==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c5010380eb0 at pc 0x55b87812fb0b bp 0x7ffe3e5499d0 sp 0x7ffe3e5499c8
READ of size 8 at 0x7c5010380eb0 thread T0 (chrome)
    #0 0x55b87812fb0a  in extensions::PostMessageSupport::SetActive() v8/include/v8-handle-base.h:90:62
    #1 0x55b8781291ce  in extensions::MimeHandlerViewContainerManager::DidLoad(int, GURL const&) extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container_manager.cc:229:22
    #2 0x55b8705fcbdb  in extensions::mojom::MimeHandlerViewContainerManagerStubDispatch::Accept(extensions::mojom::MimeHandlerViewContainerManager*, mojo::Message*) ./gen/extensions/common/mojom/guest_view.mojom.cc:1153:13
    #3 0x55b8791d6069  in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #4 0x55b8791f3df3  in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24
    #5 0x55b8791dc513  in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #6 0x55b87d0fc7dd  in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #7 0x55b87d0fec65  in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #8 0x55b879416326  in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #9 0x55b87948d9c9  in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #10 0x55b87948c83a  in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #11 0x55b8792d4927  in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #12 0x55b87948f0d7  in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #13 0x55b879390ca0  in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #14 0x55b88571a1fb  in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #15 0x55b874f2e6ef  in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #16 0x55b874f2fa1f  in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #17 0x55b874f32728  in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #18 0x55b874f2c101  in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #19 0x55b874f2c6fc  in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #20 0x55b861461b39  in ChromeMain chrome/app/chrome_main.cc:191:12
    #21 0x7ff01202b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7c5010380eb0 is located 16 bytes inside of 64-byte region [0x7c5010380ea0,0x7c5010380ee0)
freed by thread T0 (chrome) here:
    #0 0x55b861461002  in operator delete(void*, unsigned long) ??:0:0
    #1 0x55b87812dddd  in extensions::PostMessageSupport::Delegate::~Delegate() ./gen/third_party/libc++/src/include/__vector/vector.h:259:67
    #2 0x55b87812d473  in extensions::MimeHandlerViewFrameContainer::~MimeHandlerViewFrameContainer() extensions/renderer/guest_view/mime_handler_view/mime_handler_view_frame_container.cc:33:63
    #3 0x55b878127489  in extensions::MimeHandlerViewContainerManager::RemoveFrameContainer(extensions::MimeHandlerViewFrameContainer*, bool) ./gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #4 0x55b87812d908  in extensions::MimeHandlerViewFrameContainer::AreFramesValid() extensions/renderer/guest_view/mime_handler_view/mime_handler_view_frame_container.cc:0:0
    #5 0x55b87812d543  in extensions::MimeHandlerViewFrameContainer::GetTargetFrame() extensions/renderer/guest_view/mime_handler_view/mime_handler_view_frame_container.cc:40:8
    #6 0x55b87812e847  in extensions::PostMessageSupport::PostJavaScriptMessage(v8::Isolate*, v8::Local<v8::Value>) extensions/renderer/guest_view/mime_handler_view/post_message_support.cc:137:35
    #7 0x55b87812f7d3  in extensions::PostMessageSupport::SetActive() extensions/renderer/guest_view/mime_handler_view/post_message_support.cc:185:5
    #8 0x55b8781291ce  in extensions::MimeHandlerViewContainerManager::DidLoad(int, GURL const&) extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container_manager.cc:229:22
    #9 0x55b8705fcbdb  in extensions::mojom::MimeHandlerViewContainerManagerStubDispatch::Accept(extensions::mojom::MimeHandlerViewContainerManager*, mojo::Message*) ./gen/extensions/common/mojom/guest_view.mojom.cc:1153:13
    #10 0x55b8791d6069  in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #11 0x55b8791f3df3  in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24
    #12 0x55b8791dc513  in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #13 0x55b87d0fc7dd  in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #14 0x55b87d0fec65  in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #15 0x55b879416326  in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #16 0x55b87948d9c9  in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #17 0x55b87948c83a  in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #18 0x55b8792d4927  in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #19 0x55b87948f0d7  in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #20 0x55b879390ca0  in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #21 0x55b88571a1fb  in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #22 0x55b874f2e6ef  in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #23 0x55b874f2fa1f  in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #24 0x55b874f32728  in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #25 0x55b874f2c101  in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #26 0x55b874f2c6fc  in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #27 0x55b861461b39  in ChromeMain chrome/app/chrome_main.cc:191:12
    #28 0x7ff01202b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 (chrome) here:
    #0 0x55b8614603fd  in operator new(unsigned long) ??:0:0
    #1 0x55b878131ff0  in v8::Global<v8::Value>* std::__Cr::vector<v8::Global<v8::Value>, std::__Cr::allocator<v8::Global<v8::Value>>>::__emplace_back_slow_path<v8::Global<v8::Value>>(v8::Global<v8::Value>&&) ./gen/third_party/libc++/src/include/__new/allocate.h:43:28
    #2 0x55b87812edbc  in extensions::PostMessageSupport::PostJavaScriptMessage(v8::Isolate*, v8::Local<v8::Value>) ./gen/third_party/libc++/src/include/__vector/vector.h:1148:21
    #3 0x55b878131b7a  in void base::internal::Invoker<base::internal::FunctorTraits<void (extensions::PostMessageSupport::* const&)(v8::Isolate*, v8::Local<v8::Value>), base::WeakPtr<extensions::PostMessageSupport> const&, v8::Isolate* const&>, base::internal::BindState<true, true, false, void (extensions::PostMessageSupport::*)(v8::Isolate*, v8::Local<v8::Value>), base::WeakPtr<extensions::PostMessageSupport>, base::internal::UnretainedWrapper<v8::Isolate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (v8::Local<v8::Value>)>::RunImpl<void (extensions::PostMessageSupport::* const&)(v8::Isolate*, v8::Local<v8::Value>), std::__Cr::tuple<base::WeakPtr<extensions::PostMessageSupport>, base::internal::UnretainedWrapper<v8::Isolate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>> const&, 0ul, 1ul>(void (extensions::PostMessageSupport::* const&)(v8::Isolate*, v8::Local<v8::Value>), std::__Cr::tuple<base::WeakPtr<extensions::PostMessageSupport>, base::internal::UnretainedWrapper<v8::Isolate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>> const&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>, v8::Local<v8::Value>&&) base/functional/bind_internal.h:740:12
    #4 0x55b8781315bd  in base::RepeatingCallback<void (v8::Local<v8::Value>)>::Run(v8::Local<v8::Value>) const & base/functional/callback.h:346:12
    #5 0x55b878130e6a  in gin::internal::Dispatcher<void (v8::Local<v8::Value>)>::DispatchToCallbackImpl(gin::Arguments*) gin/function_template.h:232:14
    #6 0x55b878130b51  in gin::internal::Dispatcher<void (v8::Local<v8::Value>)>::DispatchToCallback(v8::FunctionCallbackInfo<v8::Value> const&) gin/function_template.h:270:5
    #7 0x55b86c3716e3  in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc:0:0
    #8 0x55b86c36f902  in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc:0:0
    #9 0x55b86c36c69b  in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc:0:0
    #10 0x55b86c36c3ea  in Builtins_JSEntry setup-isolate-deserialize.cc:0:0
    #11 0x55b8675c27ad  in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12
    #12 0x55b8675c0e22  in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) v8/src/execution/execution.cc:564:10
    #13 0x55b86716f849  in v8::Function::Call(v8::Isolate*, v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) v8/src/api/api.cc:5603:27
    #14 0x55b885888dff  in blink::V8ScriptRunner::CallFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:851:48
    #15 0x55b88af252d6  in blink::bindings::CallbackInvokeHelper<blink::CallbackFunctionWithTaskAttributionBase, (blink::bindings::CallbackInvokeHelperMode)0, (blink::bindings::CallbackReturnTypeIsPromise)0>::Call(int, v8::Local<v8::Value>*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:124:12
    #16 0x55b88af37736  in blink::V8FrameRequestCallback::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, double) ./gen/third_party/blink/renderer/bindings/core/v8/v8_frame_request_callback.cc:62:13
    #17 0x55b88af38037  in blink::V8FrameRequestCallback::InvokeAndReportException(blink::bindings::V8ValueOrScriptWrappableAdapter, double) ./gen/third_party/blink/renderer/bindings/core/v8/v8_frame_request_callback.cc:111:15
    #18 0x55b886d2cc2e  in blink::FrameRequestCallbackCollection::ExecuteFrameCallbacks(double, double) third_party/blink/renderer/core/dom/frame_request_callback_collection.cc:0:0
    #19 0x55b888a8c345  in blink::PageAnimator::ServiceScriptedAnimations(base::TimeTicks, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, std::__Cr::pair<cppgc::internal::BasicMember<blink::ScriptedAnimationController, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, bool>, 0u> const&) third_party/blink/renderer/core/page/page_animator.cc:292:28
    #20 0x55b888a88ce0  in blink::PageAnimator::ServiceScriptedAnimations(base::TimeTicks) third_party/blink/renderer/core/page/page_animator.cc:110:3
    #21 0x55b888a76ff7  in blink::Page::Animate(base::TimeTicks) third_party/blink/renderer/core/page/page.cc:1545:14
    #22 0x55b886fa1966  in blink::WebFrameWidgetImpl::BeginMainFrame(viz::BeginFrameArgs const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:2665:14
    #23 0x55b88a003b94  in blink::WidgetBase::BeginMainFrame(viz::BeginFrameArgs const&) third_party/blink/renderer/platform/widget/widget_base.cc:1068:12
    #24 0x55b87f23bf09  in cc::ProxyMain::BeginMainFrame(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState, std::__Cr::default_delete<cc::BeginMainFrameAndCommitState>>) cc/trees/proxy_main.cc:318:21
    #25 0x55b87f264775  in base::internal::Invoker<base::internal::FunctorTraits<void (cc::ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState, std::__Cr::default_delete<cc::BeginMainFrameAndCommitState>>), base::WeakPtr<cc::ProxyMain>&&, std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState, std::__Cr::default_delete<cc::BeginMainFrameAndCommitState>>&&>, base::internal::BindState<true, true, false, void (cc::ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState, std::__Cr::default_delete<cc::BeginMainFrameAndCommitState>>), base::WeakPtr<cc::ProxyMain>, std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState, std::__Cr::default_delete<cc::BeginMainFrameAndCommitState>>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #26 0x55b879416326  in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #27 0x55b87948d9c9  in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #28 0x55b87948c83a  in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #29 0x55b8792d4927  in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55

SUMMARY: AddressSanitizer: heap-use-after-free (/chromium/chromium/src/out/asan/chrome+0x27ad7b0a) (BuildId: 0440b075dbd4a9a3) 
Shadow bytes around the buggy address:
  0x7c5010380c00: fd fd fd fd fd fd fd fd fa fa f7 fa fd fd fd fd
  0x7c5010380c80: fd fd fd fd fa fa f7 fa 00 00 00 00 00 00 00 06
  0x7c5010380d00: fa fa f7 fa 00 00 00 00 00 00 00 06 fa fa f7 fa
  0x7c5010380d80: fd fd fd fd fd fd fd fd fa fa f7 fa fd fd fd fd
  0x7c5010380e00: fd fd fd fa fa fa f7 fa fd fd fd fd fd fd fd fd
=>0x7c5010380e80: fa fa f7 fa fd fd[fd]fd fd fd fd fd fa fa f7 fa
  0x7c5010380f00: fd fd fd fd fd fd fd fd fa fa f7 fa 00 00 00 00
  0x7c5010380f80: 00 00 00 06 fa fa f7 fa fd fd fd fd fd fd fd fd
  0x7c5010381000: fa fa f7 fa fd fd fd fd fd fd fd fa fa fa f7 fa
  0x7c5010381080: fd fd fd fd fd fd fd fd fa fa f7 fa 00 00 00 00
  0x7c5010381100: 00 00 00 fa fa fa f7 fa 00 00 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==1==ADDITIONAL INFO

==1==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55b87d0f5df7  in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=552 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1777060546432874 --launch-time-ticks=71840480850 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,10674372436292737415,7416356046012831466,2097152 --field-trial-handle=3,i,2885471610012503214,5634478096227850562,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,5967056084973765104,16947009329258727013,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr --v=0`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==1==END OF ADDITIONAL INFO

==1==ABORTING