[.] Sanitizer coverage enabled. Counter map size: 8575417, Cmp map size: 262144
Note: Google Test filter = SVGTreeScopeResourcesTest.*
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from SVGTreeScopeResourcesTest
[ RUN      ] SVGTreeScopeResourcesTest.StoredValueDanglesAcrossNestedGC
=================================================================
==2110==ERROR: AddressSanitizer: heap-use-after-free on address 0x749826027f18 at pc 0x6491e1968fe6 bp 0x7ffc4a4f2510 sp 0x7ffc4a4f2508
WRITE of size 4 at 0x749826027f18 thread T0
    #0 0x6491e1968fe5 in blink::SVGTreeScopeResourcesTest_StoredValueDanglesAcrossNestedGC_Test::TestBody() gen/third_party/libc++/src/include/__atomic/support/c11.h:68:3
    #1 0x6491ca04243b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #2 0x6491ca044fa7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #3 0x6491ca047023 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #4 0x6491ca076324 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #5 0x6491ca074e9a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #6 0x6491e5877a70 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #7 0x6491c931f911 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), base::TestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::TestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #8 0x6491e588188b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #9 0x6491e58811ab in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #10 0x6491c931f37f in main third_party/blink/renderer/controller/tests/run_all_tests.cc:18:10
    #11 0x760827da8249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x749826027f18 is located 7448 bytes inside of 16384-byte region [0x749826026200,0x74982602a200)
freed by thread T0 here:
    #0 0x6491c927a366 in free (/chromium/chromium/src/out/asan/blink_unittests+0x10421366) (BuildId: 7e5b63dfd51a4298)
    #1 0x6491e196b27c in blink::HashTable<blink::AtomicString, blink::KeyValuePair<blink::AtomicString, cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>, blink::KeyValuePairExtractor, blink::HashMapValueTraits<blink::HashTraits<blink::AtomicString>, blink::HashTraits<cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>>, blink::HashTraits<blink::AtomicString>, blink::PartitionAllocator>::RehashTo(blink::KeyValuePair<blink::AtomicString, cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>*, unsigned int, blink::KeyValuePair<blink::AtomicString, cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>*) third_party/blink/renderer/platform/wtf/allocator/partition_allocator.h:73:5
    #2 0x6491efbfdafe in blink::SVGTreeScopeResources::ProcessCustomWeakness(cppgc::LivenessBroker const&) third_party/blink/renderer/platform/wtf/hash_table.h:1509:3
    #3 0x6491d22c29ba in cppgc::internal::MarkerBase::ProcessWeakness() v8/src/heap/cppgc/marker.cc:467:7
    #4 0x6491d22c1895 in cppgc::internal::MarkerBase::LeaveAtomicPause() v8/src/heap/cppgc/marker.cc:322:3
    #5 0x6491d010fb44 in v8::internal::CppHeap::FinishMarkingAndProcessWeakness() v8/src/heap/cppgc-js/cpp-heap.cc:988:14
    #6 0x6491d02a0f45 in v8::internal::MarkCompactCollector::CollectGarbage() v8/src/heap/mark-compact.cc:552:15
    #7 0x6491d02269a5 in v8::internal::Heap::MarkCompact() v8/src/heap/heap.cc:2547:29
    #8 0x6491d0225229 in v8::internal::Heap::PerformGarbageCollection(v8::internal::GarbageCollector, v8::internal::GarbageCollectionReason, char const*) v8/src/heap/heap.cc:2280:5
    #9 0x6491d027380e in v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags, v8::internal::PerformHeapLimitCheck, v8::internal::PerformIneffectiveMarkCompactCheck)::$_0::operator()() const v8/src/heap/heap.cc:1553:7
    #10 0x6491d0272fcc in void heap::base::Stack::SetMarkerAndCallbackImpl<v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags, v8::internal::PerformHeapLimitCheck, v8::internal::PerformIneffectiveMarkCompactCheck)::$_0>(heap::base::Stack*, void*, void const*) v8/src/heap/base/stack.h:182:5
    #11 0x6491d2307f22 in PushAllRegistersAndIterateStack push_registers_asm.cc
    #12 0x6491d021ad41 in v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags, v8::internal::PerformHeapLimitCheck, v8::internal::PerformIneffectiveMarkCompactCheck) v8/src/heap/base/stack.h:78:7
    #13 0x6491cfbc9aaa in v8::Isolate::RequestGarbageCollectionForTesting(v8::Isolate::GarbageCollectionType, cppgc::EmbedderStackState) v8/src/api/api.cc:10019:50
    #14 0x6491d0109941 in v8::internal::CppHeap::CollectGarbageForTesting(cppgc::internal::CollectionType, cppgc::EmbedderStackState) v8/src/heap/cppgc-js/cpp-heap.cc:1123:11
    #15 0x6491d4e4762a in blink::ThreadState::CollectAllGarbageForTesting(cppgc::EmbedderStackState) third_party/blink/renderer/platform/heap/thread_state.cc:203:16
    #16 0x6491e1967c0c in blink::SVGTreeScopeResourcesTest_StoredValueDanglesAcrossNestedGC_Test::TestBody() third_party/blink/renderer/core/svg/svg_tree_scope_resources_test.cc:87:27
    #17 0x6491ca04243b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #18 0x6491ca044fa7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #19 0x6491ca047023 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #20 0x6491ca076324 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #21 0x6491ca074e9a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #22 0x6491e5877a70 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #23 0x6491c931f911 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), base::TestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::TestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #24 0x6491e588188b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #25 0x6491e58811ab in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #26 0x6491c931f37f in main third_party/blink/renderer/controller/tests/run_all_tests.cc:18:10
    #27 0x760827da8249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 here:
    #0 0x6491c927a934 in malloc (/chromium/chromium/src/out/asan/blink_unittests+0x10421934) (BuildId: 7e5b63dfd51a4298)
    #1 0x6491e5ce1383 in void* partition_alloc::PartitionRoot::Alloc<(partition_alloc::internal::AllocFlags)0>(unsigned long, char const*) base/allocator/partition_allocator/src/partition_alloc/partition_root.h:2220:56
    #2 0x6491e196aa36 in blink::HashTable<blink::AtomicString, blink::KeyValuePair<blink::AtomicString, cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>, blink::KeyValuePairExtractor, blink::HashMapValueTraits<blink::HashTraits<blink::AtomicString>, blink::HashTraits<cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>>, blink::HashTraits<blink::AtomicString>, blink::PartitionAllocator>::Expand(blink::KeyValuePair<blink::AtomicString, cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>*) third_party/blink/renderer/platform/wtf/allocator/partition_allocator.h:65:20
    #3 0x6491e196a6b9 in blink::HashTableAddResult<blink::HashTable<blink::AtomicString, blink::KeyValuePair<blink::AtomicString, cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>, blink::KeyValuePairExtractor, blink::HashMapValueTraits<blink::HashTraits<blink::AtomicString>, blink::HashTraits<cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>>, blink::HashTraits<blink::AtomicString>, blink::PartitionAllocator>, blink::KeyValuePair<blink::AtomicString, cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>> blink::HashTable<blink::AtomicString, blink::KeyValuePair<blink::AtomicString, cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>, blink::KeyValuePairExtractor, blink::HashMapValueTraits<blink::HashTraits<blink::AtomicString>, blink::HashTraits<cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>>, blink::HashTraits<blink::AtomicString>, blink::PartitionAllocator>::insert<blink::HashMapTranslator<blink::HashTraits<blink::AtomicString>, blink::HashMapValueTraits<blink::HashTraits<blink::AtomicString>, blink::HashTraits<cppgc::internal::BasicMember<blink::LocalSVGResource, cppgc::internal::UntracedMemberTag, cppgc::internal::NoWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>>>>, blink::AtomicString const&, std::nullptr_t>(blink::AtomicString const&, std::nullptr_t&&) third_party/blink/renderer/platform/wtf/hash_table.h:1280:13
    #4 0x6491efbfce8d in blink::SVGTreeScopeResources::ResourceForId(blink::AtomicString const&) third_party/blink/renderer/platform/wtf/hash_map.h:489:25
    #5 0x6491e1967228 in blink::SVGTreeScopeResourcesTest_StoredValueDanglesAcrossNestedGC_Test::TestBody() third_party/blink/renderer/core/svg/svg_tree_scope_resources_test.cc:66:15
    #6 0x6491ca04243b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x6491ca044fa7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #8 0x6491ca047023 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #9 0x6491ca076324 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #10 0x6491ca074e9a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #11 0x6491e5877a70 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #12 0x6491c931f911 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), base::TestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::TestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #13 0x6491e588188b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #14 0x6491e58811ab in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #15 0x6491c931f37f in main third_party/blink/renderer/controller/tests/run_all_tests.cc:18:10
    #16 0x760827da8249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Shadow bytes around the buggy address:
  0x749826027c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x749826027d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x749826027d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x749826027e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x749826027e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x749826027f00: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd
  0x749826027f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x749826028000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x749826028080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x749826028100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x749826028180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
E0000 00:00:1778916065.834070    2110 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2110==ADDITIONAL INFO
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778916065.834216    2110 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2110==Note: Please include this section with the ASan report.
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778916065.834249    2110 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace:
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778916065.834279    2110 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778916065.834300    2110 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2110==END OF ADDITIONAL INFO
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778916065.834324    2110 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2110==ABORTING
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31