[2696280:2696280:0423/191434.438280:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[2696280:2696280:0423/191434.438611:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[2696280:2696280:0423/191434.438716:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[2696280:2696280:0423/191434.449123:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:123] Should skip nVidia device named: nvidia-drm
[2696280:2696280:0423/191434.450625:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process.
[2695722:2695722:0423/191434.576343:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured.
[2696449:2696449:0423/191434.604162:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[2696449:2696449:0423/191434.604421:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[2696449:2696449:0423/191434.604509:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[2696298:2696298:0423/191434.654490:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[2696298:2696298:0423/191434.654605:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[2696298:2696298:0423/191434.654627:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[2696959:2696959:0423/191434.914892:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[2696959:2696959:0423/191434.915129:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[2696959:2696959:0423/191434.915214:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[2696985:2696985:0423/191434.924941:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[2696985:2696985:0423/191434.925175:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[2696985:2696985:0423/191434.925242:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[2695722:2695722:0423/191435.213748:INFO:CONSOLE:14] "[poc] navigator.storage.getDirectory()...", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.223237:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used.
[2695722:2695722:0423/191435.292543:INFO:CONSOLE:14] "[poc] OPFS root acquired", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.292669:INFO:CONSOLE:14] "[poc] getFileHandle(target, create)...", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.300101:INFO:CONSOLE:14] "[poc] target file handle acquired", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.300263:INFO:CONSOLE:14] "[poc] new FileSystemObserver + observe(root)...", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.305465:INFO:CONSOLE:14] "[poc] observer registered", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.305697:INFO:CONSOLE:14] "[poc] starting 40 infinite 4MB write chains", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.308083:INFO:CONSOLE:14] "[poc] 40 write chains running on file_task_runner", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.361154:INFO:CONSOLE:14] "[poc] waiting 3 seconds to let DidWrite callbacks accumulate on", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.361325:INFO:CONSOLE:14] "[poc] file_task_runner, then calling window.close() to trigger", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.361421:INFO:CONSOLE:14] "[poc] the last-incognito-window close path, which runs", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.361522:INFO:CONSOLE:14] "[poc] ProfileDestroyer -> StoragePartition teardown ->", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.361604:INFO:CONSOLE:14] "[poc] ~FileSystemAccessBucketPathWatcher on UI while Unretained", source: http://localhost:18852/poc.html (14)
[2695722:2695722:0423/191435.361691:INFO:CONSOLE:14] "[poc] (watcher) callbacks are still queued and undrained.", source: http://localhost:18852/poc.html (14)
[2699884:2699884:0423/191437.960961:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[2699884:2699884:0423/191437.961186:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[2699884:2699884:0423/191437.961282:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[2695722:2695722:0423/191441.311724:INFO:CONSOLE:14] "[poc] calling window.close() now", source: http://localhost:18852/poc.html (14)
[2703497:2703497:0423/191441.384036:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[2703497:2703497:0423/191441.384575:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[2703497:2703497:0423/191441.384636:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
=================================================================
==2695722==ERROR: MiraclePtr: dangling-pointer-instantiation on address 0x726e8adef3e0 at pc 0x5e47d9a190ec bp 0x70ee75cc4340 sp 0x70ee71d0d8a0
=================================================================
==2695722==ERROR: AddressSanitizer: heap-use-after-free on address 0x726e8adef3e0 at pc 0x5e47cd8cfd0a bp 0x7ffede3723f0 sp 0x7ffede3723e8
READ of size 8 at 0x726e8adef3e0 thread T0 (chrome)
    #0 0x5e47c17d9e41 in __sanitizer_print_stack_trace (/home/ab/code/chromium/src/out/asan_nodcheck/chrome+0x10fb1e41) (BuildId: 8c82855b9da9bf86)
    #1 0x5e47d9a19035 in base::(anonymous namespace)::Log(base::(anonymous namespace)::MessageLevel, unsigned long, char const*, char const*) base/memory/raw_ptr_asan_service.cc:829:3
    #2 0x5e47d9a190eb in base::RawPtrAsanService::CrashOnDanglingInstantiation(void const volatile*) const base/memory/raw_ptr_asan_service.cc:853:3
    #3 0x5e47cd8ce636 in void storage::TaskRunnerBoundObserverList<storage::FileChangeObserver>::Notify<void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), storage::FileSystemURL const&>(void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), storage::FileSystemURL const&) const base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr_hookable_impl.h:60:9
    #4 0x5e47dff4f2f8 in storage::ObfuscatedFileUtil::DeleteFile(storage::FileSystemOperationContext*, storage::FileSystemURL const&) storage/browser/file_system/obfuscated_file_util.cc:814:32
    #5 0x5e47dff1090a in base::internal::Invoker<base::internal::FunctorTraits<base::File::Error (storage::FileSystemFileUtil::*&&)(storage::FileSystemOperationContext*, storage::FileSystemURL const&), storage::FileSystemFileUtil*, storage::FileSystemOperationContext*, storage::FileSystemURL&&>, base::internal::BindState<true, true, false, base::File::Error (storage::FileSystemFileUtil::*)(storage::FileSystemOperationContext*, storage::FileSystemURL const&), base::internal::UnretainedWrapper<storage::FileSystemFileUtil, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::OwnedWrapper<storage::FileSystemOperationContext, std::__Cr::default_delete<storage::FileSystemOperationContext>>, storage::FileSystemURL>, base::File::Error ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #6 0x5e47dfe88804 in void base::internal::ReturnAsParamAdapter<std::__Cr::tuple<base::File::Error>, base::File::Error>(base::OnceCallback<base::File::Error ()>, std::__Cr::unique_ptr<std::__Cr::tuple<base::File::Error>, std::__Cr::default_delete<std::__Cr::tuple<base::File::Error>>>*) base/functional/callback.h:155:12
    #7 0x5e47dfe88e0c in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::OnceCallback<base::File::Error ()>, std::__Cr::unique_ptr<std::__Cr::tuple<base::File::Error>, std::__Cr::default_delete<std::__Cr::tuple<base::File::Error>>>*), base::OnceCallback<base::File::Error ()>&&, std::__Cr::unique_ptr<std::__Cr::tuple<base::File::Error>, std::__Cr::default_delete<std::__Cr::tuple<base::File::Error>>>*&&>, base::internal::BindState<false, true, false, void (*)(base::OnceCallback<base::File::Error ()>, std::__Cr::unique_ptr<std::__Cr::tuple<base::File::Error>, std::__Cr::default_delete<std::__Cr::tuple<base::File::Error>>>*), base::OnceCallback<base::File::Error ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::tuple<base::File::Error>, std::__Cr::default_delete<std::__Cr::tuple<base::File::Error>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #8 0x5e47d9924c9b in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(base::internal::PostTaskAndReplyRelay) base/functional/callback.h:155:12
    #9 0x5e47d99251ee in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #10 0x5e47d9898d83 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #11 0x5e47d99323d2 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5
    #12 0x5e47d993261c in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:675:3
    #13 0x5e47d9930c09 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:705:7
    #14 0x5e47d992fe92 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5
    #15 0x5e47d9974dc3 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36
    #16 0x5e47d9973f04 in base::internal::WorkerThread::RunPooledWorker() base/task/thread_pool/worker_thread.cc:359:3
    #17 0x5e47d997396b in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:339:7
    #18 0x5e47d99fdc6e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #19 0x5e47c17cbf16 in asan_thread_start(void*) asan_interceptors.cpp

    #0 0x5e47cd8cfd09 in base::internal::Invoker<base::internal::FunctorTraits<void (storage::FileChangeObserver::*&&)(storage::FileSystemURL const&), storage::FileChangeObserver*, storage::FileSystemURL&&>, base::internal::BindState<true, true, false, void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), base::internal::UnretainedWrapper<storage::FileChangeObserver, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, storage::FileSystemURL>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #1 0x5e47d9898d83 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #2 0x5e47d990a5dc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #3 0x5e47d990947a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #4 0x5e47d9ab92a8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #5 0x5e47d9abc868 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #6 0x74ee8df60584  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d584) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #7 0x74ee8dfbf976  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xbc976) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #8 0x74ee8df5fa22 in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ca22) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #9 0x5e47d9ab98c3 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:770:30
    #10 0x5e47d990bcc4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #11 0x5e47d9812c90 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #12 0x5e47cd1862ac in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18
    #13 0x5e47cd18e97c in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15
    #14 0x5e47cd17d02c in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28
    #15 0x5e47d5bf1c4f in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10
    #16 0x5e47d5bf5ea8 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1332:10
    #17 0x5e47d5bf533a in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12
    #18 0x5e47d5beea5e in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #19 0x5e47d5bef05c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #20 0x5e47c18092a9 in ChromeMain chrome/app/chrome_main.cc:194:12
    #21 0x74ee8ca2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #22 0x74ee8ca2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #23 0x5e47c172e029 in _start (/home/ab/code/chromium/src/out/asan_nodcheck/chrome+0x10f06029) (BuildId: 8c82855b9da9bf86)

0x726e8adef3e0 is located 864 bytes inside of 888-byte region [0x726e8adef080,0x726e8adef3f8)
freed by thread T0 (chrome) here:
    #0 0x5e47c1807ddd in operator delete(void*) (/home/ab/code/chromium/src/out/asan_nodcheck/chrome+0x10fdfddd) (BuildId: 8c82855b9da9bf86)
    #1 0x5e47cd96bb17 in content::FileSystemAccessWatcherManager::~FileSystemAccessWatcherManager() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5e47cd90036a in content::FileSystemAccessManagerImpl::~FileSystemAccessManagerImpl() content/browser/file_system_access/file_system_access_manager_impl.cc:459:1
    #3 0x5e47cd900d43 in content::FileSystemAccessManagerImpl::~FileSystemAccessManagerImpl() content/browser/file_system_access/file_system_access_manager_impl.cc:457:61
    #4 0x5e47cd92e48a in void content::BrowserThread::DeleteOnThread<(content::BrowserThread::ID)0>::Destruct<content::FileSystemAccessEntryFactory>(content::FileSystemAccessEntryFactory const*) content/public/browser/browser_thread.h:145:9
    #5 0x5e47ceefd68c in content::StoragePartitionImpl::~StoragePartitionImpl() base/memory/ref_counted.h:427:7
    #6 0x5e47ceeff023 in content::StoragePartitionImpl::~StoragePartitionImpl() content/browser/storage_partition_impl.cc:1153:47
    #7 0x5e47cef7594b in void std::__Cr::__destroy_at<std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>>(std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #8 0x5e47cef7588b in std::__Cr::__tree<std::__Cr::__value_type<content::StoragePartitionConfig, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>, std::__Cr::__map_value_compare<content::StoragePartitionConfig, std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>, std::__Cr::less<content::StoragePartitionConfig>>, std::__Cr::allocator<std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>>>::__tree_deleter::operator()(std::__Cr::__tree_node<std::__Cr::__value_type<content::StoragePartitionConfig, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>, void*>*) gen/third_party/libc++/src/include/__memory/allocator_traits.h:313:5
    #9 0x5e47cef6e93e in content::StoragePartitionImplMap::~StoragePartitionImplMap() gen/third_party/libc++/src/include/__tree:1361:64
    #10 0x5e47cd0cb342 in content::BrowserContextImpl::ShutdownStoragePartitions() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #11 0x5e47d948c521 in OffTheRecordProfileImpl::~OffTheRecordProfileImpl() chrome/browser/profiles/off_the_record_profile_impl.cc:278:3
    #12 0x5e47d948c8d3 in OffTheRecordProfileImpl::~OffTheRecordProfileImpl() chrome/browser/profiles/off_the_record_profile_impl.cc:252:53
    #13 0x5e47d948a345 in std::__Cr::__tree<std::__Cr::__value_type<Profile::OTRProfileID, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, std::__Cr::__map_value_compare<Profile::OTRProfileID, std::__Cr::pair<Profile::OTRProfileID const, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, std::__Cr::less<Profile::OTRProfileID>>, std::__Cr::allocator<std::__Cr::pair<Profile::OTRProfileID const, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>>>::erase(std::__Cr::__tree_const_iterator<std::__Cr::__value_type<Profile::OTRProfileID, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, std::__Cr::__tree_node<std::__Cr::__value_type<Profile::OTRProfileID, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, void*>*, long>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #14 0x5e47d94846cd in ProfileImpl::DestroyOffTheRecordProfile(Profile*) gen/third_party/libc++/src/include/__tree:2077:3
    #15 0x5e47d79d59cd in ProfileDestroyer::DestroyOffTheRecordProfileNow(Profile*) chrome/browser/profiles/profile_destroyer.cc:251:34
    #16 0x5e47d79d4170 in ProfileDestroyer::Start(std::__Cr::set<content::RenderProcessHost*, std::__Cr::less<content::RenderProcessHost*>, std::__Cr::allocator<content::RenderProcessHost*>> const&) chrome/browser/profiles/profile_destroyer.cc:452:3
    #17 0x5e47d79d4981 in ProfileDestroyer::DestroyOTRProfileWhenAppropriateWithTimeout(Profile*, base::TimeDelta) chrome/browser/profiles/profile_destroyer.cc:221:22
    #18 0x5e47f24c26c4 in BrowserManagerService::DeleteBrowser(Browser*) chrome/browser/ui/browser_manager_service.cc:129:5
    #19 0x5e47f24522b0 in base::internal::Invoker<base::internal::FunctorTraits<void (Browser::*&&)(), base::WeakPtr<Browser>&&>, base::internal::BindState<true, true, false, void (Browser::*)(), base::WeakPtr<Browser>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #20 0x5e47d9898d83 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #21 0x5e47d990a5dc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #22 0x5e47d990947a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #23 0x5e47d9ab92a8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #24 0x5e47d9abc868 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #25 0x74ee8df60584  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d584) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #26 0x74ee8dfbf976  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xbc976) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #27 0x74ee8df5fa22 in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ca22) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #28 0x5e47d9ab98c3 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:770:30
    #29 0x5e47d990bcc4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12

previously allocated by thread T0 (chrome) here:
    #0 0x5e47c180759d in operator new(unsigned long) (/home/ab/code/chromium/src/out/asan_nodcheck/chrome+0x10fdf59d) (BuildId: 8c82855b9da9bf86)
    #1 0x5e47cd96b014 in content::FileSystemAccessWatcherManager::FileSystemAccessWatcherManager(content::FileSystemAccessManagerImpl*, base::PassKey<content::FileSystemAccessManagerImpl>) content/browser/file_system_access/file_system_access_bucket_path_watcher.h:27:3
    #2 0x5e47cd8ff6de in content::FileSystemAccessManagerImpl::FileSystemAccessManagerImpl(scoped_refptr<storage::FileSystemContext>, scoped_refptr<content::ChromeBlobStorageContext>, content::FileSystemAccessPermissionContext*, bool) content/browser/file_system_access/file_system_access_manager_impl.cc:450:7
    #3 0x5e47cef07cdf in scoped_refptr<content::FileSystemAccessManagerImpl> base::MakeRefCounted<content::FileSystemAccessManagerImpl, scoped_refptr<storage::FileSystemContext>&, scoped_refptr<content::ChromeBlobStorageContext>&, content::FileSystemAccessPermissionContext*, bool>(scoped_refptr<storage::FileSystemContext>&, scoped_refptr<content::ChromeBlobStorageContext>&, content::FileSystemAccessPermissionContext*&&, bool&&) base/memory/scoped_refptr.h:151:16
    #4 0x5e47cef02a35 in content::StoragePartitionImpl::Initialize(content::StoragePartitionImpl*) content/browser/storage_partition_impl.cc:1369:7
    #5 0x5e47cef6f029 in content::StoragePartitionImplMap::Get(content::StoragePartitionConfig const&, bool) content/browser/storage_partition_impl_map.cc:355:14
    #6 0x5e47cd0c2c5e in content::BrowserContext::GetDefaultStoragePartition() content/browser/browser_context.cc:151:52
    #7 0x5e47d788f2b5 in OptimizationGuideKeyedService::InitializeModelExecution(Profile*) chrome/browser/optimization_guide/optimization_guide_keyed_service.cc:366:38
    #8 0x5e47d788d7e5 in OptimizationGuideKeyedService::Initialize() chrome/browser/optimization_guide/optimization_guide_keyed_service.cc:345:3
    #9 0x5e47d7895257 in OptimizationGuideKeyedServiceFactory::BuildServiceInstanceForBrowserContext(content::BrowserContext*) const gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #10 0x5e47de93e215 in KeyedServiceTemplatedFactory<KeyedService>::GetServiceForContext(void*, bool) components/keyed_service/core/keyed_service_templated_factory.cc:149:22
    #11 0x5e47de92fc20 in DependencyManager::CreateContextServices(void*, bool) components/keyed_service/core/dependency_manager.cc:125:16
    #12 0x5e47dfda21d4 in BrowserContextDependencyManager::DoCreateBrowserContextServices(content::BrowserContext*, bool) components/keyed_service/content/browser_context_dependency_manager.cc:36:22
    #13 0x5e47d948b8b8 in OffTheRecordProfileImpl::Init() chrome/browser/profiles/off_the_record_profile_impl.cc:194:51
    #14 0x5e47d948df58 in Profile::CreateOffTheRecordProfile(Profile*, Profile::OTRProfileID const&) chrome/browser/profiles/off_the_record_profile_impl.cc:637:12
    #15 0x5e47d948404b in ProfileImpl::GetOffTheRecordProfile(Profile::OTRProfileID const&, bool) chrome/browser/profiles/profile_impl.cc:1015:7
    #16 0x5e47c2eb05f6 in Profile::GetPrimaryOTRProfile(bool) chrome/browser/profiles/profile.cc:547:10
    #17 0x5e47d5bcb5db in (anonymous namespace)::GetPrivateProfileIfRequested(base::CommandLine const&, StartupProfileInfo) chrome/browser/ui/startup/startup_browser_creator.cc:303:21
    #18 0x5e47d5bc95e4 in StartupBrowserCreator::ProcessCmdLineImpl(base::CommandLine const&, base::FilePath const&, chrome::startup::IsProcessStartup, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&) chrome/browser/ui/startup/startup_browser_creator.cc:615:7
    #19 0x5e47d5bc8e5e in StartupBrowserCreator::Start(base::CommandLine const&, base::FilePath const&, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&) chrome/browser/ui/startup/startup_browser_creator.cc:682:10
    #20 0x5e47d9389262 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:2064:25
    #21 0x5e47d93878dc in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1463:18
    #22 0x5e47cd183a8c in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1003:28
    #23 0x5e47cd18ac71 in base::internal::Invoker<base::internal::FunctorTraits<int (content::BrowserMainLoop::*&&)(), content::BrowserMainLoop*>, base::internal::BindState<true, true, false, int (content::BrowserMainLoop::*)(), base::internal::UnretainedWrapper<content::BrowserMainLoop, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #24 0x5e47ceef2e8d in content::StartupTaskRunner::RunAllTasksNow(bool) base/functional/callback.h:155:12
    #25 0x5e47cd1828c5 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:909:25
    #26 0x5e47cd18e07f in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams) content/browser/browser_main_runner_impl.cc:138:15
    #27 0x5e47cd17cf8a in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:28:32
    #28 0x5e47d5bf1c4f in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10
    #29 0x5e47d5bf5ea8 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1332:10

SUMMARY: AddressSanitizer: heap-use-after-free base/functional/bind_internal.h:740:12 in base::internal::Invoker<base::internal::FunctorTraits<void (storage::FileChangeObserver::*&&)(storage::FileSystemURL const&), storage::FileChangeObserver*, storage::FileSystemURL&&>, base::internal::BindState<true, true, false, void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), base::internal::UnretainedWrapper<storage::FileChangeObserver, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, storage::FileSystemURL>, void ()>::RunOnce(base::internal::BindStateBase*)
Shadow bytes around the buggy address:
  0x726e8adef100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x726e8adef180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x726e8adef200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x726e8adef280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x726e8adef300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x726e8adef380: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fa
  0x726e8adef400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x726e8adef480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x726e8adef500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x726e8adef580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x726e8adef600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2695722==ADDITIONAL INFO

==2695722==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5e47cd8ce601 in void storage::TaskRunnerBoundObserverList<storage::FileChangeObserver>::Notify<void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), storage::FileSystemURL const&>(void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), storage::FileSystemURL const&) const storage/browser/file_system/task_runner_bound_observer_list.h:74:11
    #1 0x5e47dff0ba66 in storage::AsyncFileUtilAdapter::DeleteFile(std::__Cr::unique_ptr<storage::FileSystemOperationContext, std::__Cr::default_delete<storage::FileSystemOperationContext>>, storage::FileSystemURL const&, base::OnceCallback<void (base::File::Error)>) storage/browser/file_system/async_file_util_adapter.cc:323:7
    #2 0x5e47cd8d0d5a in content::FileSystemAccessFileWriterImpl::~FileSystemAccessFileWriterImpl() content/browser/file_system_access/file_system_access_file_writer_impl.cc:63:9
    #3 0x5e47f24328c9 in Browser::OnWindowClosing() chrome/browser/ui/browser.cc:1346:9


Command line: `/home/ab/code/chromium/src/out/asan_nodcheck/chrome --no-sandbox --headless=new --disable-gpu --disable-crashpad-for-testing --disable-breakpad --disable-crash-reporter --disable-in-process-stack-traces --disable-dev-shm-usage --enable-logging=stderr --v=0 --user-data-dir=/tmp/chrome-bug-a-current.SoBOQK --incognito --enable-blink-features=FileSystemObserver --no-first-run --no-default-browser-check --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl --flag-switches-begin --flag-switches-end http://localhost:18852/poc.html`


MiraclePtr Status: PROTECTED
This crash occurred inside a callback where a raw_ptr<T> pointing to the same region was bound to one of the arguments.
MiraclePtr is expected to make this crash non-exploitable once fully enabled.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==2695722==END OF ADDITIONAL INFO

==2695722==ABORTING