[330:347:0515/232118.248270:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[330:347:0515/232118.705936:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:347:0515/232118.706048:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[330:347:0515/232118.706089:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[330:347:0515/232118.706243:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:347:0515/232118.764290:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[367:367:0515/232118.787659:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1587] drmGetDevices2() has not found any devices
[367:367:0515/232118.937820:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process.
[330:330:0515/232118.993192:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured.
[330:347:0515/232119.106944:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:330:0515/232120.005347:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:330:0515/232120.064695:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable.
[330:330:0515/232120.064845:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:347:0515/232120.064886:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:347:0515/232120.065015:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:330:0515/232120.087846:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:330:0515/232120.090938:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:347:0515/232120.228688:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory

(chrome:330): dbind-WARNING **: 23:21:20.233: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory
[330:347:0515/232120.297818:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[330:347:0515/232120.496138:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:347:0515/232120.568090:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:330:0515/232121.257651:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:330:0515/232121.363905:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:347:0515/232121.364240:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:330:0515/232121.382578:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal.
[330:330:0515/232121.548301:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: 
[330:330:0515/232121.548338:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device
[330:330:0515/232121.632891:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:347:0515/232121.633154:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:330:0515/232121.654404:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:347:0515/232121.654594:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:330:0515/232121.687592:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:330:0515/232121.687641:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used.
[330:330:0515/232128.218569:INFO:CONSOLE:11] "[poc-ext] starting two downloads", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (11)
[330:347:0515/232128.309501:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:330:0515/232128.309724:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:347:0515/232128.309854:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:330:0515/232128.309901:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:347:0515/232128.316970:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:330:0515/232128.317083:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:347:0515/232128.317187:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory
[330:330:0515/232128.317243:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[330:330:0515/232128.320382:INFO:CONSOLE:20] "[poc-ext] download ids: 1,2", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (20)
[330:330:0515/232129.541895:INFO:CONSOLE:38] "[poc-ext] both downloads complete; bubble should be showing", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (38)
[330:330:0515/232130.115277:INFO:CONSOLE:50] "[poc-ext] erasing front-row download id 2", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (50)
[330:330:0515/232130.421963:INFO:CONSOLE:52] "[poc-ext] erased: 2 -- initially_focused_view now dangling; press F6", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (52)
=================================================================
==330==ERROR: AddressSanitizer: heap-use-after-free on address 0x6f528356a080 at pc 0x5eb68b995c45 bp 0x7ffc6cba5e90 sp 0x7ffc6cba5e88
READ of size 8 at 0x6f528356a080 thread T0 (chrome)
    #0 0x5eb68b995c44 in BrowserFocusControllerDelegateViews::ActivateFirstInactiveBubbleForAccessibility() chrome/browser/ui/focus/browser_focus_controller_delegate_views.cc:119:18
    #1 0x5eb6a81bbfb2 in non-virtual thunk to BrowserView::RotatePaneFocusFromView(views::View*, bool, bool) chrome/browser/ui/views/frame/browser_view.cc:4465:13
    #2 0x5eb68b99402d in BrowserFocusController::RotatePaneFocus(bool) chrome/browser/ui/focus/browser_focus_controller.cc:50:30
    #3 0x5eb6a7897c38 in chrome::FocusNextPane(BrowserWindowInterface*) chrome/browser/ui/browser_commands.cc:2328:42
    #4 0x5eb6a787b155 in chrome::BrowserCommandController::ExecuteCommandWithDisposition(int, WindowOpenDisposition, base::TimeTicks) chrome/browser/ui/browser_command_controller.cc:1007:7
    #5 0x5eb6922e2fb9 in ui::AcceleratorManager::Process(ui::Accelerator const&) ui/base/accelerators/accelerator_manager.cc:156:17
    #6 0x5eb69707ea3b in views::FocusManager::ProcessAccelerator(ui::Accelerator const&) ui/views/focus/focus_manager.cc:522:28
    #7 0x5eb6a664873b in views::UnhandledKeyboardEventHandler::HandleKeyboardEvent(input::NativeWebKeyboardEvent const&, views::FocusManager*) ui/views/controls/webview/unhandled_keyboard_event_handler.cc:44:24
    #8 0x5eb68454f046 in content::WebContentsImpl::HandleKeyboardEvent(input::NativeWebKeyboardEvent const&) content/browser/web_contents/web_contents_impl.cc:4633:34
    #9 0x5eb683f12a74 in base::internal::Invoker<base::internal::FunctorTraits<void (content::RenderWidgetHostImpl::*&&)(input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState), base::WeakPtr<content::RenderWidgetHostImpl>&&>, base::internal::BindState<true, true, false, void (content::RenderWidgetHostImpl::*)(input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState), base::WeakPtr<content::RenderWidgetHostImpl>>, void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>::RunOnce(base::internal::BindStateBase*, input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState) base/functional/bind_internal.h:740:12
    #10 0x5eb69648f813 in input::InputRouterImpl::KeyboardEventHandled(input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, base::OnceCallback<void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>) base/functional/callback.h:155:12
    #11 0x5eb69649b652 in void base::internal::DecayedFunctorTraits<void (input::InputRouterImpl::*)(input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, base::OnceCallback<void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>), base::WeakPtr<input::InputRouterImpl>&&, input::EventWithLatencyInfo<input::NativeWebKeyboardEvent>&&, base::OnceCallback<void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>&&>::Invoke<void (input::InputRouterImpl::*)(input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, base::OnceCallback<void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>), base::WeakPtr<input::InputRouterImpl> const&, input::EventWithLatencyInfo<input::NativeWebKeyboardEvent>, base::OnceCallback<void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>>(void (input::InputRouterImpl::*)(input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, base::OnceCallback<void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>), base::WeakPtr<input::InputRouterImpl> const&, input::EventWithLatencyInfo<input::NativeWebKeyboardEvent>&&, base::OnceCallback<void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>&&, blink::mojom::InputEventResultSource&&, ui::LatencyInfo const&, blink::mojom::InputEventResultState&&, mojo::StructPtr<blink::mojom::DidOverscrollParams>&&, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>&&) base/functional/bind_internal.h:740:12
    #12 0x5eb69649b2f5 in base::internal::Invoker<base::internal::FunctorTraits<void (input::InputRouterImpl::*&&)(input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, base::OnceCallback<void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>), base::WeakPtr<input::InputRouterImpl>&&, input::EventWithLatencyInfo<input::NativeWebKeyboardEvent>&&, base::OnceCallback<void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>&&>, base::internal::BindState<true, true, false, void (input::InputRouterImpl::*)(input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, base::OnceCallback<void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>), base::WeakPtr<input::InputRouterImpl>, input::EventWithLatencyInfo<input::NativeWebKeyboardEvent>, base::OnceCallback<void (input::EventWithLatencyInfo<input::NativeWebKeyboardEvent> const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>>, void (blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>)>::RunOnce(base::internal::BindStateBase*, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>&&, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>&&) base/functional/bind_internal.h:956:5
    #13 0x5eb69649e24a in base::internal::Invoker<base::internal::FunctorTraits<input::InputRouterImpl::FilterAndSendWebInputEvent(blink::WebInputEvent const&, ui::LatencyInfo const&, base::OnceCallback<void (blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>)>, base::OnceCallback<void (blink::WebInputEvent const&, input::DispatchToRendererResult)>&)::$_0&&, base::OnceCallback<void (blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>)>&&, base::WeakPtr<input::InputRouterImpl>&&>, base::internal::BindState<false, false, false, input::InputRouterImpl::FilterAndSendWebInputEvent(blink::WebInputEvent const&, ui::LatencyInfo const&, base::OnceCallback<void (blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>)>, base::OnceCallback<void (blink::WebInputEvent const&, input::DispatchToRendererResult)>&)::$_0, base::OnceCallback<void (blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>)>, base::WeakPtr<input::InputRouterImpl>>, void (blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>)>::RunOnce(base::internal::BindStateBase*, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr<blink::mojom::DidOverscrollParams>&&, mojo::InlinedStructPtr<blink::mojom::TouchActionOptional>&&) base/functional/callback.h:155:12
    #14 0x5eb67bbb96f9 in blink::mojom::WidgetInputHandler_DispatchEvent_ForwardToCallback::Accept(mojo::Message*) base/functional/callback.h:155:12
    #15 0x5eb68fb9ed19 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1079:41
    #16 0x5eb68fbbc291 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #17 0x5eb68fba4973 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #18 0x5eb68fbcc168 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42
    #19 0x5eb68fbca648 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7
    #20 0x5eb68fbbc291 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #21 0x5eb68fb951cc in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) mojo/public/cpp/bindings/lib/connector.cc:567:49
    #22 0x5eb68fb96850 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14
    #23 0x5eb68fb962a9 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3
    #24 0x5eb68fb98104 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12
    #25 0x5eb67c0d7d1e in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12
    #26 0x5eb67c0d7aba in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12
    #27 0x5eb68fc386d0 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12
    #28 0x5eb68fc38010 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14
    #29 0x5eb68fc391d7 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #30 0x5eb68ede44c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #31 0x5eb68ee534ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #32 0x5eb68ee5238a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #33 0x5eb68effe828 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #34 0x5eb68f001de8 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #35 0x71b28652b718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)

0x6f528356a080 is located 0 bytes inside of 1200-byte region [0x6f528356a080,0x6f528356a530)
freed by thread T0 (chrome) here:
    #0 0x5eb676c53ddd in operator delete(void*) (/chromium/chromium/src/out/asan/chrome+0x10e2eddd) (BuildId: 42c52701e3eebdcb)
    #1 0x5eb697116c3a in views::View::~View() ui/views/view.cc:285:9
    #2 0x5eb68b377fd3 in DownloadBubbleRowView::~DownloadBubbleRowView() chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc:315:1
    #3 0x5eb68b378353 in DownloadBubbleRowView::~DownloadBubbleRowView() chrome/browser/ui/views/download/bubble/download_bubble_row_view.cc:309:49
    #4 0x5eb68c45a1b7 in void base::ObserverList<DownloadBubbleRowListViewInfoObserver, false, (base::ObserverListReentrancyPolicy)0, base::internal::CheckedObserverAdapter>::Notify<void (DownloadBubbleRowListViewInfoObserver::*)(offline_items_collection::ContentId const&), offline_items_collection::ContentId>(T, offline_items_collection::ContentId const&) gen/third_party/libc++/src/include/__type_traits/invoke.h:90:27
    #5 0x5eb68c459416 in DownloadBubbleRowListViewInfo::RemoveRow(offline_items_collection::ContentId const&) chrome/browser/ui/download/download_bubble_info.h:41:16
    #6 0x5eb68c461a77 in void base::ObserverList<DownloadBubbleRowViewInfoObserver, false, (base::ObserverListReentrancyPolicy)0, base::internal::CheckedObserverAdapter>::Notify<void (DownloadBubbleRowViewInfoObserver::*)(offline_items_collection::ContentId const&), offline_items_collection::ContentId>(T, offline_items_collection::ContentId const&) gen/third_party/libc++/src/include/__type_traits/invoke.h:90:27
    #7 0x5eb68bbfe79b in DownloadItemModel::OnDownloadDestroyed(download::DownloadItem*) chrome/browser/download/download_item_model.cc:617:16
    #8 0x5eb67c46cb7d in download::DownloadItemImpl::~DownloadItemImpl() components/download/internal/common/download_item_impl.cc:527:14
    #9 0x5eb67c46da83 in download::DownloadItemImpl::~DownloadItemImpl() components/download/internal/common/download_item_impl.cc:518:39
    #10 0x5eb682c809d3 in std::__Cr::unordered_map<unsigned int, std::__Cr::unique_ptr<download::DownloadItemImpl, std::__Cr::default_delete<download::DownloadItemImpl>>, std::__Cr::hash<unsigned int>, std::__Cr::equal_to<unsigned int>, std::__Cr::allocator<std::__Cr::pair<unsigned int const, std::__Cr::unique_ptr<download::DownloadItemImpl, std::__Cr::default_delete<download::DownloadItemImpl>>>>>::erase(unsigned int const&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #11 0x5eb682c80b20 in non-virtual thunk to content::DownloadManagerImpl::DownloadRemoved(download::DownloadItemImpl*) content/browser/download/download_manager_impl.cc:984:14
    #12 0x5eb68973cb3d in extensions::DownloadsEraseFunction::Run() chrome/browser/extensions/api/downloads/downloads_api.cc:1388:13
    #13 0x5eb685b4b8c2 in ExtensionFunction::RunWithValidation() extensions/browser/extension_function.cc:494:10
    #14 0x5eb685b5c5d3 in extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal(mojo::StructPtr<extensions::mojom::RequestParams>, content::RenderFrameHost*, content::RenderProcessHost&, base::OnceCallback<void (ExtensionFunction::ResponseType, base::ListValue, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, mojo::StructPtr<extensions::mojom::ExtraResponseData>)>) extensions/browser/extension_function_dispatcher.cc:457:15
    #15 0x5eb685b5d157 in extensions::ExtensionFunctionDispatcher::DispatchForServiceWorker(mojo::StructPtr<extensions::mojom::RequestParams>, int, base::OnceCallback<void (bool, base::ListValue, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, mojo::StructPtr<extensions::mojom::ExtraResponseData>)>) extensions/browser/extension_function_dispatcher.cc:248:3
    #16 0x5eb685cfceaf in extensions::ServiceWorkerHost::RequestWorker(mojo::StructPtr<extensions::mojom::RequestParams>, base::OnceCallback<void (bool, base::ListValue, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, mojo::StructPtr<extensions::mojom::ExtraResponseData>)>) extensions/browser/service_worker/service_worker_host.cc:288:16
    #17 0x5eb685e8d643 in extensions::mojom::ServiceWorkerHostStubDispatch::AcceptWithResponder(extensions::mojom::ServiceWorkerHost*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_delete<mojo::MessageReceiverWithStatus>>) gen/extensions/common/mojom/service_worker_host.mojom.cc:1718:13
    #18 0x5eb68fb9e667 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56
    #19 0x5eb68fbbc291 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #20 0x5eb68fba4973 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #21 0x5eb68fbcc168 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42
    #22 0x5eb68fbca648 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7
    #23 0x5eb68fbbc291 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #24 0x5eb68fb951cc in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) mojo/public/cpp/bindings/lib/connector.cc:567:49
    #25 0x5eb68fb96850 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14
    #26 0x5eb68fb962a9 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3
    #27 0x5eb68fb98104 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12
    #28 0x5eb67c0d7d1e in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12
    #29 0x5eb67c0d7aba in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12

previously allocated by thread T0 (chrome) here:
    #0 0x5eb676c5359d in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2e59d) (BuildId: 42c52701e3eebdcb)
    #1 0x5eb68b3796e4 in DownloadBubbleRowView::DownloadBubbleRowView(DownloadBubbleRowViewInfo const&, base::WeakPtr<DownloadBubbleUIController>, base::WeakPtr<DownloadBubbleNavigationHandler>, base::WeakPtr<Browser>, int) ui/views/controls/button/button.h:54:3
    #2 0x5eb68b36e5f1 in DownloadBubbleRowListView::AddRow(DownloadBubbleRowViewInfo const&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #3 0x5eb68b36df5b in DownloadBubbleRowListView::DownloadBubbleRowListView(base::WeakPtr<Browser>, base::WeakPtr<DownloadBubbleUIController>, base::WeakPtr<DownloadBubbleNavigationHandler>, int, DownloadBubbleRowListViewInfo const&) chrome/browser/ui/views/download/bubble/download_bubble_row_list_view.cc:32:5
    #4 0x5eb68b36c6bb in DownloadBubblePrimaryView::BuildAndAddScrollView(base::WeakPtr<Browser>, base::WeakPtr<DownloadBubbleUIController>, base::WeakPtr<DownloadBubbleNavigationHandler>, DownloadBubbleRowListViewInfo const&, int) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #5 0x5eb68b35b7c6 in DownloadBubblePartialView::DownloadBubblePartialView(base::WeakPtr<Browser>, base::WeakPtr<DownloadBubbleUIController>, base::WeakPtr<DownloadBubbleNavigationHandler>, DownloadBubbleRowListViewInfo const&, base::OnceCallback<void ()>) chrome/browser/ui/views/download/bubble/download_bubble_partial_view.cc:225:3
    #6 0x5eb68b3561ad in DownloadBubbleContentsView::DownloadBubbleContentsView(base::WeakPtr<Browser>, base::WeakPtr<DownloadBubbleUIController>, base::WeakPtr<DownloadBubbleNavigationHandler>, bool, std::__Cr::unique_ptr<DownloadBubbleContentsViewInfo, std::__Cr::default_delete<DownloadBubbleContentsViewInfo>>, views::BubbleDialogDelegate*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #7 0x5eb68b3afbc2 in DownloadToolbarUIController::CreateBubbleDialogDelegate() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #8 0x5eb68ebebc5f in DownloadDisplayController::OnUpdatedItem(bool, bool) chrome/browser/download/bubble/download_display_controller.cc:180:15
    #9 0x5eb68ebc4b29 in DownloadBubbleUIController::OnDownloadItemUpdated(download::DownloadItem*) chrome/browser/download/bubble/download_bubble_ui_controller.cc:206:24
    #10 0x5eb68ebe4559 in bool absl::functional_internal::InvokeObject<DownloadBubbleUpdateService::OnDownloadUpdated(content::DownloadManager*, download::DownloadItem*)::$_0 const&, bool, BrowserWindowInterface*>(absl::functional_internal::VoidPtr, absl::functional_internal::ForwardT<BrowserWindowInterface*>::type) chrome/browser/download/bubble/download_bubble_update_service.cc:879:30
    #11 0x5eb68b29f99b in BrowserCollection::ForEach(base::FunctionRef<bool (BrowserWindowInterface*)>, BrowserCollection::Order, bool) third_party/abseil-cpp/absl/functional/function_ref.h:165:12
    #12 0x5eb68ebd46b8 in DownloadBubbleUpdateService::OnDownloadUpdated(content::DownloadManager*, download::DownloadItem*) chrome/browser/download/bubble/download_bubble_update_service.cc:874:54
    #13 0x5eb67c46ea10 in download::DownloadItemImpl::UpdateObservers() components/download/internal/common/download_item_impl.cc:552:14
    #14 0x5eb67c48368a in download::DownloadItemImpl::Completed() components/download/internal/common/download_item_impl.cc:2124:3
    #15 0x5eb67c482ef4 in download::DownloadItemImpl::OnDownloadRenamedToFinalName(download::DownloadInterruptReason, base::FilePath const&) components/download/internal/common/download_item_impl.cc:2066:5
    #16 0x5eb67c4825c5 in download::DownloadItemImpl::OnRenameAndAnnotateDone(download::DownloadInterruptReason, base::FilePath const&) components/download/internal/common/download_item_impl.cc:2012:3
    #17 0x5eb67c489c5e in base::internal::Invoker<base::internal::FunctorTraits<void (download::DownloadItemImpl::*&&)(download::DownloadInterruptReason, base::FilePath const&), base::WeakPtr<download::DownloadItemImpl>&&>, base::internal::BindState<true, true, false, void (download::DownloadItemImpl::*)(download::DownloadInterruptReason, base::FilePath const&), base::WeakPtr<download::DownloadItemImpl>>, void (download::DownloadInterruptReason, base::FilePath const&)>::RunOnce(base::internal::BindStateBase*, download::DownloadInterruptReason, base::FilePath const&) base/functional/bind_internal.h:740:12
    #18 0x5eb67c460ea8 in base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (download::DownloadInterruptReason, base::FilePath const&)>&&, download::DownloadInterruptReason&&, base::FilePath&&>, base::internal::BindState<false, true, true, base::OnceCallback<void (download::DownloadInterruptReason, base::FilePath const&)>, download::DownloadInterruptReason, base::FilePath>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/callback.h:155:12
    #19 0x5eb68ede44c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #20 0x5eb68ee534ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #21 0x5eb68ee5238a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #22 0x5eb68efff164 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48
    #23 0x5eb68ee54bd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #24 0x5eb68ed5fb70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #25 0x5eb6826a911c in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18
    #26 0x5eb6826b1acc in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:148:15
    #27 0x5eb6826a015c in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28
    #28 0x5eb68b5e18c1 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10
    #29 0x5eb68b5e5a08 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1331:10

SUMMARY: AddressSanitizer: heap-use-after-free chrome/browser/ui/focus/browser_focus_controller_delegate_views.cc:119:18 in BrowserFocusControllerDelegateViews::ActivateFirstInactiveBubbleForAccessibility()
Shadow bytes around the buggy address:
  0x6f5283569e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f5283569e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f5283569f00: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
  0x6f5283569f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6f528356a000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
=>0x6f528356a080:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f528356a100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f528356a180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f528356a200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f528356a280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f528356a300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==330==ADDITIONAL INFO

==330==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5eb68fc38b43 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13


Command line: `/chromium/chromium/src/out/asan/chrome --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --user-data-dir=/tmp/chrome-poc-profile --disable-features=ChromeWhatsNewUI --load-extension=/poc-artifacts/extension --enable-logging=stderr --v=0 --ozone-platform=x11 --flag-switches-begin --flag-switches-end http://localhost:8080/poc.html`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==330==END OF ADDITIONAL INFO

==330==ABORTING
[371:409:0515/232133.050210:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.
[371:409:0515/232133.050316:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.