=================================================================
==63307==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190006d1d40 at pc 0x000309218ea4 bp 0x00016d9bfff0 sp 0x00016d9bffe8
READ of size 4 at 0x6190006d1d40 thread T0
    #0 0x000309218ea0 in content::FileSystemAccessWatcherManager::OnRawChange(storage::FileSystemURL const&, bool, content::FilePathWatcher::ChangeInfo const&, content::FileSystemAccessWatchScope const&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x9218ea0)
    #1 0x00030913b300 in content::FileSystemAccessChangeSource::NotifyOfChange(base::FilePath const&, bool, content::FilePathWatcher::ChangeInfo const&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x913b300)
    #2 0x00030a812238 in content::FileSystemAccessLocalPathWatcher::OnFilePathChanged(content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xa812238)
    #3 0x00030a8138e8 in base::internal::Invoker<base::internal::FunctorTraits<void (content::FileSystemAccessLocalPathWatcher::* const&)(content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool), base::WeakPtr<content::FileSystemAccessLocalPathWatcher> const&>, base::internal::BindState<true, true, false, void (content::FileSystemAccessLocalPathWatcher::*)(content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool), base::WeakPtr<content::FileSystemAccessLocalPathWatcher>>, void (content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool)>::Run(base::internal::BindStateBase*, content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xa8138e8)
    #4 0x00030a8169d4 in base::internal::Invoker<base::internal::FunctorTraits<base::RepeatingCallback<void (content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool)>&&, content::FilePathWatcher::ChangeInfo&&, base::FilePath&&, bool&&>, base::internal::BindState<false, true, true, base::RepeatingCallback<void (content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool)>, content::FilePathWatcher::ChangeInfo, base::FilePath, bool>, void ()>::RunOnce(base::internal::BindStateBase*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xa8169d4)
    #5 0x000312b400a4 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12b400a4)
    #6 0x000312ba7cec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12ba7cec)
    #7 0x000312ba70a4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12ba70a4)
    #8 0x000312cc93a0 in base::MessagePumpCFRunLoopBase::RunWork() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cc93a0)
    #9 0x000312cbaaa4 in base::apple::CallWithEHFrame(void () block_pointer) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cbaaa4)
    #10 0x000312cc77fc in base::MessagePumpCFRunLoopBase::RunWorkSource(void*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cc77fc)
    #11 0x0001969eaa60  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7ca60)
    #12 0x0001969ea9f4  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7c9f4)
    #13 0x0001969ea760  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7c760)
    #14 0x0001969e93b4  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7b3b4)
    #15 0x0001969e89e4  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7a9e4)
    #16 0x0001a248a278  (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:arm64e+0xc3278)
    #17 0x0001a248d4e4  (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:arm64e+0xc64e4)
    #18 0x0001a2618480  (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:arm64e+0x251480)
    #19 0x00019a909a30  (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x3aa30)
    #20 0x00019b2a85c8  (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x9d95c8)
    #21 0x000311bb7910 in __71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x11bb7910)
    #22 0x000312cbaaa4 in base::apple::CallWithEHFrame(void () block_pointer) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cbaaa4)
    #23 0x000311bb75d4 in -[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x11bb75d4)
    #24 0x00019a8fcbe0  (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x2dbe0)
    #25 0x000312ccaa40 in base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12ccaa40)
    #26 0x000312cc6534 in base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cc6534)
    #27 0x000312ba904c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12ba904c)
    #28 0x000312acd474 in base::RunLoop::Run(base::Location const&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12acd474)
    #29 0x000308b56114 in content::BrowserMainLoop::RunMainMessageLoop() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x8b56114)
    #30 0x000308b5ccd0 in content::BrowserMainRunnerImpl::Run() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x8b5ccd0)
    #31 0x000308b4e910 in content::BrowserMain(content::MainFunctionParams) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x8b4e910)
    #32 0x00030f1047b0 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xf1047b0)
    #33 0x00030f107cd4 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xf107cd4)
    #34 0x00030f106eac in content::ContentMainRunnerImpl::Run() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xf106eac)
    #35 0x00030f1029f0 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xf1029f0)
    #36 0x00030f102ee0 in content::ContentMain(content::ContentMainParams) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xf102ee0)
    #37 0x000300005cb4 in ChromeMain (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x5cb4)
    #38 0x00010243cbb0 in main (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/MacOS/Chromium:arm64+0x100000bb0)
    #39 0x00019655eb94 in start (/usr/lib/dyld:arm64e+0x6b94)

0x6190006d1d40 is located 704 bytes inside of 936-byte region [0x6190006d1a80,0x6190006d1e28)
freed by thread T0 here:
    #0 0x0001027d1074 in __asan_memmove (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x55074)
    #1 0x00030921a7c0 in content::FileSystemAccessWatcherManager::RemoveObserver(content::FileSystemAccessObservationGroup*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x921a7c0)
    #2 0x0003091f0990 in content::FileSystemAccessObservationGroup::~FileSystemAccessObservationGroup() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91f0990)
    #3 0x000309224c50 in std::__Cr::__tree<std::__Cr::__value_type<std::__Cr::pair<blink::StorageKey, content::FileSystemAccessWatchScope>, content::FileSystemAccessObservationGroup>, std::__Cr::__map_value_compare<std::__Cr::pair<blink::StorageKey, content::FileSystemAccessWatchScope>, std::__Cr::pair<std::__Cr::pair<blink::StorageKey, content::FileSystemAccessWatchScope> const, content::FileSystemAccessObservationGroup>, std::__Cr::less<std::__Cr::pair<blink::StorageKey, content::FileSystemAccessWatchScope>>>, std::__Cr::allocator<std::__Cr::pair<std::__Cr::pair<blink::StorageKey, content::FileSystemAccessWatchScope> const, content::FileSystemAccessObservationGroup>>>::erase(std::__Cr::__tree_const_iterator<std::__Cr::__value_type<std::__Cr::pair<blink::StorageKey, content::FileSystemAccessWatchScope>, content::FileSystemAccessObservationGroup>, std::__Cr::__tree_node<std::__Cr::__value_type<std::__Cr::pair<blink::StorageKey, content::FileSystemAccessWatchScope>, content::FileSystemAccessObservationGroup>, void*>*, long>) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x9224c50)
    #4 0x00030921af14 in content::FileSystemAccessWatcherManager::RemoveObservationGroup(blink::StorageKey const&, content::FileSystemAccessWatchScope const&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x921af14)
    #5 0x0003091f2d54 in base::ScopedObservation<content::FileSystemAccessObservationGroup, content::FileSystemAccessObservationGroup::Observer, (partition_alloc::internal::RawPtrTraits)1>::Reset() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91f2d54)
    #6 0x0003091efe70 in content::FileSystemAccessObservationGroup::Observer::~Observer() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91efe70)
    #7 0x0003091fef58 in content::FileSystemAccessObserverObservation::~FileSystemAccessObserverObservation() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91fef58)
    #8 0x0003091ff178 in content::FileSystemAccessObserverObservation::~FileSystemAccessObserverObservation() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91ff178)
    #9 0x0003091fb598 in std::__Cr::vector<std::__Cr::unique_ptr<content::FileSystemAccessObserverObservation, std::__Cr::default_delete<content::FileSystemAccessObserverObservation>>, std::__Cr::allocator<std::__Cr::unique_ptr<content::FileSystemAccessObserverObservation, std::__Cr::default_delete<content::FileSystemAccessObserverObservation>>>>::erase(std::__Cr::__wrap_iter<std::__Cr::unique_ptr<content::FileSystemAccessObserverObservation, std::__Cr::default_delete<content::FileSystemAccessObserverObservation>> const*>, std::__Cr::__wrap_iter<std::__Cr::unique_ptr<content::FileSystemAccessObserverObservation, std::__Cr::default_delete<content::FileSystemAccessObserverObservation>> const*>) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91fb598)
    #10 0x0003091f75d8 in content::FileSystemAccessObserverHost::RemoveObservation(content::FileSystemAccessObserverObservation*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91f75d8)
    #11 0x0003091ffa38 in content::FileSystemAccessObserverObservation::HandleError() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91ffa38)
    #12 0x0003091fe4a8 in content::FileSystemAccessObserverObservation::OnChanges(std::__Cr::optional<std::__Cr::list<content::FileSystemAccessObservationGroup::Change, std::__Cr::allocator<content::FileSystemAccessObservationGroup::Change>>> const&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91fe4a8)
    #13 0x000309201b94 in base::internal::Invoker<base::internal::FunctorTraits<void (content::FileSystemAccessObserverObservation::* const&)(std::__Cr::optional<std::__Cr::list<content::FileSystemAccessObservationGroup::Change, std::__Cr::allocator<content::FileSystemAccessObservationGroup::Change>>> const&), base::WeakPtr<content::FileSystemAccessObserverObservation> const&>, base::internal::BindState<true, true, false, void (content::FileSystemAccessObserverObservation::*)(std::__Cr::optional<std::__Cr::list<content::FileSystemAccessObservationGroup::Change, std::__Cr::allocator<content::FileSystemAccessObservationGroup::Change>>> const&), base::WeakPtr<content::FileSystemAccessObserverObservation>>, void (std::__Cr::optional<std::__Cr::list<content::FileSystemAccessObservationGroup::Change, std::__Cr::allocator<content::FileSystemAccessObservationGroup::Change>>> const&)>::Run(base::internal::BindStateBase*, std::__Cr::optional<std::__Cr::list<content::FileSystemAccessObservationGroup::Change, std::__Cr::allocator<content::FileSystemAccessObservationGroup::Change>>> const&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x9201b94)
    #14 0x0003091f0388 in base::RepeatingCallback<void (std::__Cr::optional<std::__Cr::list<content::FileSystemAccessObservationGroup::Change, std::__Cr::allocator<content::FileSystemAccessObservationGroup::Change>>> const&)>::Run(std::__Cr::optional<std::__Cr::list<content::FileSystemAccessObservationGroup::Change, std::__Cr::allocator<content::FileSystemAccessObservationGroup::Change>>> const&) const & (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91f0388)
    #15 0x0003091f1970 in content::FileSystemAccessObservationGroup::NotifyOfChanges(std::__Cr::optional<std::__Cr::list<content::FileSystemAccessObservationGroup::Change, std::__Cr::allocator<content::FileSystemAccessObservationGroup::Change>>> const&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91f1970)
    #16 0x000309217da8 in content::FileSystemAccessWatcherManager::OnRawChange(storage::FileSystemURL const&, bool, content::FilePathWatcher::ChangeInfo const&, content::FileSystemAccessWatchScope const&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x9217da8)
    #17 0x00030913b300 in content::FileSystemAccessChangeSource::NotifyOfChange(base::FilePath const&, bool, content::FilePathWatcher::ChangeInfo const&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x913b300)
    #18 0x00030a812238 in content::FileSystemAccessLocalPathWatcher::OnFilePathChanged(content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xa812238)
    #19 0x00030a8138e8 in base::internal::Invoker<base::internal::FunctorTraits<void (content::FileSystemAccessLocalPathWatcher::* const&)(content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool), base::WeakPtr<content::FileSystemAccessLocalPathWatcher> const&>, base::internal::BindState<true, true, false, void (content::FileSystemAccessLocalPathWatcher::*)(content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool), base::WeakPtr<content::FileSystemAccessLocalPathWatcher>>, void (content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool)>::Run(base::internal::BindStateBase*, content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xa8138e8)
    #20 0x00030a8169d4 in base::internal::Invoker<base::internal::FunctorTraits<base::RepeatingCallback<void (content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool)>&&, content::FilePathWatcher::ChangeInfo&&, base::FilePath&&, bool&&>, base::internal::BindState<false, true, true, base::RepeatingCallback<void (content::FilePathWatcher::ChangeInfo const&, base::FilePath const&, bool)>, content::FilePathWatcher::ChangeInfo, base::FilePath, bool>, void ()>::RunOnce(base::internal::BindStateBase*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xa8169d4)
    #21 0x000312b400a4 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12b400a4)
    #22 0x000312ba7cec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12ba7cec)
    #23 0x000312ba70a4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12ba70a4)
    #24 0x000312cc93a0 in base::MessagePumpCFRunLoopBase::RunWork() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cc93a0)
    #25 0x000312cbaaa4 in base::apple::CallWithEHFrame(void () block_pointer) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cbaaa4)
    #26 0x000312cc77fc in base::MessagePumpCFRunLoopBase::RunWorkSource(void*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cc77fc)
    #27 0x0001969eaa60  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7ca60)
    #28 0x0001969ea9f4  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7c9f4)
    #29 0x0001969ea760  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7c760)

previously allocated by thread T0 here:
    #0 0x0001027d0f84 in __asan_memmove (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x54f84)
    #1 0x0003291c4c9c in operator new(unsigned long) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x291c4c9c)
    #2 0x00030921b31c in content::FileSystemAccessWatcherManager::CreateOwnedSourceForScope(content::FileSystemAccessWatchScope) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x921b31c)
    #3 0x000309215a2c in content::FileSystemAccessWatcherManager::EnsureSourceIsInitializedForScope(content::FileSystemAccessWatchScope, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, unsigned long)>) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x9215a2c)
    #4 0x000309215490 in content::FileSystemAccessWatcherManager::GetFileObservation(blink::StorageKey const&, storage::FileSystemURL const&, long long, base::OnceCallback<void (base::expected<std::__Cr::unique_ptr<content::FileSystemAccessObservationGroup::Observer, std::__Cr::default_delete<content::FileSystemAccessObservationGroup::Observer>>, mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>>)>) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x9215490)
    #5 0x0003091f6170 in content::FileSystemAccessObserverHost::DidCheckItemExists(std::__Cr::variant<std::__Cr::unique_ptr<content::FileSystemAccessDirectoryHandleImpl, std::__Cr::default_delete<content::FileSystemAccessDirectoryHandleImpl>>, std::__Cr::unique_ptr<content::FileSystemAccessFileHandleImpl, std::__Cr::default_delete<content::FileSystemAccessFileHandleImpl>>>, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, mojo::PendingReceiver<blink::mojom::FileSystemAccessObserver>)>, storage::FileSystemURL, bool, base::File::Error) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91f6170)
    #6 0x0003091f9590 in void base::internal::DecayedFunctorTraits<void (content::FileSystemAccessObserverHost::*)(std::__Cr::variant<std::__Cr::unique_ptr<content::FileSystemAccessDirectoryHandleImpl, std::__Cr::default_delete<content::FileSystemAccessDirectoryHandleImpl>>, std::__Cr::unique_ptr<content::FileSystemAccessFileHandleImpl, std::__Cr::default_delete<content::FileSystemAccessFileHandleImpl>>>, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, mojo::PendingReceiver<blink::mojom::FileSystemAccessObserver>)>, storage::FileSystemURL, bool, base::File::Error), base::WeakPtr<content::FileSystemAccessObserverHost>&&, std::__Cr::variant<std::__Cr::unique_ptr<content::FileSystemAccessDirectoryHandleImpl, std::__Cr::default_delete<content::FileSystemAccessDirectoryHandleImpl>>, std::__Cr::unique_ptr<content::FileSystemAccessFileHandleImpl, std::__Cr::default_delete<content::FileSystemAccessFileHandleImpl>>>&&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, mojo::PendingReceiver<blink::mojom::FileSystemAccessObserver>)>&&, storage::FileSystemURL&&, bool&&>::Invoke<void (content::FileSystemAccessObserverHost::*)(std::__Cr::variant<std::__Cr::unique_ptr<content::FileSystemAccessDirectoryHandleImpl, std::__Cr::default_delete<content::FileSystemAccessDirectoryHandleImpl>>, std::__Cr::unique_ptr<content::FileSystemAccessFileHandleImpl, std::__Cr::default_delete<content::FileSystemAccessFileHandleImpl>>>, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, mojo::PendingReceiver<blink::mojom::FileSystemAccessObserver>)>, storage::FileSystemURL, bool, base::File::Error), base::WeakPtr<content::FileSystemAccessObserverHost> const&, std::__Cr::variant<std::__Cr::unique_ptr<content::FileSystemAccessDirectoryHandleImpl, std::__Cr::default_delete<content::FileSystemAccessDirectoryHandleImpl>>, std::__Cr::unique_ptr<content::FileSystemAccessFileHandleImpl, std::__Cr::default_delete<content::FileSystemAccessFileHandleImpl>>>, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, mojo::PendingReceiver<blink::mojom::FileSystemAccessObserver>)>, storage::FileSystemURL, bool, base::File::Error>(void (content::FileSystemAccessObserverHost::*)(std::__Cr::variant<std::__Cr::unique_ptr<content::FileSystemAccessDirectoryHandleImpl, std::__Cr::default_delete<content::FileSystemAccessDirectoryHandleImpl>>, std::__Cr::unique_ptr<content::FileSystemAccessFileHandleImpl, std::__Cr::default_delete<content::FileSystemAccessFileHandleImpl>>>, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, mojo::PendingReceiver<blink::mojom::FileSystemAccessObserver>)>, storage::FileSystemURL, bool, base::File::Error), base::WeakPtr<content::FileSystemAccessObserverHost> const&, std::__Cr::variant<std::__Cr::unique_ptr<content::FileSystemAccessDirectoryHandleImpl, std::__Cr::default_delete<content::FileSystemAccessDirectoryHandleImpl>>, std::__Cr::unique_ptr<content::FileSystemAccessFileHandleImpl, std::__Cr::default_delete<content::FileSystemAccessFileHandleImpl>>>&&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, mojo::PendingReceiver<blink::mojom::FileSystemAccessObserver>)>&&, storage::FileSystemURL&&, bool&&, base::File::Error&&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91f9590)
    #7 0x0003091f92ac in base::internal::Invoker<base::internal::FunctorTraits<void (content::FileSystemAccessObserverHost::*&&)(std::__Cr::variant<std::__Cr::unique_ptr<content::FileSystemAccessDirectoryHandleImpl, std::__Cr::default_delete<content::FileSystemAccessDirectoryHandleImpl>>, std::__Cr::unique_ptr<content::FileSystemAccessFileHandleImpl, std::__Cr::default_delete<content::FileSystemAccessFileHandleImpl>>>, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, mojo::PendingReceiver<blink::mojom::FileSystemAccessObserver>)>, storage::FileSystemURL, bool, base::File::Error), base::WeakPtr<content::FileSystemAccessObserverHost>&&, std::__Cr::variant<std::__Cr::unique_ptr<content::FileSystemAccessDirectoryHandleImpl, std::__Cr::default_delete<content::FileSystemAccessDirectoryHandleImpl>>, std::__Cr::unique_ptr<content::FileSystemAccessFileHandleImpl, std::__Cr::default_delete<content::FileSystemAccessFileHandleImpl>>>&&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, mojo::PendingReceiver<blink::mojom::FileSystemAccessObserver>)>&&, storage::FileSystemURL&&, bool&&>, base::internal::BindState<true, true, false, void (content::FileSystemAccessObserverHost::*)(std::__Cr::variant<std::__Cr::unique_ptr<content::FileSystemAccessDirectoryHandleImpl, std::__Cr::default_delete<content::FileSystemAccessDirectoryHandleImpl>>, std::__Cr::unique_ptr<content::FileSystemAccessFileHandleImpl, std::__Cr::default_delete<content::FileSystemAccessFileHandleImpl>>>, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, mojo::PendingReceiver<blink::mojom::FileSystemAccessObserver>)>, storage::FileSystemURL, bool, base::File::Error), base::WeakPtr<content::FileSystemAccessObserverHost>, std::__Cr::variant<std::__Cr::unique_ptr<content::FileSystemAccessDirectoryHandleImpl, std::__Cr::default_delete<content::FileSystemAccessDirectoryHandleImpl>>, std::__Cr::unique_ptr<content::FileSystemAccessFileHandleImpl, std::__Cr::default_delete<content::FileSystemAccessFileHandleImpl>>>, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, mojo::PendingReceiver<blink::mojom::FileSystemAccessObserver>)>, storage::FileSystemURL, bool>, void (base::File::Error)>::RunOnce(base::internal::BindStateBase*, base::File::Error) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x91f92ac)
    #8 0x000309154328 in base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (base::File::Error)>&&, base::File::Error&&>, base::internal::BindState<false, true, true, base::OnceCallback<void (base::File::Error)>, base::File::Error>, void ()>::RunOnce(base::internal::BindStateBase*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x9154328)
    #9 0x000312b400a4 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12b400a4)
    #10 0x000312ba7cec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12ba7cec)
    #11 0x000312ba70a4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12ba70a4)
    #12 0x000312cc93a0 in base::MessagePumpCFRunLoopBase::RunWork() (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cc93a0)
    #13 0x000312cbaaa4 in base::apple::CallWithEHFrame(void () block_pointer) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cbaaa4)
    #14 0x000312cc77fc in base::MessagePumpCFRunLoopBase::RunWorkSource(void*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cc77fc)
    #15 0x0001969eaa60  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7ca60)
    #16 0x0001969ea9f4  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7c9f4)
    #17 0x0001969ea760  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7c760)
    #18 0x0001969e93b4  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7b3b4)
    #19 0x0001969e89e4  (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x7a9e4)
    #20 0x0001a248a278  (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:arm64e+0xc3278)
    #21 0x0001a248d4e4  (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:arm64e+0xc64e4)
    #22 0x0001a2618480  (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:arm64e+0x251480)
    #23 0x00019a909a30  (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x3aa30)
    #24 0x00019b2a85c8  (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x9d95c8)
    #25 0x000311bb7910 in __71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x11bb7910)
    #26 0x000312cbaaa4 in base::apple::CallWithEHFrame(void () block_pointer) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12cbaaa4)
    #27 0x000311bb75d4 in -[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x11bb75d4)
    #28 0x00019a8fcbe0  (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x2dbe0)
    #29 0x000312ccaa40 in base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x12ccaa40)

SUMMARY: AddressSanitizer: heap-use-after-free (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0x9218ea0) in content::FileSystemAccessWatcherManager::OnRawChange(storage::FileSystemURL const&, bool, content::FilePathWatcher::ChangeInfo const&, content::FileSystemAccessWatchScope const&)
Shadow bytes around the buggy address:
  0x6190006d1a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6190006d1b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6190006d1b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6190006d1c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6190006d1c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x6190006d1d00: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd
  0x6190006d1d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6190006d1e00: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
  0x6190006d1e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6190006d1f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x6190006d1f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==63307==ADDITIONAL INFO

==63307==Note: Please include this section with the ASan report.
Task trace:
    #0 0x00030a8118a0 in content::FileSystemAccessLocalPathWatcher::Initialize(base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>)>) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xa8118a0)
    #1 0x00030a85c0a0 in content::FilePathWatcherFSEvents::FSEventsCallback(__FSEventStream const*, void*, unsigned long, void*, unsigned int const*, unsigned long long const*) (/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/148.0.7763.0/Chromium Framework:arm64+0xa85c0a0)


Command line: `/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/Chromium.app/Contents/MacOS/Chromium --user-data-dir=/tmp/fsa_obs_group_uaf_profile_final --enable-blink-features=FileSystemObserver --test-type --no-first-run --no-default-browser-check --flag-switches-begin --flag-switches-end --file-url-path-alias=/gen=/Users/asjidkalam/fuzzing/chrome_research/chromium/src/.asan_mac_arm64_run/gen http://127.0.0.1:8001/fsa_observation_group_uaf_poc/index.html?attempts=256&concurrency=16`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==63307==END OF ADDITIONAL INFO

==63307==ABORTING