================================================================= ==1488484==ERROR: AddressSanitizer: heap-use-after-free on address 0x731075fe20a8 at pc 0x59b534f2a4a2 bp 0x7ffde602da70 sp 0x7ffde602da68 READ of size 4 at 0x731075fe20a8 thread T0 (chrome) #0 0x59b534f2a4a1 in wl_proxy_marshal_array_flags ./../../third_party/wayland/src/src/wayland-client.c:911:22 #1 0x59b534f2a84f in wl_proxy_marshal_flags ./../../third_party/wayland/src/src/wayland-client.c:857:9 #2 0x59b5350b414d in operator() ./../../ui/ozone/platform/wayland/common/wayland_object.h:50:5 #3 0x59b5350b414d in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:290:7 #4 0x59b5350b414d in ~unique_ptr ./../../third_party/libc++/src/include/__memory/unique_ptr.h:259:71 #5 0x59b5350b414d in ui::WaylandScreen::~WaylandScreen() ./../../ui/ozone/platform/wayland/host/wayland_screen.cc:132:31 #6 0x59b5350b44d3 in ui::WaylandScreen::~WaylandScreen() ./../../ui/ozone/platform/wayland/host/wayland_screen.cc:132:31 #7 0x59b5603be121 in operator() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:77:5 #8 0x59b5603be121 in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:290:7 #9 0x59b5603be121 in ~unique_ptr ./../../third_party/libc++/src/include/__memory/unique_ptr.h:259:71 #10 0x59b5603be121 in aura::ScreenOzone::~ScreenOzone() ./../../ui/aura/screen_ozone.cc:38:1 #11 0x59b5603bdb43 in ~DesktopScreenOzone ./../../ui/views/widget/desktop_aura/desktop_screen_ozone.cc:18:41 #12 0x59b5603bdb43 in views::DesktopScreenOzone::~DesktopScreenOzone() ./../../ui/views/widget/desktop_aura/desktop_screen_ozone.cc:18:41 #13 0x59b5603b8ac1 in operator() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:77:5 #14 0x59b5603b8ac1 in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:290:7 #15 0x59b5603b8ac1 in ~unique_ptr ./../../third_party/libc++/src/include/__memory/unique_ptr.h:259:71 #16 0x59b5603b8ac1 in ChromeBrowserMainExtraPartsViews::~ChromeBrowserMainExtraPartsViews() ./../../chrome/browser/ui/views/chrome_browser_main_extra_parts_views.cc:83:1 #17 0x59b5610bdf5e in ~ChromeBrowserMainExtraPartsViewsLinux ./../../chrome/browser/ui/views/chrome_browser_main_extra_parts_views_linux.cc:47:44 #18 0x59b5610bdf5e in ChromeBrowserMainExtraPartsViewsLinux::~ChromeBrowserMainExtraPartsViewsLinux() ./../../chrome/browser/ui/views/chrome_browser_main_extra_parts_views_linux.cc:47:44 #19 0x59b54773b636 in operator() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:77:5 #20 0x59b54773b636 in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:290:7 #21 0x59b54773b636 in ~unique_ptr ./../../third_party/libc++/src/include/__memory/unique_ptr.h:259:71 #22 0x59b54773b636 in __destroy_at >, 0> ./../../third_party/libc++/src/include/__memory/construct_at.h:63:11 #23 0x59b54773b636 in destroy >, 0> ./../../third_party/libc++/src/include/__memory/allocator_traits.h:313:5 #24 0x59b54773b636 in __base_destruct_at_end ./../../third_party/libc++/src/include/__vector/vector.h:763:7 #25 0x59b54773b636 in __destruct_at_end ./../../third_party/libc++/src/include/__vector/vector.h:703:5 #26 0x59b54773b636 in pop_back ./../../third_party/libc++/src/include/__vector/vector.h:487:11 #27 0x59b54773b636 in ChromeBrowserMainParts::~ChromeBrowserMainParts() ./../../chrome/browser/chrome_browser_main.cc:605:25 #28 0x59b5485577f3 in ~ChromeBrowserMainPartsLinux ./../../chrome/browser/chrome_browser_main_linux.cc:53:59 #29 0x59b5485577f3 in ChromeBrowserMainPartsLinux::~ChromeBrowserMainPartsLinux() ./../../chrome/browser/chrome_browser_main_linux.cc:53:59 #30 0x59b53dfab7c2 in operator() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:77:5 #31 0x59b53dfab7c2 in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:290:7 #32 0x59b53dfab7c2 in ~unique_ptr ./../../third_party/libc++/src/include/__memory/unique_ptr.h:259:71 #33 0x59b53dfab7c2 in content::BrowserMainLoop::~BrowserMainLoop() ./../../content/browser/browser_main_loop.cc:514:1 #34 0x59b53dfabdb3 in content::BrowserMainLoop::~BrowserMainLoop() ./../../content/browser/browser_main_loop.cc:510:37 #35 0x59b53dfbc66a in operator() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:77:5 #36 0x59b53dfbc66a in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:290:7 #37 0x59b53dfbc66a in content::BrowserMainRunnerImpl::Shutdown() ./../../content/browser/browser_main_runner_impl.cc:186:16 #38 0x59b53dfaab2c in content::BrowserMain(content::MainFunctionParams) ./../../content/browser/browser_main.cc:41:16 #39 0x59b5458404e0 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:734:10 #40 0x59b545843e03 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) ./../../content/app/content_main_runner_impl.cc:1341:10 #41 0x59b5458434c2 in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner_impl.cc:1196:12 #42 0x59b54583d849 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ./../../content/app/content_main.cc:362:36 #43 0x59b54583dd6b in content::ContentMain(content::ContentMainParams) ./../../content/app/content_main.cc:375:10 #44 0x59b5329fcf27 in ChromeMain ./../../chrome/app/chrome_main.cc:222:12 #45 0x75d08402a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #46 0x75d08402a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3 #47 0x59b532921029 in _start ??:0:0 0x731075fe20a8 is located 104 bytes inside of 392-byte region [0x731075fe2040,0x731075fe21c8) freed by thread T0 (chrome) here: #0 0x59b5329c2396 in __interceptor_free _asan_rtl_:3 #1 0x59b53501937e in operator() ./../../ui/ozone/platform/wayland/common/wayland_object.h:50:5 #2 0x59b53501937e in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:290:7 #3 0x59b53501937e in ~unique_ptr ./../../third_party/libc++/src/include/__memory/unique_ptr.h:259:71 #4 0x59b53501937e in ui::WaylandConnection::~WaylandConnection() ./../../ui/ozone/platform/wayland/host/wayland_connection.cc:136:39 #5 0x59b53514e8cc in operator() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:77:5 #6 0x59b53514e8cc in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:290:7 #7 0x59b53514e8cc in ui::(anonymous namespace)::OzonePlatformWayland::PostMainMessageLoopRun() ./../../ui/ozone/platform/wayland/ozone_platform_wayland.cc:480:17 #8 0x59b53dfb46a0 in content::BrowserMainLoop::ShutdownThreadsAndCleanUp() ./../../content/browser/browser_main_loop.cc:1161:13 #9 0x59b53dfbc60b in content::BrowserMainRunnerImpl::Shutdown() ./../../content/browser/browser_main_runner_impl.cc:180:17 #10 0x59b53dfaab2c in content::BrowserMain(content::MainFunctionParams) ./../../content/browser/browser_main.cc:41:16 #11 0x59b5458404e0 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:734:10 #12 0x59b545843e03 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) ./../../content/app/content_main_runner_impl.cc:1341:10 #13 0x59b5458434c2 in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner_impl.cc:1196:12 #14 0x59b54583d849 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ./../../content/app/content_main.cc:362:36 #15 0x59b54583dd6b in content::ContentMain(content::ContentMainParams) ./../../content/app/content_main.cc:375:10 #16 0x59b5329fcf27 in ChromeMain ./../../chrome/app/chrome_main.cc:222:12 #17 0x75d08402a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #18 0x75d08402a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3 #19 0x59b532921029 in _start ??:0:0 previously allocated by thread T0 (chrome) here: #0 0x59b5329c2809 in ___interceptor_calloc _asan_rtl_:3 #1 0x59b534f2a983 in zalloc ./../../third_party/wayland/src/src/wayland-private.h:251:9 #2 0x59b534f2a983 in wl_display_connect_to_fd ./../../third_party/wayland/src/src/wayland-client.c:1222:12 #3 0x59b534f2b37d in wl_display_connect ./../../third_party/wayland/src/src/wayland-client.c:1343:9 #4 0x59b535019c10 in ui::WaylandConnection::Initialize(bool) ./../../ui/ozone/platform/wayland/host/wayland_connection.cc:188:18 #5 0x59b535150ac7 in ui::(anonymous namespace)::OzonePlatformWayland::InitializeUI(ui::OzonePlatform::InitParams const&) ./../../ui/ozone/platform/wayland/ozone_platform_wayland.cc:277:23 #6 0x59b534f18ee5 in ui::OzonePlatform::InitializeForUI(ui::OzonePlatform::InitParams const&) ./../../ui/ozone/public/ozone_platform.cc:82:20 #7 0x59b54fb17581 in aura::Env::Init() ./../../ui/aura/env.cc:256:8 #8 0x59b54fb173c8 in aura::Env::CreateInstance() ./../../ui/aura/env.cc:106:13 #9 0x59b53dfb752d in content::BrowserMainLoop::InitializeToolkit() ./../../content/browser/browser_main_loop.cc:1507:10 #10 0x59b53dfbc028 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams) ./../../content/browser/browser_main_runner_impl.cc:122:22 #11 0x59b53dfaaa13 in content::BrowserMain(content::MainFunctionParams) ./../../content/browser/browser_main.cc:28:32 #12 0x59b5458404e0 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:734:10 #13 0x59b545843e03 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) ./../../content/app/content_main_runner_impl.cc:1341:10 #14 0x59b5458434c2 in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner_impl.cc:1196:12 #15 0x59b54583d849 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ./../../content/app/content_main.cc:362:36 #16 0x59b54583dd6b in content::ContentMain(content::ContentMainParams) ./../../content/app/content_main.cc:375:10 #17 0x59b5329fcf27 in ChromeMain ./../../chrome/app/chrome_main.cc:222:12 #18 0x75d08402a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #19 0x75d08402a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3 #20 0x59b532921029 in _start ??:0:0 SUMMARY: AddressSanitizer: heap-use-after-free (/data/workspace/vmate_fuzz/chrome_extension/chrome/chrome+0x122794a1) (BuildId: bc503f41700be154) Shadow bytes around the buggy address: 0x731075fe1e00: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 00 0x731075fe1e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x731075fe1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x731075fe1f80: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa 0x731075fe2000: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd =>0x731075fe2080: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd 0x731075fe2100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x731075fe2180: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x731075fe2200: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 00 0x731075fe2280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x731075fe2300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1488484==ADDITIONAL INFO ==1488484==Note: Please include this section with the ASan report. Task trace: Command line: `/data/workspace/vmate_fuzz/chrome_extension/chrome/chrome --load-extension=/data/workspace/vmate/agent/builds/chrome_extension/extension --user-data-dir=/data/workspace/vmate_fuzz/chrome_extension/fuzz_user --no-sandbox --enable-logging=stderr --v=0 --flag-switches-begin --flag-switches-end --ozone-platform-hint=auto --ozone-platform=wayland --file-url-path-alias=/gen=/data/workspace/vmate_fuzz/chrome_extension/chrome/gen` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==1488484==END OF ADDITIONAL INFO