$ ./chromium-150/chrome-wrapper --no-sandbox ~/Downloads/poc.html
=================================================================
==1829564==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c14e5c287c8 at pc 0x55b5cad3aa72 bp 0x7ffe09d2cf30 sp 0x7ffe09d2cf28
READ of size 8 at 0x7c14e5c287c8 thread T0 (chrome)
==1829564==WARNING: invalid path to external symbolizer!
==1829564==WARNING: Failed to use and restart external symbolizer!
    #0 0x55b5cad3aa71 in blink::Document::ProcessBaseElement() ./../../base/memory/scoped_refptr.h:319:43
    #1 0x55b5caee2356 in blink::Element::AttributeChanged(blink::Element::AttributeModificationParams const&) ./../../third_party/blink/renderer/core/dom/element.cc:3797:3
    #2 0x55b5c7cb6c4e in blink::HTMLElement::AttributeChanged(blink::Element::AttributeModificationParams const&) ./../../third_party/blink/renderer/core/html/html_element.cc:841:12
    #3 0x55b5caee7f41 in blink::Element::AttributeChangedWithInvalidations(blink::Element::AttributeModificationParams const&) ./../../third_party/blink/renderer/core/dom/element.cc:3939:3
    #4 0x55b5caf600d6 in blink::Element::SetAttributeWithoutValidation(blink::QualifiedName const&, blink::AtomicString const&) ./../../third_party/blink/renderer/core/dom/element.cc:11736:3
    #5 0x55b5cbbf48c9 in blink::(anonymous namespace)::v8_html_base_element::HrefAttributeSetCallback(v8::FunctionCallbackInfo<v8::Value> const&) ./gen/third_party/blink/renderer/bindings/core/v8/v8_html_base_element.cc:117:17
    #6 0x55b5a71c8c90 in v8::internal::FunctionCallbackArguments::CallOrConstruct(v8::internal::Isolate*, v8::internal::Tagged<v8::internal::FunctionTemplateInfo>, bool) ./../../v8/src/api/api-arguments-inl.h:176:3
    #7 0x55b5a71c7c61 in v8::internal::Builtins::InvokeApiFunction(v8::internal::Isolate*, bool, v8::internal::DirectHandle<v8::internal::FunctionTemplateInfo>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>, v8::internal::DirectHandle<v8::internal::HeapObject>) ./../../v8/src/builtins/builtins-api.cc:120:27
    #8 0x55b5a82db320 in v8::internal::Object::SetPropertyWithAccessor(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>) ./../../v8/src/objects/objects.cc:1696:9
    #9 0x55b5a82e1521 in v8::internal::Object::SetPropertyInternal(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>, v8::internal::StoreOrigin, bool*) ./../../v8/src/objects/objects.cc:2473:16
    #10 0x55b5a82d5ce6 in v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) ./../../v8/src/objects/objects.cc:2567:9
    #11 0x55b5a7ae3b94 in v8::internal::StoreIC::Store(v8::internal::Handle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::Handle<v8::internal::Name>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin) ./../../v8/src/ic/ic.cc:2266:23
    #12 0x55b5a7af2eb1 in v8::internal::Runtime_StoreIC_Miss(int, unsigned long*, v8::internal::Isolate*) ./../../v8/src/ic/ic.cc:3392:40
    #13 0x55b5ac2ec4f5 in Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit ???:0:0
    #14 0x55b5ac3f592c in Builtins_SetNamedPropertyHandler ???:0:0
    #15 0x55b5ac23a956 in Builtins_InterpreterEntryTrampoline ???:0:0
    #16 0x55b5ac2376db in Builtins_JSEntryTrampoline ???:0:0
    #17 0x55b5ac23742a in Builtins_JSEntry ???:0:0
    #18 0x55b5a74e0ad7 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) ./../../v8/src/execution/execution.cc:475:22
    #19 0x55b5a74e3482 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) ./../../v8/src/execution/execution.cc:575:10
    #20 0x55b5a70baa03 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) ./../../v8/src/api/api.cc:2040:7
    #21 0x55b5c610119d in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local<v8::Script>, v8::Local<v8::Data>, blink::ExecutionContext*) ./../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:509:22
    #22 0x55b5c6102b36 in blink::V8ScriptRunner::CompileAndRunScript(blink::ScriptState*, blink::ClassicScript*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:633:22
    #23 0x55b5c9829c92 in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/core/script/classic_script.cc:227:10
    #24 0x55b5c988dac7 in blink::Script::RunScriptOnScriptState(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/core/script/script.cc:35:17
    #25 0x55b5c988defb in blink::Script::RunScript(blink::LocalDOMWindow*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/core/script/script.cc:42:3
    #26 0x55b5c98b9f46 in blink::PendingScript::ExecuteScriptBlockInternal(blink::Script*, blink::ScriptElementBase*, bool, bool, bool, base::TimeTicks, bool) ./../../third_party/blink/renderer/core/script/pending_script.cc:312:13
    #27 0x55b5c98b8eb6 in blink::PendingScript::ExecuteScriptBlock() ./../../third_party/blink/renderer/core/script/pending_script.cc:209:3
    #28 0x55b5c989460a in blink::ScriptLoader::PrepareScript(blink::ScriptLoader::ParserBlockingInlineOption, blink::TextPosition const&) ./../../third_party/blink/renderer/core/script/script_loader.cc:1179:60
    #29 0x55b5cb0b7c8f in blink::HTMLParserScriptRunner::ProcessScriptElementInternal(blink::Element*, blink::TextPosition const&) ./../../third_party/blink/renderer/core/script/html_parser_script_runner.cc:587:52
    #30 0x55b5cb0b7436 in blink::HTMLParserScriptRunner::ProcessScriptElement(blink::Element*, blink::TextPosition const&) ./../../third_party/blink/renderer/core/script/html_parser_script_runner.cc:297:3
    #31 0x55b5cb090b9c in blink::HTMLDocumentParser::RunScriptsForPausedTreeBuilder() ./../../third_party/blink/renderer/core/html/parser/html_document_parser.cc:672:21
    #32 0x55b5cb08cffd in blink::HTMLDocumentParser::PumpTokenizer() ./../../third_party/blink/renderer/core/html/parser/html_document_parser.h:232:7
    #33 0x55b5cb08b4ad in blink::HTMLDocumentParser::PumpTokenizerIfPossible() ./../../third_party/blink/renderer/core/html/parser/html_document_parser.cc:635:15
    #34 0x55b5cb099de4 in blink::HTMLDocumentParser::FinishAppend() ./../../third_party/blink/renderer/core/html/parser/html_document_parser.cc:1038:5
    #35 0x55b5cb098575 in blink::HTMLDocumentParser::Append(blink::String const&) ./../../third_party/blink/renderer/core/html/parser/html_document_parser.cc:1031:3
    #36 0x55b5c7e370e8 in blink::DecodedDataDocumentParser::UpdateDocument(blink::String const&) ./../../third_party/blink/renderer/core/dom/decoded_data_document_parser.cc:153:3
    #37 0x55b5c7e36b40 in blink::DecodedDataDocumentParser::AppendBytes(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) ./../../third_party/blink/renderer/core/dom/decoded_data_document_parser.cc:72:3
    #38 0x55b5cb09fb8f in blink::HTMLDocumentParser::AppendBytes(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) ./../../third_party/blink/renderer/core/html/parser/html_document_parser.cc:1405:30
    #39 0x55b5c8f4d1d0 in blink::DocumentLoader::CommitData(blink::DocumentLoader::BodyData&) ./../../third_party/blink/renderer/core/loader/document_loader.cc:1654:8
    #40 0x55b5c8f49630 in blink::DocumentLoader::ProcessDataBuffer(blink::DocumentLoader::BodyData*) ./../../third_party/blink/renderer/core/loader/document_loader.cc:1936:5
    #41 0x55b5c8f47eee in blink::DocumentLoader::BodyDataReceivedImpl(blink::DocumentLoader::BodyData&) ./../../third_party/blink/renderer/core/loader/document_loader.cc:1380:3
    #42 0x55b5c8f48369 in non-virtual thunk to blink::DocumentLoader::BodyDataReceived(base::span<char const, 18446744073709551615ul, char const*>) ./../../third_party/blink/renderer/core/loader/document_loader.cc:1326:3
    #43 0x55b5b1f2c549 in blink::NavigationBodyLoader::MainThreadBodyReader::DataReceived(base::span<char const, 18446744073709551615ul, char const*>) ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:346:23
    #44 0x55b5b1f2475f in blink::(anonymous namespace)::ReadFromDataPipeImpl(blink::(anonymous namespace)::BodyReader&, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>&, mojo::SimpleWatcher&) ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:147:17
    #45 0x55b5b1f24063 in blink::NavigationBodyLoader::ReadFromDataPipe() ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:548:3
    #46 0x55b5b1f1f4cb in blink::NavigationBodyLoader::OnReadable(unsigned int) ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:507:3
    #47 0x55b5b1f22540 in blink::NavigationBodyLoader::BindURLLoaderAndStartLoadingResponseBodyIfPossible() ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:605:3
    #48 0x55b5b1f21f8b in blink::NavigationBodyLoader::StartLoadingBody(blink::WebNavigationBodyLoader::Client*) ./../../third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:452:3
    #49 0x55b5c8f5403c in blink::DocumentLoader::StartLoadingResponse() ./../../third_party/blink/renderer/core/loader/document_loader.cc:0:0
    #50 0x55b5c8f64193 in blink::DocumentLoader::CommitNavigation() ./../../third_party/blink/renderer/core/loader/document_loader.cc:3306:3
    #51 0x55b5c8fda4ae in blink::FrameLoader::CommitDocumentLoader(blink::DocumentLoader*, blink::HistoryItem*, blink::CommitReason) ./../../third_party/blink/renderer/core/loader/frame_loader.cc:1498:21
    #52 0x55b5c8fe679f in blink::FrameLoader::CommitNavigation(std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>, std::__Cr::unique_ptr<blink::WebDocumentLoader::ExtraData, std::__Cr::default_delete<blink::WebDocumentLoader::ExtraData>>, blink::CommitReason) ./../../third_party/blink/renderer/core/loader/frame_loader.cc:1310:3
    #53 0x55b5c78efe68 in blink::WebLocalFrameImpl::CommitNavigation(std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>, std::__Cr::unique_ptr<blink::WebDocumentLoader::ExtraData, std::__Cr::default_delete<blink::WebDocumentLoader::ExtraData>>) ./../../third_party/blink/renderer/core/frame/web_local_frame_impl.cc:2841:24
    #54 0x55b5c5dbf72c in content::RenderFrameImpl::CommitNavigationWithParams(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>) ./../../content/renderer/render_frame_impl.cc:3017:11
    #55 0x55b5c5e24dc2 in void base::internal::DecayedFunctorTraits<void (content::RenderFrameImpl::*)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>), base::WeakPtr<content::RenderFrameImpl>&&, mojo::StructPtr<blink::mojom::CommonNavigationParams>&&, mojo::StructPtr<blink::mojom::CommitNavigationParams>&&, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>&&, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>&&, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>&&, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::StructPtr<content::mojom::CookieManagerInfo>&&, mojo::StructPtr<content::mojom::StorageInfo>&&, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>&&>::Invoke<void (content::RenderFrameImpl::*)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>), base::WeakPtr<content::RenderFrameImpl> const&, mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>>(void (content::RenderFrameImpl::*)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>), base::WeakPtr<content::RenderFrameImpl> const&, mojo::StructPtr<blink::mojom::CommonNavigationParams>&&, mojo::StructPtr<blink::mojom::CommitNavigationParams>&&, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>&&, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>&&, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>&&, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::StructPtr<content::mojom::CookieManagerInfo>&&, mojo::StructPtr<content::mojom::StorageInfo>&&, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>&&, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>&&) ./../../base/functional/bind_internal.h:740:12
    #56 0x55b5c5e2487b in base::internal::Invoker<base::internal::FunctorTraits<void (content::RenderFrameImpl::*&&)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>), base::WeakPtr<content::RenderFrameImpl>&&, mojo::StructPtr<blink::mojom::CommonNavigationParams>&&, mojo::StructPtr<blink::mojom::CommitNavigationParams>&&, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>&&, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>&&, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>&&, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingRemote<network::mojom::URLLoaderFactory>&&, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::PendingRemote<blink::mojom::CodeCacheHost>&&, mojo::StructPtr<content::mojom::CookieManagerInfo>&&, mojo::StructPtr<content::mojom::StorageInfo>&&, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>&&>, base::internal::BindState<true, true, false, void (content::RenderFrameImpl::*)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>), base::WeakPtr<content::RenderFrameImpl>, mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState, std::__Cr::default_delete<content::DocumentState>>>, void (std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>)>::RunOnce(base::internal::BindStateBase*, std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>&&) ./../../base/functional/bind_internal.h:956:5
    #57 0x55b5c5dc090b in base::OnceCallback<void (std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>)>::Run(std::__Cr::unique_ptr<blink::WebNavigationParams, std::__Cr::default_delete<blink::WebNavigationParams>>) && ./../../base/functional/callback.h:155:12
    #58 0x55b5c5db9efc in content::RenderFrameImpl::CommitNavigation(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, base::TokenType<blink::DocumentTokenTypeMarker> const&, base::UnguessableToken const&, base::Uuid const&, mojo::StructPtr<blink::mojom::PolicyContainer>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, base::OnceCallback<void (mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>)>) ./../../content/renderer/render_frame_impl.cc:2875:33
    #59 0x55b5c5ea2ec0 in content::NavigationClient::CommitNavigation(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader>>>>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, base::TokenType<blink::DocumentTokenTypeMarker> const&, base::UnguessableToken const&, base::Uuid const&, mojo::StructPtr<blink::mojom::PolicyContainer>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, base::OnceCallback<void (mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>)>) ./../../content/renderer/navigation_client.cc:87:18
    #60 0x55b5a6f2eed9 in content::mojom::NavigationClientStubDispatch::AcceptWithResponder(content::mojom::NavigationClient*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_delete<mojo::MessageReceiverWithStatus>>) ./gen/content/common/navigation_client.mojom.cc:1743:13
    #61 0x55b5ba56da2b in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56
    #62 0x55b5ba58b791 in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #63 0x55b5ba573d83 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #64 0x55b5bd694c23 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ./../../ipc/ipc_mojo_bootstrap.cc:1199:24
    #65 0x55b5bd697091 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
    #66 0x55b5b978fa13 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/functional/callback.h:155:12
    #67 0x55b5b97ff06c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/common/task_annotator.h:112:5
    #68 0x55b5b97fdf0a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #69 0x55b5b964e3c2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:65:55
    #70 0x55b5b9800754 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #71 0x55b5b9709fc0 in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:135:14
    #72 0x55b5c5f938a4 in content::RendererMain(content::MainFunctionParams) ./../../content/renderer/renderer_main.cc:336:16
    #73 0x55b5b612fbb3 in content::RunZygote(content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:665:14
    #74 0x55b5b6130ebb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:772:12
    #75 0x55b5b6133df1 in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner_impl.cc:1164:10
    #76 0x55b5b612d5cb in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ./../../content/app/content_main.cc:356:36
    #77 0x55b5b612dbbc in content::ContentMain(content::ContentMainParams) ./../../content/app/content_main.cc:369:10
    #78 0x55b5a1202029 in ChromeMain ./../../chrome/app/chrome_main.cc:221:12
    #79 0x7f94e7a29f76 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #80 0x7ffe09d31660  (<unknown module>)

0x7c14e5c287c8 is located 40 bytes inside of 96-byte region [0x7c14e5c287a0,0x7c14e5c28800)
freed by thread T0 (chrome) here:
    #0 0x55b5a11c5f1a in __interceptor_free ??:0:0
    #1 0x55b5caf7249d in blink::Vector<blink::Attribute, 4u, blink::PartitionAllocator>::ReallocateBuffer(unsigned int) ./../../third_party/blink/renderer/platform/wtf/allocator/partition_allocator.h:45:50
    #2 0x55b5caf72100 in blink::Vector<blink::Attribute, 4u, blink::PartitionAllocator>::ExpandCapacity(unsigned int, blink::Attribute*) ./../../third_party/blink/renderer/platform/wtf/vector.h:2263:3
    #3 0x55b5caf71dcf in void blink::Vector<blink::Attribute, 4u, blink::PartitionAllocator>::AppendSlowCase<blink::Attribute>(blink::Attribute&&) ./../../third_party/blink/renderer/platform/wtf/vector.h:2386:9
    #4 0x55b5caf279e7 in blink::MutableAttributeCollection::Append(blink::QualifiedName const&, blink::AtomicString const&) ./../../third_party/blink/renderer/platform/wtf/vector.h:2336:3
    #5 0x55b5caf27243 in blink::Element::AppendAttributeInternal(blink::QualifiedName const&, blink::AtomicString const&, blink::Element::AttributeModificationReason) ./../../third_party/blink/renderer/core/dom/element.cc:8082:42
    #6 0x55b5caf63098 in blink::Element::SetAttributeHinted(blink::AtomicString, blink::AtomicStringTable::WeakResult, blink::AtomicString, blink::ExceptionState&) ./../../third_party/blink/renderer/core/dom/element.cc:13411:5
    #7 0x55b5c82bae41 in blink::Element::setAttribute(blink::AtomicString, blink::AtomicString, blink::ExceptionState&) ./../../third_party/blink/renderer/core/dom/element.h:474:5
    #8 0x55b5cbb23fc1 in blink::(anonymous namespace)::v8_element::SetAttributeOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) ./gen/third_party/blink/renderer/bindings/core/v8/v8_element.cc:5185:17
    #9 0x55b5ac23c6d3 in Builtins_CallApiCallbackGeneric ???:0:0
    #10 0x55b5ac23a956 in Builtins_InterpreterEntryTrampoline ???:0:0
    #11 0x55b5ac2376db in Builtins_JSEntryTrampoline ???:0:0
    #12 0x55b5ac23742a in Builtins_JSEntry ???:0:0
    #13 0x55b5a74e0ad7 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) ./../../v8/src/execution/execution.cc:475:22
    #14 0x55b5a74df401 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) ./../../v8/src/execution/execution.cc:565:10
    #15 0x55b5a70ee51d in v8::Function::Call(v8::Isolate*, v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) ./../../v8/src/api/api.cc:5612:27
    #16 0x55b5c610649f in blink::V8ScriptRunner::CallFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) ./../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:851:48
    #17 0x55b5cb888ed6 in blink::bindings::CallbackInvokeHelper<blink::CallbackFunctionBase, (blink::bindings::CallbackInvokeHelperMode)2, (blink::bindings::CallbackReturnTypeIsPromise)0>::Call(int, v8::Local<v8::Value>*) ./../../third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:123:12
    #18 0x55b5cb89bdbe in blink::V8EventHandlerNonNull::InvokeWithoutRunnabilityCheck(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) ./gen/third_party/blink/renderer/bindings/core/v8/v8_event_handler_non_null.cc:193:13
    #19 0x55b5c6f44bf2 in blink::JSEventHandler::InvokeInternal(blink::EventTarget&, blink::Event&, v8::Local<v8::Value>) ./../../third_party/blink/renderer/bindings/core/v8/js_event_handler.cc:134:14
    #20 0x55b5c6e0a1f8 in blink::JSBasedEventListener::Invoke(blink::ExecutionContext*, blink::Event*) ./../../third_party/blink/renderer/bindings/core/v8/js_based_event_listener.cc:189:5
    #21 0x55b5c6df711c in blink::EventTarget::FireEventListeners(blink::Event&, blink::EventTargetData*, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember<blink::RegisteredEventListener, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 1u>) ./../../third_party/blink/renderer/core/dom/events/event_target.cc:1081:15
    #22 0x55b5c6df4e30 in blink::EventTarget::FireEventListeners(blink::Event&) ./../../third_party/blink/renderer/core/dom/events/event_target.cc:982:29
    #23 0x55b5cafb19ac in blink::EventDispatcher::DispatchEventAtBubbling() ./../../third_party/blink/renderer/core/dom/events/event_dispatcher.cc:356:21
    #24 0x55b5cafb0742 in blink::EventDispatcher::Dispatch() ./../../third_party/blink/renderer/core/dom/events/event_dispatcher.cc:266:7
    #25 0x55b5cafaec23 in blink::EventDispatcher::DispatchEvent(blink::Node&, blink::Event&) ./../../third_party/blink/renderer/core/dom/events/event_dispatcher.cc:79:16
    #26 0x55b5c7dd4f55 in blink::HTMLScriptElement::DispatchErrorEvent() ./../../third_party/blink/renderer/core/html/html_script_element.cc:449:3
    #27 0x55b5c9896ef2 in blink::ScriptLoader::AddSpeculationRuleSet(blink::SpeculationRuleSet::Source*) ./../../third_party/blink/renderer/core/script/script_loader.cc:1386:15
    #28 0x55b5cacf854a in blink::Document::UpdateBaseURL() ./../../third_party/blink/renderer/core/dom/document.cc:5022:22
    #29 0x55b5cad3a0a0 in blink::Document::ProcessBaseElement() ./../../third_party/blink/renderer/core/dom/document.cc:5165:5

previously allocated by thread T0 (chrome) here:
    #0 0x55b5a11c64e8 in __interceptor_malloc ??:0:0
    #1 0x55b5b9a18b63 in void* partition_alloc::PartitionRoot::AllocInline<(partition_alloc::internal::AllocFlags)0>(unsigned long, char const*) ./../../base/allocator/partition_allocator/src/partition_alloc/internal/partition_root_internal.h:1318:56
    #2 0x55b5caf95609 in blink::Vector<blink::Attribute, 4u, blink::PartitionAllocator>::Vector<blink::Attribute>(base::span<blink::Attribute const, 18446744073709551615ul, blink::Attribute const*>) ./../../third_party/blink/renderer/platform/wtf/allocator/partition_allocator.h:42:9
    #3 0x55b5caf95243 in blink::UniqueElementData::UniqueElementData(blink::ShareableElementData const&) ./../../third_party/blink/renderer/core/dom/element_data.cc:179:33
    #4 0x55b5caf920e8 in blink::ElementData::MakeUniqueCopy() const ./../../v8/include/cppgc/allocation.h:239:32
    #5 0x55b5caf50a9a in blink::Element::CreateUniqueElementData() ./../../third_party/blink/renderer/core/dom/element.cc:12026:56
    #6 0x55b5caf5fe6d in blink::Element::SetAttributeWithoutValidation(blink::QualifiedName const&, blink::AtomicString const&) ./../../third_party/blink/renderer/core/dom/element.h:2821:5
    #7 0x55b5cbbf48c9 in blink::(anonymous namespace)::v8_html_base_element::HrefAttributeSetCallback(v8::FunctionCallbackInfo<v8::Value> const&) ./gen/third_party/blink/renderer/bindings/core/v8/v8_html_base_element.cc:117:17
    #8 0x55b5a71c8c90 in v8::internal::FunctionCallbackArguments::CallOrConstruct(v8::internal::Isolate*, v8::internal::Tagged<v8::internal::FunctionTemplateInfo>, bool) ./../../v8/src/api/api-arguments-inl.h:176:3
    #9 0x55b5a71c7c61 in v8::internal::Builtins::InvokeApiFunction(v8::internal::Isolate*, bool, v8::internal::DirectHandle<v8::internal::FunctionTemplateInfo>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>, v8::internal::DirectHandle<v8::internal::HeapObject>) ./../../v8/src/builtins/builtins-api.cc:120:27
    #10 0x55b5a82db320 in v8::internal::Object::SetPropertyWithAccessor(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>) ./../../v8/src/objects/objects.cc:1696:9
    #11 0x55b5a82e1521 in v8::internal::Object::SetPropertyInternal(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>, v8::internal::StoreOrigin, bool*) ./../../v8/src/objects/objects.cc:2473:16
    #12 0x55b5a82d5ce6 in v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) ./../../v8/src/objects/objects.cc:2567:9
    #13 0x55b5a7ae3b94 in v8::internal::StoreIC::Store(v8::internal::Handle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::Handle<v8::internal::Name>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin) ./../../v8/src/ic/ic.cc:2266:23
    #14 0x55b5a7af2eb1 in v8::internal::Runtime_StoreIC_Miss(int, unsigned long*, v8::internal::Isolate*) ./../../v8/src/ic/ic.cc:3392:40
    #15 0x55b5ac2ec4f5 in Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit ???:0:0
    #16 0x55b5ac3f592c in Builtins_SetNamedPropertyHandler ???:0:0
    #17 0x55b5ac23a956 in Builtins_InterpreterEntryTrampoline ???:0:0
    #18 0x55b5ac2376db in Builtins_JSEntryTrampoline ???:0:0
    #19 0x55b5ac23742a in Builtins_JSEntry ???:0:0
    #20 0x55b5a74e0ad7 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) ./../../v8/src/execution/execution.cc:475:22
    #21 0x55b5a74e3482 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) ./../../v8/src/execution/execution.cc:575:10
    #22 0x55b5a70baa03 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) ./../../v8/src/api/api.cc:2040:7
    #23 0x55b5c610119d in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local<v8::Script>, v8::Local<v8::Data>, blink::ExecutionContext*) ./../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:509:22
    #24 0x55b5c6102b36 in blink::V8ScriptRunner::CompileAndRunScript(blink::ScriptState*, blink::ClassicScript*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:633:22
    #25 0x55b5c9829c92 in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/core/script/classic_script.cc:227:10
    #26 0x55b5c988dac7 in blink::Script::RunScriptOnScriptState(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/core/script/script.cc:35:17
    #27 0x55b5c988defb in blink::Script::RunScript(blink::LocalDOMWindow*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) ./../../third_party/blink/renderer/core/script/script.cc:42:3
    #28 0x55b5c98b9f46 in blink::PendingScript::ExecuteScriptBlockInternal(blink::Script*, blink::ScriptElementBase*, bool, bool, bool, base::TimeTicks, bool) ./../../third_party/blink/renderer/core/script/pending_script.cc:312:13
    #29 0x55b5c98b8eb6 in blink::PendingScript::ExecuteScriptBlock() ./../../third_party/blink/renderer/core/script/pending_script.cc:209:3

SUMMARY: AddressSanitizer: heap-use-after-free (/usr/local/google/home/.../chrome_binaries/chromium-150/chrome+0x3abeda71) (BuildId: 68bdd2847ffc22f9)
Shadow bytes around the buggy address:
  0x7c14e5c28500: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c14e5c28580: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c14e5c28600: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c14e5c28680: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c14e5c28700: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
=>0x7c14e5c28780: fa fa f7 fa fd fd fd fd fd[fd]fd fd fd fd fd fd
  0x7c14e5c28800: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c14e5c28880: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c14e5c28900: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c14e5c28980: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c14e5c28a00: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==1829564==ADDITIONAL INFO

==1829564==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55b5bd68e221 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ./../../ipc/ipc_mojo_bootstrap.cc:1138:13


Command line: `/proc/self/exe --type=renderer --gpu-client-id=7
--crashpad-handler-pid=1829425 --enable-crash-reporter=,custom
--change-stack-guard-on-fork=enable --no-sandbox
--file-url-path-alias=/gen=/usr/local/google/home/.../chrome_binaries/chromium-150/gen --ozone-platform=x11 --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1778554098266969 --gpu-channel-request-start-time-ticks=768184194653 --launch-time-ticks=768184199280 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,5819785427807398892,7809676138190433811,2097152 --field-trial-handle=3,i,17126461325981705527,9363848287792768379,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,17883375934956335102,1995345605637795569,4 --trace-process-track-uuid=3190708992871164437`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==1829564==END OF ADDITIONAL INFO