==1765==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c5d5347eae0 at pc 0x55d59aa03b21 bp 0x7fff104a8570 sp 0x7fff104a8568
READ of size 1 at 0x7c5d5347eae0 thread T0 (chrome)
    #0 0x55d59aa03b20 in actor::ClickDispatcher::DoMouseDown(blink::mojom::Button, int, actor::ResolvedTarget const&) gen/third_party/libc++/src/include/optional:447:96
    #1 0x55d59aa048f7 in base::internal::Invoker<base::internal::FunctorTraits<void (actor::ClickDispatcher::*&&)(blink::mojom::Button, int, actor::ResolvedTarget const&), base::WeakPtr<actor::ClickDispatcher>&&, blink::mojom::Button&&, int&&, actor::ResolvedTarget&&>, base::internal::BindState<true, true, false, void (actor::ClickDispatcher::*)(blink::mojom::Button, int, actor::ResolvedTarget const&), base::WeakPtr<actor::ClickDispatcher>, blink::mojom::Button, int, actor::ResolvedTarget>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #2 0x55d59cdfa326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #3 0x55d59ce719c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #4 0x55d59ce7083a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #5 0x55d59ccb8927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #6 0x55d59ce730d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #7 0x55d59cd74ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #8 0x55d5a90fe1fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #9 0x55d5989126ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #10 0x55d598913a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #11 0x55d598916728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #12 0x55d598910101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #13 0x55d5989106fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #14 0x55d584e45b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #15 0x7f2d5502b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7c5d5347eae0 is located 288 bytes inside of 384-byte region [0x7c5d5347e9c0,0x7c5d5347eb40)
freed by thread T0 (chrome) here:
    #0 0x55d584e45002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e09002) (BuildId: d8b46a5f0638292f)
    #1 0x55d59aa4089f in actor::ToolExecutor::~ToolExecutor() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x55d5b70cbc5b in ChromeRenderFrameObserver::~ChromeRenderFrameObserver() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #3 0x55d5b70cc073 in ChromeRenderFrameObserver::~ChromeRenderFrameObserver() chrome/renderer/chrome_render_frame_observer.cc:213:55
    #4 0x55d5a8f1d3ff in content::RenderFrameImpl::~RenderFrameImpl() content/renderer/render_frame_impl.cc:1989:14
    #5 0x55d5a8f1f8b3 in content::RenderFrameImpl::~RenderFrameImpl() content/renderer/render_frame_impl.cc:1985:37
    #6 0x55d5a8f487e4 in content::RenderFrameImpl::FrameDetached(blink::DetachReason) content/renderer/render_frame_impl.cc:3788:3
    #7 0x55d5aaa5a7b9 in blink::LocalFrameClientImpl::Detached(blink::FrameDetachType) third_party/blink/renderer/core/frame/local_frame_client_impl.cc:381:11
    #8 0x55d5aa674e07 in blink::Frame::Detach(blink::FrameDetachType) third_party/blink/renderer/core/frame/frame.cc:172:12
    #9 0x55d5aa8dcb2c in blink::RemoteFrame::DetachChildren() third_party/blink/renderer/core/frame/remote_frame.cc:934:12
    #10 0x55d5aa8dbf6c in blink::RemoteFrame::DetachImpl(blink::FrameDetachType) third_party/blink/renderer/core/frame/remote_frame.cc:333:8
    #11 0x55d5aa674b2f in blink::Frame::Detach(blink::FrameDetachType) third_party/blink/renderer/core/frame/frame.cc:124:8
    #12 0x55d5aae17f7e in blink::HTMLFrameOwnerElement::DisconnectContentFrame() third_party/blink/renderer/core/html/html_frame_owner_element.cc:380:19
    #13 0x55d5aa79c086 in blink::ChildFrameDisconnector::DisconnectCollectedFrameOwners() third_party/blink/renderer/core/dom/child_frame_disconnector.cc:65:14
    #14 0x55d5add45637 in blink::ContainerNode::WillRemoveChild(blink::Node&) third_party/blink/renderer/core/dom/container_node.cc:871:10
    #15 0x55d5add4389c in blink::ContainerNode::RemoveChild(blink::Node*, blink::ExceptionState&) third_party/blink/renderer/core/dom/container_node.cc:996:3
    #16 0x55d5aeb89f16 in blink::(anonymous namespace)::v8_element::RemoveOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_element.cc:4487:17
    #17 0x55d58fd556e3 in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc
    #18 0x55d58fd53902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc
    #19 0x55d58fd5069b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc
    #20 0x55d58fd503ea in Builtins_JSEntry setup-isolate-deserialize.cc
    #21 0x55d58afa67ad in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12
    #22 0x55d58afa4e22 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) v8/src/execution/execution.cc:564:10
    #23 0x55d58ab53849 in v8::Function::Call(v8::Isolate*, v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) v8/src/api/api.cc:5603:27
    #24 0x55d5a926cdff in blink::V8ScriptRunner::CallFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:851:48
    #25 0x55d5ae90bec6 in blink::bindings::CallbackInvokeHelper<blink::CallbackInterfaceBase, (blink::bindings::CallbackInvokeHelperMode)0, (blink::bindings::CallbackReturnTypeIsPromise)0>::Call(int, v8::Local<v8::Value>*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:124:12
    #26 0x55d5ae93617a in blink::V8EventListener::InvokeWithoutRunnabilityCheck(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::Event*) gen/third_party/blink/renderer/bindings/core/v8/v8_event_listener.cc:119:13
    #27 0x55d5a9f53968 in blink::JSBasedEventListener::Invoke(blink::ExecutionContext*, blink::Event*) third_party/blink/renderer/bindings/core/v8/js_based_event_listener.cc:193:5
    #28 0x55d5a9f4145c in blink::EventTarget::FireEventListeners(blink::Event&, blink::EventTargetData*, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember<blink::RegisteredEventListener, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 1u>) third_party/blink/renderer/core/dom/events/event_target.cc:1082:15
    #29 0x55d5a9f3f170 in blink::EventTarget::FireEventListeners(blink::Event&) third_party/blink/renderer/core/dom/events/event_target.cc:983:29

previously allocated by thread T0 (chrome) here:
    #0 0x55d584e443fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e083fd) (BuildId: d8b46a5f0638292f)
    #1 0x55d59aa43127 in std::__Cr::unique_ptr<actor::ClickTool, std::__Cr::default_delete<actor::ClickTool>> std::__Cr::make_unique<actor::ClickTool, content::RenderFrame&, base::IdType<actor::TaskIdTag, int, 0, 1>&, actor::Journal&, mojo::InlinedStructPtr<actor::mojom::ClickAction>, mojo::StructPtr<actor::mojom::ToolTarget>, mojo::StructPtr<actor::mojom::ObservedToolTarget>, 0>(content::RenderFrame&, base::IdType<actor::TaskIdTag, int, 0, 1>&, actor::Journal&, mojo::InlinedStructPtr<actor::mojom::ClickAction>&&, mojo::StructPtr<actor::mojom::ToolTarget>&&, mojo::StructPtr<actor::mojom::ObservedToolTarget>&&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x55d59aa4220e in actor::ToolExecutor::InitializeToolImpl(mojo::StructPtr<actor::mojom::ToolInvocation>) chrome/renderer/actor/tool_executor.cc:92:15
    #3 0x55d59aa46cd6 in actor::ToolExecutor::InvokeTool(mojo::StructPtr<actor::mojom::ToolInvocation>, base::OnceCallback<void (mojo::StructPtr<actor::mojom::ActionResult>)>) chrome/renderer/actor/tool_executor.cc:226:7
    #4 0x55d5b70d48fc in ChromeRenderFrameObserver::InvokeTool(mojo::StructPtr<actor::mojom::ToolInvocation>, base::OnceCallback<void (mojo::StructPtr<actor::mojom::ActionResult>)>) chrome/renderer/chrome_render_frame_observer.cc:656:19
    #5 0x55d59641bcf4 in chrome::mojom::ChromeRenderFrameStubDispatch::AcceptWithResponder(chrome::mojom::ChromeRenderFrame*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_delete<mojo::MessageReceiverWithStatus>>) gen/chrome/common/chrome_render_frame.mojom.cc:3314:13
    #6 0x55d59cbba1b0 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56
    #7 0x55d59cbd7df3 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24
    #8 0x55d59cbc0513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #9 0x55d5a0ae07dd in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #10 0x55d5a0ae2c65 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #11 0x55d59cdfa326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #12 0x55d59ce719c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #13 0x55d59ce7083a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #14 0x55d59ccb8927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #15 0x55d59ce730d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #16 0x55d59cd74ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #17 0x55d5a90fe1fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #18 0x55d5989126ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #19 0x55d598913a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #20 0x55d598916728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #21 0x55d598910101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #22 0x55d5989106fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #23 0x55d584e45b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #24 0x7f2d5502b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/optional:447:96 in actor::ClickDispatcher::DoMouseDown(blink::mojom::Button, int, actor::ResolvedTarget const&)
Shadow bytes around the buggy address:
  0x7c5d5347e800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c5d5347e880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c5d5347e900: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x7c5d5347e980: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x7c5d5347ea00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7c5d5347ea80: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
  0x7c5d5347eb00: fd fd fd fd fd fd fd fd fa fa fa fa fa fa f7 fa
  0x7c5d5347eb80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c5d5347ec00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c5d5347ec80: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x7c5d5347ed00: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==1765==ADDITIONAL INFO

==1765==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55d59aa02bbc in actor::ClickDispatcher::ClickDispatcher(blink::mojom::Button, int, actor::ResolvedTarget const&, actor::ToolBase const&, base::OnceCallback<void (mojo::StructPtr<actor::mojom::ActionResult>)>) chrome/renderer/actor/click_dispatcher.cc:62:9
    #1 0x55d5a0ad9df7 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=1691 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --force-device-scale-factor=1 --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1777021730561480 --launch-time-ticks=30715636517 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,11088828027077313547,7254029450554969717,2097152 --field-trial-handle=3,i,13243894654313987687,4474927887525861882,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,16021397145431735793,6805494799155544787,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr --v=0`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==1765==END OF ADDITIONAL INFO

==1765==ABORTING