=================================================================
==31506==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d0001a8270 at pc 0x000313db45d8 bp 0x0003ee3adb90 sp 0x0003ee3adb88
READ of size 8 at 0x60d0001a8270 thread T89
==31506==WARNING: invalid path to external symbolizer!
==31506==WARNING: Failed to use and restart external symbolizer!
    #0 0x000313db45d4 in av1_choose_var_based_partitioning+0xa658 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13db45d4)
    #1 0x000313bb324c in av1_encode_sb_row+0x2060 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13bb324c)
    #2 0x000313c57ec8 in enc_row_mt_worker_hook+0xe80 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13c57ec8)
    #3 0x000302120948 in media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>::ExecuteOnTaskRunner(AVxWorker*)+0x150 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x2120948)
    #4 0x000302120f40 in void base::internal::Invoker<base::internal::FunctorTraits<void (media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>::*&&)(AVxWorker*), media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>*, AVxWorker*>, base::internal::BindState<true, true, false, void (media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>::*)(AVxWorker*), base::internal::UnretainedWrapper<media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<AVxWorker, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<void (media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>::*)(AVxWorker*), std::__Cr::tuple<base::internal::UnretainedWrapper<media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<AVxWorker, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul, 1ul>(void (media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>::*&&)(AVxWorker*), std::__Cr::tuple<base::internal::UnretainedWrapper<media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<AVxWorker, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>)+0x1f4 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x2120f40)
    #5 0x000310c2c054 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x344 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10c2c054)
    #6 0x000310c8eaac in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x844 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10c8eaac)
    #7 0x000310c8de9c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10c8de9c)
    #8 0x000310b19458 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+0x208 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10b19458)
    #9 0x000310c8fd98 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x338 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10c8fd98)
    #10 0x000310bbdf08 in base::RunLoop::Run(base::Location const&)+0x434 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10bbdf08)
    #11 0x000310cff49c in base::Thread::Run(base::RunLoop*)+0xd8 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cff49c)
    #12 0x000310cff8f8 in base::Thread::ThreadMain()+0x3dc (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cff8f8)
    #13 0x000310d4bea8 in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10d4bea8)
    #14 0x000100e9401c in __sanitizer_weak_hook_memcmp+0x3559c (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x5001c)
    #15 0x0001844aec08 in _pthread_start+0x84 (/usr/lib/system/libsystem_pthread.dylib:arm64+0x6c08)
    #16 0x0001844a9b7c in thread_start+0x4 (/usr/lib/system/libsystem_pthread.dylib:arm64+0x1b7c)

0x60d0001a8270 is located 113 bytes after 143-byte region [0x60d0001a8170,0x60d0001a81ff)
allocated by thread T4 here:
    #0 0x000100e9732c in __asan_memmove+0x2bb0 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x5332c)
    #1 0x000313b113c4 in aom_calloc+0x44 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13b113c4)
    #2 0x000313d0850c in av1_get_one_pass_rt_params+0x1f48 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13d0850c)
    #3 0x000313beeec0 in av1_encode_strategy+0x1044 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13beeec0)
    #4 0x000313c2966c in av1_get_compressed_data+0x424 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13c2966c)
    #5 0x000313b25fc4 in encoder_encode+0x1cd0 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13b25fc4)
    #6 0x000313b155d4 in aom_codec_encode+0x130 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13b155d4)
    #7 0x000320042400 in webrtc::(anonymous namespace)::LibaomAv1Encoder::Encode(webrtc::VideoFrame const&, std::__Cr::vector<webrtc::VideoFrameType, std::__Cr::allocator<webrtc::VideoFrameType>> const*)+0x1b38 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x20042400)
    #8 0x00031ffcb808 in webrtc::SimulcastEncoderAdapter::Encode(webrtc::VideoFrame const&, std::__Cr::vector<webrtc::VideoFrameType, std::__Cr::allocator<webrtc::VideoFrameType>> const*)+0xc24 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x1ffcb808)
    #9 0x0003203d9bc0 in webrtc::VideoStreamEncoder::EncodeVideoFrame(webrtc::VideoFrame const&, long long)+0x11b4 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x203d9bc0)
    #10 0x0003203d7b04 in webrtc::VideoStreamEncoder::MaybeEncodeVideoFrame(webrtc::VideoFrame const&, long long)+0x12c4 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x203d7b04)
    #11 0x0003203d6270 in webrtc::VideoStreamEncoder::OnFrame(webrtc::Timestamp, bool, webrtc::VideoFrame const&)+0x690 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x203d6270)
    #12 0x000320409db4 in void absl::internal_any_invocable::RemoteInvoker<false, void, webrtc::(anonymous namespace)::FrameCadenceAdapterImpl::OnFrame(webrtc::VideoFrame const&)::$_0&&>(absl::internal_any_invocable::TypeErasedState*)+0x2e8 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x20409db4)
    #13 0x00030145c1fc in blink::WebRtcTaskQueue::RunTask(absl::AnyInvocable<void () &&>)+0x118 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x145c1fc)
    #14 0x00030145d7d0 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::WebRtcTaskQueue::*&&)(absl::AnyInvocable<void () &&>), blink::WebRtcTaskQueue*, absl::AnyInvocable<void () &&>&&>, base::internal::BindState<true, true, false, void (blink::WebRtcTaskQueue::*)(absl::AnyInvocable<void () &&>), base::internal::RetainedRefWrapper<blink::WebRtcTaskQueue>, absl::AnyInvocable<void () &&>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x190 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x145d7d0)
    #15 0x000310c2c054 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x344 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10c2c054)
    #16 0x000310caddc4 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0x1f0 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10caddc4)
    #17 0x000310cae010 in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0xec (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cae010)
    #18 0x000310cac9e8 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&)+0x3cc (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cac9e8)
    #19 0x000310cabdd8 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource)+0x540 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cabdd8)
    #20 0x000310ce554c in base::internal::WorkerThread::RunWorker()+0x858 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10ce554c)
    #21 0x000310ce49e0 in base::internal::WorkerThread::RunPooledWorker()+0xac (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10ce49e0)
    #22 0x000310ce4398 in base::internal::WorkerThread::ThreadMain()+0x1e0 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10ce4398)
    #23 0x000310d4bea8 in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10d4bea8)
    #24 0x000100e9401c in __sanitizer_weak_hook_memcmp+0x3559c (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x5001c)
    #25 0x0001844aec08 in _pthread_start+0x84 (/usr/lib/system/libsystem_pthread.dylib:arm64+0x6c08)
    #26 0x0001844a9b7c in thread_start+0x4 (/usr/lib/system/libsystem_pthread.dylib:arm64+0x1b7c)

Thread T89 created by T4 here:
    #0 0x000100e8ed8c in __sanitizer_weak_hook_memcmp+0x3030c (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4ad8c)
    #1 0x000310d4b46c in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType)+0x270 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10d4b46c)
    #2 0x000310cfe8b4 in base::Thread::StartWithOptions(base::Thread::Options)+0x3e4 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cfe8b4)
    #3 0x000310cfe360 in base::Thread::Start()+0x178 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cfe360)
    #4 0x00030211ffdc in media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>::CodecWorkerImpl()+0x140 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x211ffdc)
    #5 0x00030211f7a0 in media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>::Reset(AVxWorker*)+0x190 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x211f7a0)
    #6 0x000313c4ca48 in av1_create_workers+0x2a0 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13c4ca48)
    #7 0x000313b2595c in encoder_encode+0x1668 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13b2595c)
    #8 0x000313b155d4 in aom_codec_encode+0x130 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13b155d4)
    #9 0x000320042400 in webrtc::(anonymous namespace)::LibaomAv1Encoder::Encode(webrtc::VideoFrame const&, std::__Cr::vector<webrtc::VideoFrameType, std::__Cr::allocator<webrtc::VideoFrameType>> const*)+0x1b38 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x20042400)
    #10 0x00031ffcb808 in webrtc::SimulcastEncoderAdapter::Encode(webrtc::VideoFrame const&, std::__Cr::vector<webrtc::VideoFrameType, std::__Cr::allocator<webrtc::VideoFrameType>> const*)+0xc24 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x1ffcb808)
    #11 0x0003203d9bc0 in webrtc::VideoStreamEncoder::EncodeVideoFrame(webrtc::VideoFrame const&, long long)+0x11b4 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x203d9bc0)
    #12 0x0003203d7b04 in webrtc::VideoStreamEncoder::MaybeEncodeVideoFrame(webrtc::VideoFrame const&, long long)+0x12c4 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x203d7b04)
    #13 0x0003203d6270 in webrtc::VideoStreamEncoder::OnFrame(webrtc::Timestamp, bool, webrtc::VideoFrame const&)+0x690 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x203d6270)
    #14 0x000320409db4 in void absl::internal_any_invocable::RemoteInvoker<false, void, webrtc::(anonymous namespace)::FrameCadenceAdapterImpl::OnFrame(webrtc::VideoFrame const&)::$_0&&>(absl::internal_any_invocable::TypeErasedState*)+0x2e8 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x20409db4)
    #15 0x00030145c1fc in blink::WebRtcTaskQueue::RunTask(absl::AnyInvocable<void () &&>)+0x118 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x145c1fc)
    #16 0x00030145d7d0 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::WebRtcTaskQueue::*&&)(absl::AnyInvocable<void () &&>), blink::WebRtcTaskQueue*, absl::AnyInvocable<void () &&>&&>, base::internal::BindState<true, true, false, void (blink::WebRtcTaskQueue::*)(absl::AnyInvocable<void () &&>), base::internal::RetainedRefWrapper<blink::WebRtcTaskQueue>, absl::AnyInvocable<void () &&>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x190 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x145d7d0)
    #17 0x000310c2c054 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x344 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10c2c054)
    #18 0x000310caddc4 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0x1f0 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10caddc4)
    #19 0x000310cae010 in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0xec (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cae010)
    #20 0x000310cac9e8 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&)+0x3cc (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cac9e8)
    #21 0x000310cabdd8 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource)+0x540 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cabdd8)
    #22 0x000310ce554c in base::internal::WorkerThread::RunWorker()+0x858 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10ce554c)
    #23 0x000310ce49e0 in base::internal::WorkerThread::RunPooledWorker()+0xac (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10ce49e0)
    #24 0x000310ce4398 in base::internal::WorkerThread::ThreadMain()+0x1e0 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10ce4398)
    #25 0x000310d4bea8 in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10d4bea8)
    #26 0x000100e9401c in __sanitizer_weak_hook_memcmp+0x3559c (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x5001c)
    #27 0x0001844aec08 in _pthread_start+0x84 (/usr/lib/system/libsystem_pthread.dylib:arm64+0x6c08)
    #28 0x0001844a9b7c in thread_start+0x4 (/usr/lib/system/libsystem_pthread.dylib:arm64+0x1b7c)

Thread T4 created by T0 here:
    #0 0x000100e8ed8c in __sanitizer_weak_hook_memcmp+0x3030c (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4ad8c)
    #1 0x000310d4b46c in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType)+0x270 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10d4b46c)
    #2 0x000310ce3360 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*)+0x27c (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10ce3360)
    #3 0x000310cb3564 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush()+0x230 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cb3564)
    #4 0x000310cb32d4 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor()+0x44 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cb32d4)
    #5 0x000310cb9540 in base::internal::ThreadGroupImpl::Start(unsigned long, unsigned long, base::TimeDelta, scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*, base::internal::ThreadGroup::WorkerEnvironment, bool, std::__Cr::optional<base::TimeDelta>)+0x290 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cb9540)
    #6 0x000310cd9c08 in base::internal::ThreadPoolImpl::Start(base::ThreadPoolInstance::InitParams const&, base::WorkerThreadObserver*)+0x7cc (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x10cd9c08)
    #7 0x0003195477d4 in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>)+0x300 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x195477d4)
    #8 0x000319692664 in content::RenderProcess::RenderProcess(std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>)+0x20 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x19692664)
    #9 0x000319692774 in content::RenderProcessImpl::RenderProcessImpl()+0xac (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x19692774)
    #10 0x00031970f8c8 in content::RendererMain(content::MainFunctionParams)+0x458 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x1970f8c8)
    #11 0x00030df30374 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*)+0x3d8 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0xdf30374)
    #12 0x00030df323dc in content::ContentMainRunnerImpl::Run()+0x49c (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0xdf323dc)
    #13 0x00030df2de0c in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x5bc (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0xdf2de0c)
    #14 0x00030df2e670 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0xdf2e670)
    #15 0x0003000070a0 in ChromeMain+0x360 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x70a0)
    #16 0x000100960d94 in main+0x254 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer):arm64+0x100000d94)
    #17 0x00018410eb94 in start+0x17b8 (/usr/lib/dyld:arm64+0xfffffffffff3ab94)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x13db45d4) in av1_choose_var_based_partitioning+0xa658
Shadow bytes around the buggy address:
  0x60d0001a7f80: fd fa fa fa fa fa fa fa f7 fa fa fa fa fa fa fa
  0x60d0001a8000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x60d0001a8080: fa fa f7 fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x60d0001a8100: fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 00 00
  0x60d0001a8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07
=>0x60d0001a8200: fa fa fa fa fa fa f7 fa fa fa fa fa fa fa[fa]fa
  0x60d0001a8280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x60d0001a8300: f7 fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x60d0001a8380: 00 00 00 fa fa fa fa fa fa fa f7 fa fa fa fa fa
  0x60d0001a8400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x60d0001a8480: fa fa fa fa f7 fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==31506==ADDITIONAL INFO

==31506==Note: Please include this section with the ASan report.
Task trace:
    #0 0x000302120490 in media::CodecWorkerImpl<AVxWorkerInterface, AVxWorkerImpl, AVxWorker, AVxWorkerStatus, (AVxWorkerStatus)0, (AVxWorkerStatus)1, (AVxWorkerStatus)2>::ChangeStateImpl(AVxWorker*, AVxWorkerStatus)+0x418 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x2120490)
    #1 0x000320404da4 in webrtc::(anonymous namespace)::FrameCadenceAdapterImpl::OnFrame(webrtc::VideoFrame const&)+0x2c4 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x20404da4)
    #2 0x000320af168c in blink::MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter::OnVideoFrameOnIO(scoped_refptr<media::VideoFrame>, base::TimeTicks)+0x130 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x20af168c)
    #3 0x0003214af3f0 in blink::CanvasCaptureHandler::SendFrame(base::TimeTicks, gfx::ColorSpace const&, scoped_refptr<media::VideoFrame>)+0x340 (/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Chromium Framework:arm64+0x214af3f0)


Command line: `/Users/jlennox/Chromium/Chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/138.0.7204.158/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer) --type=renderer --enable-dinosaur-easter-egg-alt-images --file-url-path-alias=/gen=/Users/jlennox/Chromium/Chromium/src/out/asan/gen --lang=en-US --num-raster-threads=4 --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources --enable-main-frame-before-activation --renderer-client-id=26 --time-ticks-at-unix-epoch=-1749947785385978 --launch-time-ticks=2810261150944 --shared-files --metrics-shmem-handle=1752395122,r,13786162932851446071,1535817525775190433,2097152 --field-trial-handle=1718379636,r,10649973526571850938,13127859531292311586,262144 --variations-seed-version --seatbelt-client=143`


==31506==END OF ADDITIONAL INFO
==31506==ABORTING