_timer.cc:318 #3 0x7ff88d99b9b9 in blink::MainThreadEventQueue::QueueEvent C:\Users\sherkito\chromium\src\third_party\blink\renderer\platform\widget\input\main_thread_event_queue.cc:738 Command line: `"C:\Users\sherkito\chromium\src\out\Default\chrome.exe" --type=renderer --user-data-dir="C:\Users\sherkito\AppData\Local\Tempzzzz" --no-pre-read-main-dll --start-stack-profiler --no-sandbox --js-flags="--stress-incremental-marking --expose-gc" --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ko --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --time-ticks-at-unix-epoch=-1755895366804959 --launch-time-ticks=63134325800 --metrics-shmem-handle=4720,i,618149049809249317,13778874662795399887,2097152 --field-trial-handle=2028,i,3244663307791079213,15071393464933869041,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==8720==END OF ADDITIONAL INFO ==8720==ABORTING