[14656:3188:0414/153915.530:ERROR:third_party\blink\renderer\core\html\closewatcher\close_watcher.cc:168] Signalbegin===

[14656:3188:0414/153915.532:ERROR:third_party\blink\renderer\core\html\closewatcher\close_watcher.cc:170] Signal , group 2 tname-> CrRendererMain

[14656:3188:0414/153915.532:ERROR:third_party\blink\renderer\core\html\closewatcher\close_watcher.cc:172] Signal , before RequestClose, group.size-> 2 tname-> CrRendererMain

[9452:10968:0414/153915.534:INFO:CONSOLE:42] "watcher.oncancel", source: file:///C:/Users/12700k/Documents/test/clusterfuzz-testcase-5308799824887808~/poc.html (42)
=================================================================
==14656==ERROR: AddressSanitizer: use-after-poison on address 0x7ebc00470e4c at pc 0x7ffe4d32dffd bp 0x00de0f7f90e0 sp 0x00de0f7f9128
READ of size 4 at 0x7ebc00470e4c thread T0
==14656==*** WARNING: Failed to initialize DbgHelp!              ***
==14656==*** Most likely this means that the app is already      ***
==14656==*** using DbgHelp, possibly with incompatible flags.    ***
==14656==*** Due to technical reasons, symbolization might crash ***
==14656==*** or produce wrong results.                           ***
[9452:10968:0414/153916.038:ERROR:chrome\browser\policy\cloud\fm_registration_token_uploader.cc:179] Client is missing for kUser scope
[9452:10968:0414/153916.039:ERROR:chrome\browser\policy\cloud\fm_registration_token_uploader.cc:179] Client is missing for kUser scope
[9452:7416:0414/153916.265:ERROR:google_apis\gcm\engine\registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
    #0 0x7ffe4d32dffc in blink::CloseWatcher::WatcherStack::Signal D:\chromium\src\third_party\blink\renderer\core\html\closewatcher\close_watcher.cc:176
    #1 0x7ffe4d9456e8 in blink::KeyboardEventManager::DefaultEscapeEventHandler D:\chromium\src\third_party\blink\renderer\core\input\keyboard_event_manager.cc:610
    #2 0x7ffe4d94472d in blink::KeyboardEventManager::DefaultKeyboardEventHandler D:\chromium\src\third_party\blink\renderer\core\input\keyboard_event_manager.cc:426
    #3 0x7ffe4fce79a6 in blink::EventDispatcher::DispatchEventPostProcess D:\chromium\src\third_party\blink\renderer\core\dom\events\event_dispatcher.cc:414
    #4 0x7ffe4fce524f in blink::EventDispatcher::Dispatch D:\chromium\src\third_party\blink\renderer\core\dom\events\event_dispatcher.cc:275
    #5 0x7ffe4fce33e8 in blink::EventDispatcher::DispatchEvent D:\chromium\src\third_party\blink\renderer\core\dom\events\event_dispatcher.cc:81
    #6 0x7ffe4d942890 in blink::KeyboardEventManager::KeyEvent D:\chromium\src\third_party\blink\renderer\core\input\keyboard_event_manager.cc:333
    #7 0x7ffe4d16484c in blink::WebFrameWidgetImpl::HandleKeyEvent D:\chromium\src\third_party\blink\renderer\core\frame\web_frame_widget_impl.cc:955
    #8 0x7ffe4d992f0e in blink::WidgetEventHandler::HandleInputEvent D:\chromium\src\third_party\blink\renderer\core\input\widget_event_handler.cc:114
    #9 0x7ffe4d1809ee in blink::WebFrameWidgetImpl::HandleInputEvent D:\chromium\src\third_party\blink\renderer\core\frame\web_frame_widget_impl.cc:3180
    #10 0x7ffe4670855d in blink::WidgetBaseInputHandler::HandleInputEvent D:\chromium\src\third_party\blink\renderer\platform\widget\input\widget_base_input_handler.cc:417
    #11 0x7ffe46720c36 in blink::WidgetInputHandlerManager::HandleInputEvent D:\chromium\src\third_party\blink\renderer\platform\widget\input\widget_input_handler_manager.cc:423
    #12 0x7ffe466e7791 in blink::MainThreadEventQueue::HandleEventOnMainThread D:\chromium\src\third_party\blink\renderer\platform\widget\input\main_thread_event_queue.cc:808
    #13 0x7ffe466eb69d in blink::QueuedWebInputEvent::Dispatch D:\chromium\src\third_party\blink\renderer\platform\widget\input\main_thread_event_queue.cc:194
    #14 0x7ffe466e5633 in blink::MainThreadEventQueue::DispatchEvents D:\chromium\src\third_party\blink\renderer\platform\widget\input\main_thread_event_queue.cc:571
    #15 0x7ffe466f299c in base::internal::Invoker<base::internal::FunctorTraits<void (MainThreadEventQueue::*&&)(),blink::MainThreadEventQueue *&&>,base::internal::BindState<1,1,0,void (MainThreadEventQueue::*)(),scoped_refptr<blink::MainThreadEventQueue> >,void ()>::RunOnce D:\chromium\src\base\functional\bind_internal.h:973
    #16 0x7fff3174a623 in base::TaskAnnotator::RunTaskImpl D:\chromium\src\base\task\common\task_annotator.cc:209
    #17 0x7fff317d5b19 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl D:\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456
    #18 0x7fff317d49bf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork D:\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330
    #19 0x7fff315bc6f7 in base::MessagePumpDefault::Run D:\chromium\src\base\message_loop\message_pump_default.cc:42
    #20 0x7fff317d7891 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run D:\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629
    #21 0x7fff316a91ae in base::RunLoop::Run D:\chromium\src\base\run_loop.cc:134
    #22 0x7ffe818938a0 in content::RendererMain D:\chromium\src\content\renderer\renderer_main.cc:369
    #23 0x7ffe81d60766 in content::RunOtherNamedProcessTypeMain D:\chromium\src\content\app\content_main_runner_impl.cc:781
    #24 0x7ffe81d62f9a in content::ContentMainRunnerImpl::Run D:\chromium\src\content\app\content_main_runner_impl.cc:1155
    #25 0x7ffe81d5652b in content::RunContentProcess D:\chromium\src\content\app\content_main.cc:359
    #26 0x7ffe81d570b0 in content::ContentMain D:\chromium\src\content\app\content_main.cc:372
    #27 0x7ffe895016ba in ChromeMain D:\chromium\src\chrome\app\chrome_main.cc:222
    #28 0x7ff7e20d3de9 in MainDllLoader::Launch D:\chromium\src\chrome\app\main_dll_loader_win.cc:201
    #29 0x7ff7e20d1be9 in main D:\chromium\src\chrome\app\chrome_exe_main_win.cc:352
    #30 0x7ff7e227e3b3 in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #31 0x7fff890ae8d6 in BaseThreadInitThunk+0x16 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
    #32 0x7fff8b1dbf6b in RtlUserThreadStart+0x2b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x1800bbf6b)

Address 0x7ebc00470e4c is a wild pointer inside of access range of size 0x000000000004.
SUMMARY: AddressSanitizer: use-after-poison D:\chromium\src\third_party\blink\renderer\core\html\closewatcher\close_watcher.cc:176 in blink::CloseWatcher::WatcherStack::Signal
Shadow bytes around the buggy address:
  0x7ebc00470b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ebc00470c00: 00 00 00 00 00 f7 f7 f7 f7 00 00 00 00 f7 f7 f7
  0x7ebc00470c80: f7 f7 f7 f7 f7 f7 f7 00 00 00 00 00 00 00 00 00
  0x7ebc00470d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ebc00470d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7ebc00470e00: 00 00 00 00 00 00 00 00 00[f7]00 00 00 00 00 00
  0x7ebc00470e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ebc00470f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ebc00470f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ebc00471000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7ebc00471080: 00 00 00 f7 f7 00 00 00 00 00 00 00 00 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==14656==ADDITIONAL INFO

==14656==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7ffe466e34a0 in blink::MainThreadEventQueue::QueueEvent D:\chromium\src\third_party\blink\renderer\platform\widget\input\main_thread_event_queue.cc:738
    #1 0x7fff62f6e3af in mojo::SimpleWatcher::Context::Notify D:\chromium\src\mojo\public\cpp\system\simple_watcher.cc:102


Command line: `"D:\chromium\src\out\asan\chrome.exe" --type=renderer --user-data-dir=test --no-pre-read-main-dll --no-sandbox --js-flags="-expose-gc --allow-natives-syntax" --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=2 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1743991026287498 --launch-time-ticks=625327425289 --metrics-shmem-handle=3384,i,13941371420173574604,2756554228562263361,2097152 --field-trial-handle=1880,i,16202755530615160075,16493414734575409601,262144 --variations-seed-version --enable-logging=stderr --mojo-platform-channel-handle=3392 /prefetch:1`


==14656==END OF ADDITIONAL INFO
==14656==ABORTING