[3873895:3874658:0422/044541.761222:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[3873895:3874658:0422/044541.821740:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[3874777:3874777:0422/044541.826361:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[3874777:3874777:0422/044541.845776:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[3874777:3874777:0422/044541.846000:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[3874777:3874777:0422/044541.945595:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:123] Should skip nVidia device named: nvidia-drm
[3874777:3874777:0422/044541.947581:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process.
[3873895:3873895:0422/044542.029569:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured.
[3873895:3874658:0422/044542.053736:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[3874894:3874894:0422/044542.077098:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[3874894:3874894:0422/044542.077452:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[3874894:3874894:0422/044542.077561:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[3874781:3874781:0422/044542.153828:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[3874781:3874781:0422/044542.153950:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[3874781:3874781:0422/044542.153970:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[3873895:3874658:0422/044542.304680:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[3875201:3875201:0422/044542.696548:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[3875201:3875201:0422/044542.699740:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[3875201:3875201:0422/044542.699863:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[3875215:3875215:0422/044542.838595:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[3875215:3875215:0422/044542.839241:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[3875215:3875215:0422/044542.839407:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[3873895:3873895:0422/044543.608854:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3873895:3874658:0422/044543.609273:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[3873895:3873895:0422/044543.611108:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3873895:3873895:0422/044543.671830:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3873895:3873895:0422/044543.731224:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3873895:3874658:0422/044543.731693:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[3873895:3873895:0422/044543.800394:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3873895:3873895:0422/044543.840046:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3873895:3874658:0422/044543.840464:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[3873895:3873895:0422/044544.269732:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3873895:3874658:0422/044544.274628:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[3873895:3873895:0422/044544.891289:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3873895:3874658:0422/044544.898596:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[3873895:3873895:0422/044544.987008:INFO:CONSOLE:14] "[poc] navigator.storage.getDirectory()...", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.078185:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3873895:3873895:0422/044545.078305:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used.
[3873895:3873895:0422/044545.496595:INFO:CONSOLE:14] "[poc] OPFS root acquired", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.496816:INFO:CONSOLE:14] "[poc] getFileHandle(target, create)...", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.520779:INFO:CONSOLE:14] "[poc] target file handle acquired", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.521004:INFO:CONSOLE:14] "[poc] new FileSystemObserver + observe(root)...", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.549902:INFO:CONSOLE:14] "[poc] observer registered", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.558653:INFO:CONSOLE:14] "[poc] starting 40 infinite 4MB write chains", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.851189:INFO:CONSOLE:14] "[poc] 40 write chains running on file_task_runner", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.860785:INFO:CONSOLE:14] "[poc] waiting 3 seconds to let DidWrite callbacks accumulate on", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.860984:INFO:CONSOLE:14] "[poc] file_task_runner, then calling window.close() to trigger", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.861096:INFO:CONSOLE:14] "[poc] the last-incognito-window close path, which runs", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.861183:INFO:CONSOLE:14] "[poc] ProfileDestroyer -> StoragePartition teardown ->", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.863180:INFO:CONSOLE:14] "[poc] ~FileSystemAccessBucketPathWatcher on UI while Unretained", source: http://127.0.0.1:8765/poc.html (14)
[3873895:3873895:0422/044545.863329:INFO:CONSOLE:14] "[poc] (watcher) callbacks are still queued and undrained.", source: http://127.0.0.1:8765/poc.html (14)
[3879859:3879859:0422/044549.521131:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[3879859:3879859:0422/044549.521624:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[3879859:3879859:0422/044549.524659:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[3873895:3874658:0422/044550.370249:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR
[3873895:3874658:0422/044550.380033:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR
[3873895:3874658:0422/044550.388209:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR
[3873895:3873895:0422/044551.734919:INFO:CONSOLE:14] "[poc] calling window.close() now", source: http://127.0.0.1:8765/poc.html (14)
[3881893:3881893:0422/044552.150129:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[3881893:3881893:0422/044552.151363:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[3881893:3881893:0422/044552.151615:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
=================================================================
==3873895==ERROR: AddressSanitizer: heap-use-after-free on address 0x71cd714607e0 at pc 0x5ff91b4bbd9a bp 0x7ffd89ce8f10 sp 0x7ffd89ce8f08
READ of size 8 at 0x71cd714607e0 thread T0 (chrome)
    #0 0x5ff91b4bbd99 in base::internal::Invoker<base::internal::FunctorTraits<void (storage::FileChangeObserver::*&&)(storage::FileSystemURL const&), storage::FileChangeObserver*, storage::FileSystemURL&&>, base::internal::BindState<true, true, false, void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), base::internal::UnretainedWrapper<storage::FileChangeObserver, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, storage::FileSystemURL>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #1 0x5ff92740adf3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #2 0x5ff92747befc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #3 0x5ff92747ad9a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #4 0x5ff92762aad8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #5 0x5ff92762e098 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #6 0x744d74535584  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d584) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #7 0x744d74594976  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xbc976) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #8 0x744d74534a22 in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ca22) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #9 0x5ff92762b0f3 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:770:30
    #10 0x5ff92747d5e4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #11 0x5ff927385160 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #12 0x5ff91ad755fc in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18
    #13 0x5ff91ad7dccc in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15
    #14 0x5ff91ad6c37c in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28
    #15 0x5ff9236e7e7f in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10
    #16 0x5ff9236ec0d8 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1332:10
    #17 0x5ff9236eb56a in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12
    #18 0x5ff9236e4c8e in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:357:36
    #19 0x5ff9236e528c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:370:10
    #20 0x5ff90f1562a9 in ChromeMain chrome/app/chrome_main.cc:194:12
    #21 0x744d7302a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #22 0x744d7302a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #23 0x5ff90f07b029 in _start (/home/ab/code/chromium/src/out/asan_nodcheck/chrome+0x10f9e029) (BuildId: c6f0a69f85268525)

0x71cd714607e0 is located 864 bytes inside of 888-byte region [0x71cd71460480,0x71cd714607f8)
freed by thread T0 (chrome) here:
    #0 0x5ff90f154ddd in operator delete(void*) (/home/ab/code/chromium/src/out/asan_nodcheck/chrome+0x11077ddd) (BuildId: c6f0a69f85268525)
    #1 0x5ff91b557987 in content::FileSystemAccessWatcherManager::~FileSystemAccessWatcherManager() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5ff91b4ec3fa in content::FileSystemAccessManagerImpl::~FileSystemAccessManagerImpl() content/browser/file_system_access/file_system_access_manager_impl.cc:459:1
    #3 0x5ff91b4ecdd3 in content::FileSystemAccessManagerImpl::~FileSystemAccessManagerImpl() content/browser/file_system_access/file_system_access_manager_impl.cc:457:61
    #4 0x5ff91b51a51a in void content::BrowserThread::DeleteOnThread<(content::BrowserThread::ID)0>::Destruct<content::FileSystemAccessEntryFactory>(content::FileSystemAccessEntryFactory const*) content/public/browser/browser_thread.h:145:9
    #5 0x5ff91cad6b7c in content::StoragePartitionImpl::~StoragePartitionImpl() base/memory/ref_counted.h:427:7
    #6 0x5ff91cad8513 in content::StoragePartitionImpl::~StoragePartitionImpl() content/browser/storage_partition_impl.cc:1153:47
    #7 0x5ff91cb4edcb in void std::__Cr::__destroy_at<std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>>(std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #8 0x5ff91cb4ed0b in std::__Cr::__tree<std::__Cr::__value_type<content::StoragePartitionConfig, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>, std::__Cr::__map_value_compare<content::StoragePartitionConfig, std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>, std::__Cr::less<content::StoragePartitionConfig>>, std::__Cr::allocator<std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>>>::__tree_deleter::operator()(std::__Cr::__tree_node<std::__Cr::__value_type<content::StoragePartitionConfig, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>, void*>*) gen/third_party/libc++/src/include/__memory/allocator_traits.h:313:5
    #9 0x5ff91cb47dbe in content::StoragePartitionImplMap::~StoragePartitionImplMap() gen/third_party/libc++/src/include/__tree:1361:64
    #10 0x5ff91acba692 in content::BrowserContextImpl::ShutdownStoragePartitions() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #11 0x5ff926fa9a71 in OffTheRecordProfileImpl::~OffTheRecordProfileImpl() chrome/browser/profiles/off_the_record_profile_impl.cc:278:3
    #12 0x5ff926fa9e23 in OffTheRecordProfileImpl::~OffTheRecordProfileImpl() chrome/browser/profiles/off_the_record_profile_impl.cc:252:53
    #13 0x5ff926fa7895 in std::__Cr::__tree<std::__Cr::__value_type<Profile::OTRProfileID, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, std::__Cr::__map_value_compare<Profile::OTRProfileID, std::__Cr::pair<Profile::OTRProfileID const, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, std::__Cr::less<Profile::OTRProfileID>>, std::__Cr::allocator<std::__Cr::pair<Profile::OTRProfileID const, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>>>::erase(std::__Cr::__tree_const_iterator<std::__Cr::__value_type<Profile::OTRProfileID, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, std::__Cr::__tree_node<std::__Cr::__value_type<Profile::OTRProfileID, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, void*>*, long>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #14 0x5ff926fa1bcd in ProfileImpl::DestroyOffTheRecordProfile(Profile*) gen/third_party/libc++/src/include/__tree:2077:3
    #15 0x5ff9254fc42d in ProfileDestroyer::DestroyOffTheRecordProfileNow(Profile*) chrome/browser/profiles/profile_destroyer.cc:251:34
    #16 0x5ff9254fabd0 in ProfileDestroyer::Start(std::__Cr::set<content::RenderProcessHost*, std::__Cr::less<content::RenderProcessHost*>, std::__Cr::allocator<content::RenderProcessHost*>> const&) chrome/browser/profiles/profile_destroyer.cc:452:3
    #17 0x5ff9254fb3e1 in ProfileDestroyer::DestroyOTRProfileWhenAppropriateWithTimeout(Profile*, base::TimeDelta) chrome/browser/profiles/profile_destroyer.cc:221:22
    #18 0x5ff93ffb0b94 in BrowserManagerService::DeleteBrowser(Browser*) chrome/browser/ui/browser_manager_service.cc:129:5
    #19 0x5ff93ff40490 in base::internal::Invoker<base::internal::FunctorTraits<void (Browser::*&&)(), base::WeakPtr<Browser>&&>, base::internal::BindState<true, true, false, void (Browser::*)(), base::WeakPtr<Browser>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #20 0x5ff92740adf3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #21 0x5ff92747befc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #22 0x5ff92747ad9a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #23 0x5ff92762aad8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #24 0x5ff92762e098 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #25 0x744d74535584  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d584) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #26 0x744d74594976  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xbc976) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #27 0x744d74534a22 in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ca22) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #28 0x5ff92762b0f3 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:770:30
    #29 0x5ff92747d5e4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12

previously allocated by thread T0 (chrome) here:
    #0 0x5ff90f15459d in operator new(unsigned long) (/home/ab/code/chromium/src/out/asan_nodcheck/chrome+0x1107759d) (BuildId: c6f0a69f85268525)
    #1 0x5ff91b556e84 in content::FileSystemAccessWatcherManager::FileSystemAccessWatcherManager(content::FileSystemAccessManagerImpl*, base::PassKey<content::FileSystemAccessManagerImpl>) content/browser/file_system_access/file_system_access_bucket_path_watcher.h:27:3
    #2 0x5ff91b4eb76e in content::FileSystemAccessManagerImpl::FileSystemAccessManagerImpl(scoped_refptr<storage::FileSystemContext>, scoped_refptr<content::ChromeBlobStorageContext>, content::FileSystemAccessPermissionContext*, bool) content/browser/file_system_access/file_system_access_manager_impl.cc:450:7
    #3 0x5ff91cae11cf in scoped_refptr<content::FileSystemAccessManagerImpl> base::MakeRefCounted<content::FileSystemAccessManagerImpl, scoped_refptr<storage::FileSystemContext>&, scoped_refptr<content::ChromeBlobStorageContext>&, content::FileSystemAccessPermissionContext*, bool>(scoped_refptr<storage::FileSystemContext>&, scoped_refptr<content::ChromeBlobStorageContext>&, content::FileSystemAccessPermissionContext*&&, bool&&) base/memory/scoped_refptr.h:151:16
    #4 0x5ff91cadbf25 in content::StoragePartitionImpl::Initialize(content::StoragePartitionImpl*) content/browser/storage_partition_impl.cc:1369:7
    #5 0x5ff91cb484a9 in content::StoragePartitionImplMap::Get(content::StoragePartitionConfig const&, bool) content/browser/storage_partition_impl_map.cc:355:14
    #6 0x5ff91acb1ffe in content::BrowserContext::GetDefaultStoragePartition() content/browser/browser_context.cc:151:52
    #7 0x5ff9253b5db5 in OptimizationGuideKeyedService::InitializeModelExecution(Profile*) chrome/browser/optimization_guide/optimization_guide_keyed_service.cc:366:38
    #8 0x5ff9253b42e5 in OptimizationGuideKeyedService::Initialize() chrome/browser/optimization_guide/optimization_guide_keyed_service.cc:345:3
    #9 0x5ff9253bbd57 in OptimizationGuideKeyedServiceFactory::BuildServiceInstanceForBrowserContext(content::BrowserContext*) const gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #10 0x5ff92c49ad75 in KeyedServiceTemplatedFactory<KeyedService>::GetServiceForContext(void*, bool) components/keyed_service/core/keyed_service_templated_factory.cc:149:22
    #11 0x5ff92c48c780 in DependencyManager::CreateContextServices(void*, bool) components/keyed_service/core/dependency_manager.cc:125:16
    #12 0x5ff92d8fb0e4 in BrowserContextDependencyManager::DoCreateBrowserContextServices(content::BrowserContext*, bool) components/keyed_service/content/browser_context_dependency_manager.cc:36:22
    #13 0x5ff926fa8e08 in OffTheRecordProfileImpl::Init() chrome/browser/profiles/off_the_record_profile_impl.cc:194:51
    #14 0x5ff926fab4f8 in Profile::CreateOffTheRecordProfile(Profile*, Profile::OTRProfileID const&) chrome/browser/profiles/off_the_record_profile_impl.cc:642:12
    #15 0x5ff926fa154b in ProfileImpl::GetOffTheRecordProfile(Profile::OTRProfileID const&, bool) chrome/browser/profiles/profile_impl.cc:1015:7
    #16 0x5ff9107fd156 in Profile::GetPrimaryOTRProfile(bool) chrome/browser/profiles/profile.cc:547:10
    #17 0x5ff9236c0c8b in (anonymous namespace)::GetPrivateProfileIfRequested(base::CommandLine const&, StartupProfileInfo) chrome/browser/ui/startup/startup_browser_creator.cc:302:21
    #18 0x5ff9236bec94 in StartupBrowserCreator::ProcessCmdLineImpl(base::CommandLine const&, base::FilePath const&, chrome::startup::IsProcessStartup, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&) chrome/browser/ui/startup/startup_browser_creator.cc:614:7
    #19 0x5ff9236be50e in StartupBrowserCreator::Start(base::CommandLine const&, base::FilePath const&, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&) chrome/browser/ui/startup/startup_browser_creator.cc:681:10
    #20 0x5ff926ea4b32 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:2064:25
    #21 0x5ff926ea31ac in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1463:18
    #22 0x5ff91ad72ddc in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1003:28
    #23 0x5ff91ad79fc1 in base::internal::Invoker<base::internal::FunctorTraits<int (content::BrowserMainLoop::*&&)(), content::BrowserMainLoop*>, base::internal::BindState<true, true, false, int (content::BrowserMainLoop::*)(), base::internal::UnretainedWrapper<content::BrowserMainLoop, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #24 0x5ff91cacc37d in content::StartupTaskRunner::RunAllTasksNow(bool) base/functional/callback.h:155:12
    #25 0x5ff91ad71c15 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:909:25
    #26 0x5ff91ad7d3cf in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams) content/browser/browser_main_runner_impl.cc:138:15
    #27 0x5ff91ad6c2da in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:28:32
    #28 0x5ff9236e7e7f in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10
    #29 0x5ff9236ec0d8 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1332:10

SUMMARY: AddressSanitizer: heap-use-after-free base/functional/bind_internal.h:740:12 in base::internal::Invoker<base::internal::FunctorTraits<void (storage::FileChangeObserver::*&&)(storage::FileSystemURL const&), storage::FileChangeObserver*, storage::FileSystemURL&&>, base::internal::BindState<true, true, false, void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), base::internal::UnretainedWrapper<storage::FileChangeObserver, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, storage::FileSystemURL>, void ()>::RunOnce(base::internal::BindStateBase*)
Shadow bytes around the buggy address:
  0x71cd71460500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x71cd71460580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x71cd71460600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x71cd71460680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x71cd71460700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x71cd71460780: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fa
  0x71cd71460800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x71cd71460880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x71cd71460900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x71cd71460980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x71cd71460a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==3873895==ADDITIONAL INFO

==3873895==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5ff91b4ba691 in void storage::TaskRunnerBoundObserverList<storage::FileChangeObserver>::Notify<void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), storage::FileSystemURL const&>(void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), storage::FileSystemURL const&) const storage/browser/file_system/task_runner_bound_observer_list.h:74:11
    #1 0x5ff92daeb2d4 in storage::MemoryFileStreamWriter::Write(net::IOBuffer*, int, base::OnceCallback<void (int)>) storage/browser/file_system/memory_file_stream_writer.cc:40:7
    #2 0x5ff92daeb2d4 in storage::MemoryFileStreamWriter::Write(net::IOBuffer*, int, base::OnceCallback<void (int)>) storage/browser/file_system/memory_file_stream_writer.cc:40:7
    #3 0x5ff92daeb2d4 in storage::MemoryFileStreamWriter::Write(net::IOBuffer*, int, base::OnceCallback<void (int)>) storage/browser/file_system/memory_file_stream_writer.cc:40:7


Command line: `/home/ab/code/chromium/src/out/asan_nodcheck/chrome --no-sandbox --headless=new --disable-gpu --disable-crashpad-for-testing --disable-breakpad --disable-crash-reporter --disable-in-process-stack-traces --disable-dev-shm-usage --enable-logging=stderr --v=0 --user-data-dir=/tmp/chrome-bug-a.A8j8OP --incognito --enable-blink-features=FileSystemObserver --enable-features=NetworkServiceInProcess --disable-features=HttpsUpgrades,HttpsFirstModeIncognito --no-first-run --no-default-browser-check --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl --flag-switches-begin --flag-switches-end http://127.0.0.1:8765/poc.html`


MiraclePtr Status: PROTECTED
This crash occurred inside a callback where a raw_ptr<T> pointing to the same region was bound to one of the arguments.
MiraclePtr is expected to make this crash non-exploitable once fully enabled.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==3873895==END OF ADDITIONAL INFO

==3873895==ABORTING
[3874781:3874932:0422/044559.699209:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.
[3874781:3874932:0422/044559.699375:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.