[1208:1208:0514/092435.443250:INFO:CONSOLE:8] "origin = https://a.test:8443", source: https://a.test:8443/poc.html (8) [1208:1208:0514/092435.460877:INFO:CONSOLE:8] "joined ig0", source: https://a.test:8443/poc.html (8) [1208:1208:0514/092435.480262:INFO:CONSOLE:8] "joined ig1", source: https://a.test:8443/poc.html (8) [1208:1208:0514/092435.482155:INFO:CONSOLE:8] "joined ig2", source: https://a.test:8443/poc.html (8) [1208:1208:0514/092435.482855:INFO:CONSOLE:8] "joined ig3", source: https://a.test:8443/poc.html (8) [1208:1208:0514/092435.483445:INFO:CONSOLE:8] "joined ig4", source: https://a.test:8443/poc.html (8) [1208:1208:0514/092435.484374:INFO:CONSOLE:8] "joined ig5", source: https://a.test:8443/poc.html (8) [1208:1208:0514/092435.484415:INFO:CONSOLE:8] "running auction", source: https://a.test:8443/poc.html (8) [1306:1306:0514/092435.513533:ERROR:content/services/auction_worklet/bidder_worklet.cc:638] POC worklet: sending priority_vector for ig0 value=nan [1306:1306:0514/092435.514396:ERROR:content/services/auction_worklet/bidder_worklet.cc:638] POC worklet: sending priority_vector for ig1 value=50 [1306:1306:0514/092435.514644:ERROR:content/services/auction_worklet/bidder_worklet.cc:638] POC worklet: sending priority_vector for ig2 value=nan [1306:1306:0514/092435.514928:ERROR:content/services/auction_worklet/bidder_worklet.cc:638] POC worklet: sending priority_vector for ig3 value=100 [1306:1306:0514/092435.515199:ERROR:content/services/auction_worklet/bidder_worklet.cc:638] POC worklet: sending priority_vector for ig4 value=40 [1306:1306:0514/092435.515644:ERROR:content/services/auction_worklet/bidder_worklet.cc:638] POC worklet: sending priority_vector for ig5 value=30 ================================================================= ==1208==ERROR: AddressSanitizer: container-overflow on address 0x759a8ddc8ee8 at pc 0x55f53636e788 bp 0x7ffdde826310 sp 0x7ffdde826308 READ of size 8 at 0x759a8ddc8ee8 thread T0 (chrome) #0 0x55f53636e787 in void std::__Cr::__introsort>*, false>(std::__Cr::unique_ptr>*, std::__Cr::unique_ptr>*, content::(anonymous namespace)::BidStatesDescByPriorityAndGroupByJoinOrigin&, std::__Cr::iterator_traits>*>::difference_type, bool) gen/third_party/libc++/src/include/__memory/unique_ptr.h:265:101 #1 0x55f536368a75 in content::InterestGroupAuction::BuyerHelper::ApplySizeLimitAndSort() gen/third_party/libc++/src/include/__algorithm/sort.h:872:3 #2 0x55f5363643db in content::InterestGroupAuction::BuyerHelper::OnBiddingSignalsReceivedInternal(content::InterestGroupAuction::BidState*, std::__Cr::optional, base::OnceCallback) content/browser/interest_group/interest_group_auction.cc:2604:5 #3 0x55f536388cf7 in content::InterestGroupAuction::BuyerHelper::OnBiddingSignalsReceived(base::flat_map, std::__Cr::allocator>, double, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, double>, std::__Cr::allocator, std::__Cr::allocator>, double>>>> const&, base::TimeDelta, std::__Cr::optional, base::OnceCallback) content/browser/interest_group/interest_group_auction.cc:1653:5 #4 0x55f538267d63 in auction_worklet::mojom::GenerateBidClientStubDispatch::AcceptWithResponder(auction_worklet::mojom::GenerateBidClient*, mojo::Message*, std::__Cr::unique_ptr>) gen/content/services/auction_worklet/public/mojom/bidder_worklet.mojom.cc:1340:13 #5 0x55f542e1aca7 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #6 0x55f542e387d3 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24 #7 0x55f542e20fb3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #8 0x55f542e487a8 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #9 0x55f542e46c88 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7 #10 0x55f542e388d1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #11 0x55f542e1180c in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase) mojo/public/cpp/bindings/lib/connector.cc:567:49 #12 0x55f542e12e90 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14 #13 0x55f542e139f0 in base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #14 0x55f542060b03 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #15 0x55f5420cfb2c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #16 0x55f5420ce9ca in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #17 0x55f54227ae68 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #18 0x55f54227e428 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 #19 0x793a90ae8718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d) 0x759a8ddc8ee8 is located 40 bytes inside of 64-byte region [0x759a8ddc8ec0,0x759a8ddc8f00) allocated by thread T0 (chrome) here: #0 0x55f529ecf59d in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2f59d) (BuildId: 2273d3be019a080c) #1 0x55f536389cb2 in std::__Cr::unique_ptr>* std::__Cr::vector>, std::__Cr::allocator>>>::__emplace_back_slow_path>>(std::__Cr::unique_ptr>&&) gen/third_party/libc++/src/include/__new/allocate.h:42:28 #2 0x55f5363878ad in content::InterestGroupAuction::BuyerHelper::BuyerHelper(content::InterestGroupAuction*, std::__Cr::vector>&&) gen/third_party/libc++/src/include/__vector/vector.h:1138:21 #3 0x55f53631ce8a in content::InterestGroupAuction::OnInterestGroupRead(scoped_refptr) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30 #4 0x55f53635dab5 in base::internal::Invoker), base::WeakPtr&&>, base::internal::BindState), base::WeakPtr>, void (scoped_refptr)>::RunOnce(base::internal::BindStateBase*, scoped_refptr&&) base/functional/bind_internal.h:740:12 #5 0x55f5363d02aa in base::OnceCallback)>::Run(scoped_refptr) && base/functional/callback.h:155:12 #6 0x55f536407805 in content::InterestGroupManagerImpl::OnGetInterestGroupsComplete(base::OnceCallback)>, std::__Cr::optional, std::__Cr::allocator>> const&, scoped_refptr) content/browser/interest_group/interest_group_manager_impl.cc:1019:23 #7 0x55f5364131be in void base::internal::Invoker)>, std::__Cr::optional, std::__Cr::allocator>> const&, scoped_refptr), base::WeakPtr&&, base::OnceCallback)>&&, std::__Cr::optional, std::__Cr::allocator>>&&>, base::internal::BindState)>, std::__Cr::optional, std::__Cr::allocator>> const&, scoped_refptr), base::WeakPtr, base::OnceCallback)>, std::__Cr::optional, std::__Cr::allocator>>>, void (scoped_refptr)>::RunImpl)>, std::__Cr::optional, std::__Cr::allocator>> const&, scoped_refptr), std::__Cr::tuple, base::OnceCallback)>, std::__Cr::optional, std::__Cr::allocator>>>, 0ul, 1ul, 2ul>(void (content::InterestGroupManagerImpl::*&&)(base::OnceCallback)>, std::__Cr::optional, std::__Cr::allocator>> const&, scoped_refptr), std::__Cr::tuple, base::OnceCallback)>, std::__Cr::optional, std::__Cr::allocator>>>&&, std::__Cr::integer_sequence, scoped_refptr&&) base/functional/bind_internal.h:740:12 #8 0x55f5363d02aa in base::OnceCallback)>::Run(scoped_refptr) && base/functional/callback.h:155:12 #9 0x55f5363b76a1 in content::InterestGroupCachingStorage::OnLoadInterestGroupsForOwner(url::Origin const&, unsigned int, std::__Cr::vector>) content/browser/interest_group/interest_group_caching_storage.cc:648:10 #10 0x55f5363d1d70 in void base::internal::Invoker>), base::WeakPtr&&, url::Origin&&, unsigned int&&>, base::internal::BindState>), base::WeakPtr, url::Origin, unsigned int>, void (std::__Cr::vector>)>::RunImpl>), std::__Cr::tuple, url::Origin, unsigned int>, 0ul, 1ul, 2ul>(void (content::InterestGroupCachingStorage::*&&)(url::Origin const&, unsigned int, std::__Cr::vector>), std::__Cr::tuple, url::Origin, unsigned int>&&, std::__Cr::integer_sequence, std::__Cr::vector>&&) base/functional/bind_internal.h:740:12 #11 0x55f5363e0032 in std::__Cr::__invoke_result_impl::type std::__Cr::__invoke>>, std::__Cr::vector>>(base::OnceCallback>)>, std::__Cr::unique_ptr>>, std::__Cr::default_delete>>>>*)::'lambda'(auto&&...), std::__Cr::vector>>(auto&&...) base/functional/callback.h:155:12 #12 0x55f5363df5cb in void base::internal::ReplyAdapter>>, std::__Cr::vector>>(base::OnceCallback>)>, std::__Cr::unique_ptr>>, std::__Cr::default_delete>>>>*) gen/third_party/libc++/src/include/tuple:1400:29 #13 0x55f5363dfc95 in base::internal::Invoker>)>, std::__Cr::unique_ptr>>, std::__Cr::default_delete>>>>*), base::OnceCallback>)>&&, std::__Cr::unique_ptr>>, std::__Cr::default_delete>>>>*>, base::internal::BindState>)>, std::__Cr::unique_ptr>>, std::__Cr::default_delete>>>>*), base::OnceCallback>)>, base::internal::OwnedWrapper>>, std::__Cr::default_delete>>>>, std::__Cr::default_delete>>, std::__Cr::default_delete>>>>>>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #14 0x55f5420ea90b in base::internal::PostTaskAndReplyRelay::RunReply(base::internal::PostTaskAndReplyRelay) base/functional/callback.h:155:12 #15 0x55f5420ea67e in base::internal::Invoker, base::internal::BindState, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #16 0x55f542060b03 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #17 0x55f5420cfb2c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #18 0x55f5420ce9ca in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #19 0x55f54227ae68 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #20 0x55f54227e428 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 #21 0x793a90ae8718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d) HINT: if you don't care about these errors you may set ASAN_OPTIONS=detect_container_overflow=0. Or if supported by the container library, pass -D__SANITIZER_DISABLE_CONTAINER_OVERFLOW__ to the compiler to disable instrumentation. If you suspect a false positive see also: https://github.com/google/sanitizers/wiki/AddressSanitizerContainerOverflow. SUMMARY: AddressSanitizer: container-overflow gen/third_party/libc++/src/include/__memory/unique_ptr.h:265:101 in void std::__Cr::__introsort>*, false>(std::__Cr::unique_ptr>*, std::__Cr::unique_ptr>*, content::(anonymous namespace)::BidStatesDescByPriorityAndGroupByJoinOrigin&, std::__Cr::iterator_traits>*>::difference_type, bool) Shadow bytes around the buggy address: 0x759a8ddc8c00: fa fa f7 fa 00 00 00 00 00 00 00 fa fa fa f7 fa 0x759a8ddc8c80: fd fd fd fd fd fd fd fd fa fa f7 fa fd fd fd fd 0x759a8ddc8d00: fd fd fd fd fa fa f7 fa 00 00 00 00 00 00 00 fa 0x759a8ddc8d80: fa fa f7 fa 00 00 00 00 00 00 00 fa fa fa f7 fa 0x759a8ddc8e00: 00 00 00 00 00 00 00 fa fa fa f7 fa 00 00 00 00 =>0x759a8ddc8e80: 00 00 00 03 fa fa f7 fa 00 00 fc fc fc[fc]fc fc 0x759a8ddc8f00: fa fa f7 fa 00 00 00 00 00 00 00 fa fa fa f7 fa 0x759a8ddc8f80: 00 00 00 00 00 00 00 fa fa fa f7 fa 00 00 00 00 0x759a8ddc9000: 00 00 00 fa fa fa f7 fa fd fd fd fd fd fd fd fd 0x759a8ddc9080: fa fa f7 fa 00 00 00 00 00 00 00 fa fa fa f7 fa 0x759a8ddc9100: 00 00 00 00 00 00 00 fa fa fa f7 fa 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1208==ADDITIONAL INFO ==1208==Note: Please include this section with the ASan report. Task trace: #0 0x55f542e135e8 in mojo::Connector::ScheduleDispatchOfPendingMessagesOrWaitForMore(unsigned long) mojo/public/cpp/bindings/lib/connector.cc:588:7 #1 0x55f542eb5183 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13 Command line: `/chromium/chromium/src/out/asan/chrome --no-first-run --no-default-browser-check --disable-gpu --headless=new --no-sandbox --user-data-dir=/tmp/chrome-poc-profile.se033j --ignore-certificate-errors --host-resolver-rules=MAP a.test 127.0.0.1 --enable-features=InterestGroupStorage,AdInterestGroupAPI,Fledge,PrivacySandboxAdsAPIsOverride,PrivacySandboxAdsAPIsM1Override,OverridePrivacySandboxSettingsLocalTesting --disable-features=FledgeEnforceKAnonymity,EnforcePrivacySandboxAttestations --privacy-sandbox-enrollment-overrides=https://a.test:8443 --enable-logging=stderr --v=0 --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl --flag-switches-begin --flag-switches-end https://a.test:8443/poc.html` ==1208==END OF ADDITIONAL INFO ==1208==ABORTING