==54310==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110002a4448 at pc 0x000115beb104 bp 0x000305c9a650 sp 0x000305c9a648
READ of size 8 at 0x6110002a4448 thread T7
==54310==WARNING: invalid path to external symbolizer!
==54310==WARNING: Failed to use and restart external symbolizer!
    #0 0x000115beb100 in std::__Cr::__tree<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__map_value_compare<unsigned long long, std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::less<unsigned long long>>, std::__Cr::allocator<std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>>>::erase(std::__Cr::__tree_const_iterator<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>)+0x194 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37f100)
    #1 0x000115be8b58 in network::ThrottlingP2PNetworkInterceptor::OnSendNetworkTimer()+0x12c (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37cb58)
    #2 0x000115bea2a4 in base::internal::Invoker<base::internal::FunctorTraits<void (network::ThrottlingP2PNetworkInterceptor::*&&)(), network::ThrottlingP2PNetworkInterceptor*>, base::internal::BindState<true, true, false, void (network::ThrottlingP2PNetworkInterceptor::*)(), base::internal::UnretainedWrapper<network::ThrottlingP2PNetworkInterceptor, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x184 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37e2a4)
    #3 0x0001070a8c18 in base::OneShotTimer::RunUserTask()+0x190 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x330c18)
    #4 0x0001070ae3dc in base::internal::Invoker<base::internal::FunctorTraits<void (base::internal::DelayTimerBase::* const&)(), base::internal::DelayTimerBase*>, base::internal::BindState<true, true, false, void (base::internal::DelayTimerBase::*)(), base::internal::UnretainedWrapper<base::internal::DelayTimerBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*)+0x11c (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x3363dc)
    #5 0x000106f75804 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x1fd804)
    #6 0x000106ff2e84 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x88c (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x27ae84)
    #7 0x000106ff223c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x27a23c)
    #8 0x0001071c6004 in base::MessagePumpKqueue::Run(base::MessagePump::Delegate*)+0x1c0 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x44e004)
    #9 0x000106ff4240 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x32c (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x27c240)
    #10 0x000106ee0b08 in base::RunLoop::Run(base::Location const&)+0x430 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x168b08)
    #11 0x00010708c03c in base::Thread::Run(base::RunLoop*)+0xd8 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x31403c)
    #12 0x0001357a5b9c in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*)+0x168 (/Users/sakura/chromium/src/out/asan-release/libcontent.dylib:arm64+0xb9b9c)
    #13 0x00010708c49c in base::Thread::ThreadMain()+0x3d8 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x31449c)
    #14 0x0001070fde54 in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x385e54)
    #15 0x000105185668 in __sanitizer_weak_hook_memcmp+0x3653c (/Users/sakura/chromium/src/out/asan-release/libclang_rt.asan_osx_dynamic.dylib:arm64+0x51668)
    #16 0x00019bf9bc08 in _pthread_start+0x84 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x6c08)
    #17 0x00019bf96b7c in thread_start+0x4 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x1b7c)

0x6110002a4448 is located 8 bytes inside of 216-byte region [0x6110002a4440,0x6110002a4518)
freed by thread T7 here:
    #0 0x0001051995a8 in __sanitizer_finish_switch_fiber+0xa04 (/Users/sakura/chromium/src/out/asan-release/libclang_rt.asan_osx_dynamic.dylib:arm64+0x655a8)
    #1 0x000115beb0a0 in std::__Cr::__tree<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__map_value_compare<unsigned long long, std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::less<unsigned long long>>, std::__Cr::allocator<std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>>>::erase(std::__Cr::__tree_const_iterator<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>)+0x134 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37f0a0)
    #2 0x000115be77b8 in network::ThrottlingP2PNetworkInterceptor::UnregisterSocket(network::P2PSocketUdp*)+0x344 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37b7b8)
    #3 0x000115bd6548 in network::P2PSocketUdp::~P2PSocketUdp()+0x80 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x36a548)
    #4 0x000115bd6990 in network::P2PSocketUdp::~P2PSocketUdp()+0x8 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x36a990)
    #5 0x000115bbb80c in base::internal::flat_tree<network::P2PSocket*, base::internal::GetFirst, std::__Cr::less<void>, std::__Cr::vector<std::__Cr::pair<network::P2PSocket*, std::__Cr::unique_ptr<network::P2PSocket, std::__Cr::default_delete<network::P2PSocket>>>, std::__Cr::allocator<std::__Cr::pair<network::P2PSocket*, std::__Cr::unique_ptr<network::P2PSocket, std::__Cr::default_delete<network::P2PSocket>>>>>>::erase(std::__Cr::__wrap_iter<std::__Cr::pair<network::P2PSocket*, std::__Cr::unique_ptr<network::P2PSocket, std::__Cr::default_delete<network::P2PSocket>>> const*>)+0x224 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x34f80c)
    #6 0x000115bbbb00 in non-virtual thunk to network::P2PSocketManager::DestroySocket(network::P2PSocket*)+0x138 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x34fb00)
    #7 0x000115bb6ae0 in network::P2PSocket::OnError()+0x19c (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x34aae0)
    #8 0x000115bd9a5c in network::P2PSocketUdp::DoSend(network::P2PPendingPacket const&)+0x8d0 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x36da5c)
    #9 0x000115be8c5c in network::ThrottlingP2PNetworkInterceptor::OnSendNetworkTimer()+0x230 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37cc5c)
    #10 0x000115bea2a4 in base::internal::Invoker<base::internal::FunctorTraits<void (network::ThrottlingP2PNetworkInterceptor::*&&)(), network::ThrottlingP2PNetworkInterceptor*>, base::internal::BindState<true, true, false, void (network::ThrottlingP2PNetworkInterceptor::*)(), base::internal::UnretainedWrapper<network::ThrottlingP2PNetworkInterceptor, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x184 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37e2a4)
    #11 0x0001070a8c18 in base::OneShotTimer::RunUserTask()+0x190 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x330c18)
    #12 0x0001070ae3dc in base::internal::Invoker<base::internal::FunctorTraits<void (base::internal::DelayTimerBase::* const&)(), base::internal::DelayTimerBase*>, base::internal::BindState<true, true, false, void (base::internal::DelayTimerBase::*)(), base::internal::UnretainedWrapper<base::internal::DelayTimerBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*)+0x11c (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x3363dc)
    #13 0x000106f75804 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x1fd804)
    #14 0x000106ff2e84 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x88c (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x27ae84)
    #15 0x000106ff223c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x27a23c)
    #16 0x0001071c6004 in base::MessagePumpKqueue::Run(base::MessagePump::Delegate*)+0x1c0 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x44e004)
    #17 0x000106ff4240 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x32c (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x27c240)
    #18 0x000106ee0b08 in base::RunLoop::Run(base::Location const&)+0x430 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x168b08)
    #19 0x00010708c03c in base::Thread::Run(base::RunLoop*)+0xd8 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x31403c)
    #20 0x0001357a5b9c in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*)+0x168 (/Users/sakura/chromium/src/out/asan-release/libcontent.dylib:arm64+0xb9b9c)
    #21 0x00010708c49c in base::Thread::ThreadMain()+0x3d8 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x31449c)
    #22 0x0001070fde54 in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x385e54)
    #23 0x000105185668 in __sanitizer_weak_hook_memcmp+0x3653c (/Users/sakura/chromium/src/out/asan-release/libclang_rt.asan_osx_dynamic.dylib:arm64+0x51668)
    #24 0x00019bf9bc08 in _pthread_start+0x84 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x6c08)
    #25 0x00019bf96b7c in thread_start+0x4 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x1b7c)

previously allocated by thread T7 here:
    #0 0x0001051991c0 in __sanitizer_finish_switch_fiber+0x61c (/Users/sakura/chromium/src/out/asan-release/libclang_rt.asan_osx_dynamic.dylib:arm64+0x651c0)
    #1 0x000115beaab0 in std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool> std::__Cr::__try_key_extraction_impl<unsigned long long, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool>, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__map_value_compare<unsigned long long, std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::less<unsigned long long>>, std::__Cr::allocator<std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&)::'lambda'(unsigned long long const&, std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&), std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__map_value_compare<unsigned long long, std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::less<unsigned long long>>, std::__Cr::allocator<std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&)::'lambda'(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&), std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>, 0>(std::__Cr::__priority_tag<1ul>, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__map_value_compare<unsigned long long, std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::less<unsigned long long>>, std::__Cr::allocator<std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&)::'lambda'(unsigned long long const&, std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&), std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__map_value_compare<unsigned long long, std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::less<unsigned long long>>, std::__Cr::allocator<std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&)::'lambda'(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&), std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&)+0xfc (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37eab0)
    #2 0x000115be86d8 in network::ThrottlingP2PNetworkInterceptor::EnqueueSend(network::P2PPendingPacket, network::P2PSocketUdp*)+0x30c (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37c6d8)
    #3 0x000115bdbc04 in network::P2PSocketUdp::SendPacket(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>, network::P2PPacketInfo const&)+0x2ec (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x36fc04)
    #4 0x000115bdb7d0 in network::P2PSocketUdp::Send(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>, network::P2PPacketInfo const&)+0x13c (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x36f7d0)
    #5 0x000115d89f6c in network::mojom::P2PSocketStubDispatch::Accept(network::mojom::P2PSocket*, mojo::Message*)+0x248 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x51df6c)
    #6 0x000105c05cac in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*)+0x8fc (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x25cac)
    #7 0x000105c1bf18 in mojo::MessageDispatcher::Accept(mojo::Message*)+0x2f0 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x3bf18)
    #8 0x000105c0aea0 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*)+0x148 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x2aea0)
    #9 0x000105c295c4 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*)+0x650 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x495c4)
    #10 0x000105c28058 in mojo::internal::MultiplexRouter::Accept(mojo::Message*)+0x558 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x48058)
    #11 0x000105c1bf18 in mojo::MessageDispatcher::Accept(mojo::Message*)+0x2f0 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x3bf18)
    #12 0x000105bf2ad0 in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>)+0x394 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x12ad0)
    #13 0x000105bf4208 in mojo::Connector::ReadAllAvailableMessages()+0x23c (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x14208)
    #14 0x000105bf3ce0 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int)+0xe8 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x13ce0)
    #15 0x000105bf66a0 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int)+0x1b8 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x166a0)
    #16 0x000105bf5d54 in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const &+0x148 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x15d54)
    #17 0x000105bf5b30 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&)+0xf0 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_cpp_bindings.dylib:arm64+0x15b30)
    #18 0x000105d26e64 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const &+0x154 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_system_cpp.dylib:arm64+0x1ae64)
    #19 0x000105d26880 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&)+0x398 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_system_cpp.dylib:arm64+0x1a880)
    #20 0x000105d271a4 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int)+0x1d8 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_system_cpp.dylib:arm64+0x1b1a4)
    #21 0x000105d24380 in mojo::SimpleWatcher::Context::CallNotify(MojoTrapEvent const*)+0xb8 (/Users/sakura/chromium/src/out/asan-release/libmojo_public_system_cpp.dylib:arm64+0x18380)
    #22 0x00010637b2a4 in mojo::core::ipcz_driver::MojoTrap::DispatchOrQueueEvent(mojo::core::ipcz_driver::MojoTrap::Trigger&, MojoTrapEvent const&)+0x334 (/Users/sakura/chromium/src/out/asan-release/libmojo_core_embedder_internal.dylib:arm64+0x372a4)
    #23 0x00010637d340 in mojo::core::ipcz_driver::MojoTrap::HandleEvent(IpczTrapEvent const&)+0x680 (/Users/sakura/chromium/src/out/asan-release/libmojo_core_embedder_internal.dylib:arm64+0x39340)
    #24 0x00010642e144 in ipcz::TrapEventDispatcher::~TrapEventDispatcher()+0x16c (/Users/sakura/chromium/src/out/asan-release/libmojo_core_embedder_internal.dylib:arm64+0xea144)
    #25 0x000106416a48 in ipcz::Router::AcceptInboundParcel(std::__Cr::unique_ptr<ipcz::Parcel, std::__Cr::default_delete<ipcz::Parcel>>)+0x248 (/Users/sakura/chromium/src/out/asan-release/libmojo_core_embedder_internal.dylib:arm64+0xd2a48)
    #26 0x0001063e4800 in ipcz::NodeLink::AcceptCompleteParcel(ipcz::StrongAlias<ipcz::SublinkIdTag, unsigned long long>, std::__Cr::unique_ptr<ipcz::Parcel, std::__Cr::default_delete<ipcz::Parcel>>)+0x9a8 (/Users/sakura/chromium/src/out/asan-release/libmojo_core_embedder_internal.dylib:arm64+0xa0800)
    #27 0x0001063e8b0c in ipcz::NodeLink::OnAcceptParcel(ipcz::msg::AcceptParcel&)+0xc54 (/Users/sakura/chromium/src/out/asan-release/libmojo_core_embedder_internal.dylib:arm64+0xa4b0c)
    #28 0x0001064072d4 in ipcz::msg::NodeMessageListener::OnTransportMessage(ipcz::DriverTransport::RawMessage const&, ipcz::DriverTransport const&, unsigned long)+0x1c80 (/Users/sakura/chromium/src/out/asan-release/libmojo_core_embedder_internal.dylib:arm64+0xc32d4)
    #29 0x0001063b4688 in ipcz::(anonymous namespace)::NotifyTransport(unsigned long, void const*, unsigned long, unsigned long const*, unsigned long, unsigned int, IpczTransportActivityOptions const*)+0x340 (/Users/sakura/chromium/src/out/asan-release/libmojo_core_embedder_internal.dylib:arm64+0x70688)

Thread T7 created by T0 here:
    #0 0x00010517f760 in __sanitizer_weak_hook_memcmp+0x30634 (/Users/sakura/chromium/src/out/asan-release/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4b760)
    #1 0x0001070fd418 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType)+0x270 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x385418)
    #2 0x00010708ad1c in base::Thread::StartWithOptions(base::Thread::Options)+0x498 (/Users/sakura/chromium/src/out/asan-release/libbase.dylib:arm64+0x312d1c)
    #3 0x0001357a4840 in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>, bool)+0x404 (/Users/sakura/chromium/src/out/asan-release/libcontent.dylib:arm64+0xb8840)
    #4 0x000139464c74 in content::UtilityMain(content::MainFunctionParams)+0x654 (/Users/sakura/chromium/src/out/asan-release/libcontent.dylib:arm64+0x3d78c74)
    #5 0x000139480dd8 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*)+0x420 (/Users/sakura/chromium/src/out/asan-release/libcontent.dylib:arm64+0x3d94dd8)
    #6 0x000139482f58 in content::ContentMainRunnerImpl::Run()+0x53c (/Users/sakura/chromium/src/out/asan-release/libcontent.dylib:arm64+0x3d96f58)
    #7 0x00013947e868 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x858 (/Users/sakura/chromium/src/out/asan-release/libcontent.dylib:arm64+0x3d92868)
    #8 0x00013947ed58 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/sakura/chromium/src/out/asan-release/libcontent.dylib:arm64+0x3d92d58)
    #9 0x00011d22b724 in ChromeMain+0x490 (/Users/sakura/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0xb724)
    #10 0x0001048d4b94 in main+0x254 (/Users/sakura/chromium/src/out/asan-release/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7702.0/Helpers/Chromium Helper.app/Contents/MacOS/Chromium Helper:arm64+0x100000b94)
    #11 0x00019bbfab94 in start+0x17b8 (/usr/lib/dyld:arm64e+0x6b94)

SUMMARY: AddressSanitizer: heap-use-after-free (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37f100) in std::__Cr::__tree<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__map_value_compare<unsigned long long, std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::less<unsigned long long>>, std::__Cr::allocator<std::__Cr::pair<unsigned long long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>>>::erase(std::__Cr::__tree_const_iterator<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>)+0x194
Shadow bytes around the buggy address:
  0x6110002a4180: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x6110002a4200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6110002a4280: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa
  0x6110002a4300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6110002a4380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
=>0x6110002a4400: fa fa fa fa fa fa f7 fa fd[fd]fd fd fd fd fd fd
  0x6110002a4480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6110002a4500: fd fd fd fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x6110002a4580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6110002a4600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x6110002a4680: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==54310==ADDITIONAL INFO

==54310==Note: Please include this section with the ASan report.
Task trace:
    #0 0x000115be8c94 in network::ThrottlingP2PNetworkInterceptor::OnSendNetworkTimer()+0x268 (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37cc94)
    #1 0x000115be8708 in network::ThrottlingP2PNetworkInterceptor::EnqueueSend(network::P2PPendingPacket, network::P2PSocketUdp*)+0x33c (/Users/sakura/chromium/src/out/asan-release/libservices_network_network_service.dylib:arm64+0x37c708)


Command line: `/Users/sakura/chromium/src/out/asan-release/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7702.0/Helpers/Chromium Helper.app/Contents/MacOS/Chromium Helper --type=utility --utility-sub-type=network.mojom.NetworkService --lang=zh-CN --service-sandbox-type=network --user-data-dir=/tmp/poc-p2p-manual-KjBev --start-stack-profiler --shared-files --metrics-shmem-handle=1752395122,r,15947356220012857116,15841494850046582270,524288 --field-trial-handle=1718379636,r,8260178911270114349,9619617882640087053,262144 --variations-seed-version --pseudonymization-salt-handle=1935764596,r,11645408795473973288,1370401451963380747,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=stderr --v=1 --seatbelt-client=30`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==54310==END OF ADDITIONAL INFO

==54310==ABORTING