[4355:4370:0514/161024.881854:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [4355:4370:0514/161024.892994:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [4355:4370:0514/161024.893219:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [4355:4370:0514/161024.893289:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [4355:4370:0514/161024.893348:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [4355:4370:0514/161025.041058:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [4387:4387:0514/161025.050201:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1587] drmGetDevices2() has not found any devices [4387:4387:0514/161025.054637:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [4355:4355:0514/161025.151706:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured. [4355:4370:0514/161025.161247:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [4355:4355:0514/161025.208181:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [4355:4355:0514/161025.208307:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [4355:4355:0514/161025.208357:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [4355:4370:0514/161025.208469:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [4355:4370:0514/161025.208558:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [4355:4355:0514/161025.209224:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [4355:4355:0514/161025.219308:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [4355:4370:0514/161025.222658:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [4355:4370:0514/161025.222751:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [4355:4355:0514/161025.222852:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [4355:4355:0514/161025.224240:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [4355:4370:0514/161025.224383:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [4355:4355:0514/161025.227567:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [4355:4355:0514/161025.227627:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [4355:4355:0514/161025.227638:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [4355:4355:0514/161025.228342:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [4355:4370:0514/161025.228445:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [4355:4355:0514/161025.229699:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [4355:4370:0514/161025.229788:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [4355:4355:0514/161025.231290:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [4355:4355:0514/161025.231321:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. (poc.html:4355): dbind-WARNING **: 16:10:25.262: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory [4445:4472:0514/161029.856778:INFO:third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc:937] Running WebRTC with a combined Network and Worker thread. [4355:4355:0514/161029.860433:INFO:CONSOLE:28] "[POC] [4.5s] L=16000000 K=136 (target refs=4352000273, wraps to 57032977)", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161029.872079:INFO:CONSOLE:28] "[POC] [4.5s] Generating ECDSA P-256 certificate...", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161029.899689:INFO:CONSOLE:28] "[POC] [4.5s] Certificate generated.", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161029.935247:INFO:CONSOLE:28] "[POC] [4.5s] Creating 136 RTCPeerConnections (each holds 2 vectors of 16000000 scoped_refptr)...", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161113.830085:INFO:CONSOLE:28] "[POC] [48.4s] 5/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4370:0514/161130.079648:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT [4355:4355:0514/161149.070578:INFO:CONSOLE:28] "[POC] [83.7s] 10/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4370:0514/161156.938924:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT [4355:4355:0514/161224.260398:INFO:CONSOLE:28] "[POC] [118.9s] 15/136 PCs", source: http://127.0.0.1:8080/poc.html (28) Warning: vkCreateInstance: Found no drivers! Warning: vkCreateInstance failed with VK_ERROR_INCOMPATIBLE_DRIVER at CheckVkSuccessImpl (../../third_party/dawn/src/dawn/native/vulkan/VulkanError.cpp:106) Warning: Couldn't get proc eglChooseConfig - While trying to discover a BackendType::OpenGLES adapter. at LoadClientProcs (../../third_party/dawn/src/dawn/native/opengl/EGLFunctions.cpp:119) [4355:4370:0514/161240.915204:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: QUOTA_EXCEEDED [4355:4355:0514/161259.904243:INFO:CONSOLE:28] "[POC] [154.5s] 20/136 PCs", source: http://127.0.0.1:8080/poc.html (28) Warning: vkCreateInstance: Found no drivers! Warning: vkCreateInstance failed with VK_ERROR_INCOMPATIBLE_DRIVER at CheckVkSuccessImpl (../../third_party/dawn/src/dawn/native/vulkan/VulkanError.cpp:106) [4355:4355:0514/161334.135166:INFO:CONSOLE:28] "[POC] [188.7s] 25/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161407.966188:INFO:CONSOLE:28] "[POC] [222.6s] 30/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161443.210940:INFO:CONSOLE:28] "[POC] [257.8s] 35/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161518.123848:INFO:CONSOLE:28] "[POC] [292.7s] 40/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161552.484003:INFO:CONSOLE:28] "[POC] [327.1s] 45/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161626.835685:INFO:CONSOLE:28] "[POC] [361.4s] 50/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161701.306649:INFO:CONSOLE:28] "[POC] [395.9s] 55/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161735.186810:INFO:CONSOLE:28] "[POC] [429.8s] 60/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161808.834175:INFO:CONSOLE:28] "[POC] [463.4s] 65/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161843.136398:INFO:CONSOLE:28] "[POC] [497.7s] 70/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161918.810920:INFO:CONSOLE:28] "[POC] [533.4s] 75/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/161952.576463:INFO:CONSOLE:28] "[POC] [567.2s] 80/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/162025.997645:INFO:CONSOLE:28] "[POC] [600.6s] 85/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/162100.224271:INFO:CONSOLE:28] "[POC] [634.8s] 90/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/162134.949770:INFO:CONSOLE:28] "[POC] [669.6s] 95/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/162208.929236:INFO:CONSOLE:28] "[POC] [703.5s] 100/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/162242.550983:INFO:CONSOLE:28] "[POC] [737.2s] 105/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/162317.514780:INFO:CONSOLE:28] "[POC] [772.1s] 110/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/162353.662275:INFO:CONSOLE:28] "[POC] [808.3s] 115/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/162428.864428:INFO:CONSOLE:28] "[POC] [843.5s] 120/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/162504.239372:INFO:CONSOLE:28] "[POC] [878.8s] 125/136 PCs", source: http://127.0.0.1:8080/poc.html (28) [4355:4355:0514/162539.057995:INFO:CONSOLE:28] "[POC] [913.7s] 130/136 PCs", source: http://127.0.0.1:8080/poc.html (28) ================================================================= ==4445==ERROR: AddressSanitizer: heap-use-after-free on address 0x73e568629270 at pc 0x62515151878c bp 0x726ccced45f0 sp 0x726ccced45e8 WRITE of size 4 at 0x73e568629270 thread T11 (WebRTC_Signalin) #0 0x62515151878b in std::__Cr::vector, std::__Cr::allocator>>::clear() gen/third_party/libc++/src/include/__atomic/support/c11.h:207:10 #1 0x625151514a06 in webrtc::PeerConnectionInterface::RTCConfiguration::~RTCConfiguration() gen/third_party/libc++/src/include/__vector/vector.h:247:16 #2 0x625151e8136b in webrtc::RTCStatsCollector::RTCStatsCollector(webrtc::PeerConnectionInternal*, webrtc::Environment const&, long) third_party/webrtc/pc/rtc_stats_collector.cc:1236:11 #3 0x625151ced913 in webrtc::PeerConnection::PeerConnection(webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::Environment const&, webrtc::scoped_refptr, webrtc::PeerConnectionFactoryInterface::Options const&, bool, std::__Cr::unique_ptr>, webrtc::PeerConnectionDependencies&, std::__Cr::set, std::__Cr::allocator> const&, std::__Cr::vector> const&, bool) third_party/webrtc/pc/peer_connection.cc:488:7 #4 0x625151d1e368 in webrtc::RefCountedObject::RefCountedObject&, webrtc::PeerConnectionFactoryInterface::Options const&, bool&, std::__Cr::unique_ptr>, webrtc::PeerConnectionDependencies&, std::__Cr::set, std::__Cr::allocator> const&, std::__Cr::vector> const&, bool&>(webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::Environment const&, webrtc::scoped_refptr&, webrtc::PeerConnectionFactoryInterface::Options const&, bool&, std::__Cr::unique_ptr>&&, webrtc::PeerConnectionDependencies&, std::__Cr::set, std::__Cr::allocator> const&, std::__Cr::vector> const&, bool&) third_party/webrtc/rtc_base/ref_counted_object.h:33:9 #5 0x625151cecf34 in webrtc::PeerConnection::Create(webrtc::Environment const&, webrtc::scoped_refptr, webrtc::PeerConnectionFactoryInterface::Options const&, std::__Cr::unique_ptr>, webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::PeerConnectionDependencies&, std::__Cr::set, std::__Cr::allocator> const&, std::__Cr::vector> const&) third_party/webrtc/api/make_ref_counted.h:90:31 #6 0x625151b73d62 in webrtc::PeerConnectionFactory::CreatePeerConnectionOrError(webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::PeerConnectionDependencies) third_party/webrtc/pc/peer_connection_factory.cc:310:13 #7 0x625151b6c005 in void webrtc::ReturnType>>::Invoke> (webrtc::PeerConnectionFactoryInterface::*)(webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::PeerConnectionDependencies), webrtc::PeerConnectionInterface::RTCConfiguration const, webrtc::PeerConnectionDependencies>(webrtc::PeerConnectionFactoryInterface*, webrtc::RTCErrorOr> (webrtc::PeerConnectionFactoryInterface::*)(webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::PeerConnectionDependencies), webrtc::PeerConnectionInterface::RTCConfiguration const&&, webrtc::PeerConnectionDependencies&&) third_party/webrtc/pc/proxy.h:80:10 #8 0x625151b6c452 in void absl::internal_any_invocable::LocalInvoker>, webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::PeerConnectionDependencies>::Marshal(webrtc::Thread*)::'lambda'()&&>(absl::internal_any_invocable::TypeErasedState*) third_party/webrtc/pc/proxy.h:125:8 #9 0x625135c60b39 in webrtc::ThreadWrapper::RunTaskQueueTask(absl::AnyInvocable) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:774:1 #10 0x625135c63478 in void base::internal::Invoker), base::WeakPtr&&, absl::AnyInvocable&&>, base::internal::BindState), base::WeakPtr, absl::AnyInvocable>, void ()>::RunImpl), std::__Cr::tuple, absl::AnyInvocable>, 0ul, 1ul>(void (webrtc::ThreadWrapper::*&&)(absl::AnyInvocable), std::__Cr::tuple, absl::AnyInvocable>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:740:12 #11 0x62513cfbb4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #12 0x62513d02a4ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #13 0x62513d02938a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #14 0x62513ce7c6e2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #15 0x62513d02bbd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #16 0x62513cf36b70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #17 0x62513d0b852c in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13 #18 0x62513d0b8a6f in base::Thread::ThreadMain() base/threading/thread.cc:426:3 #19 0x62513d11f08e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #20 0x625124deef16 in asan_thread_start(void*) asan_interceptors.cpp 0x73e568629270 is located 0 bytes inside of 16-byte region [0x73e568629270,0x73e568629280) freed by thread T11 (WebRTC_Signalin) here: #0 0x625124e2b1a2 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2f1a2) (BuildId: e3c3958ddee81f4f) #1 0x625151518730 in std::__Cr::vector, std::__Cr::allocator>>::clear() third_party/webrtc/api/ref_counted_base.h:81:7 #2 0x625151514a06 in webrtc::PeerConnectionInterface::RTCConfiguration::~RTCConfiguration() gen/third_party/libc++/src/include/__vector/vector.h:247:16 #3 0x625151e8136b in webrtc::RTCStatsCollector::RTCStatsCollector(webrtc::PeerConnectionInternal*, webrtc::Environment const&, long) third_party/webrtc/pc/rtc_stats_collector.cc:1236:11 #4 0x625151ced913 in webrtc::PeerConnection::PeerConnection(webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::Environment const&, webrtc::scoped_refptr, webrtc::PeerConnectionFactoryInterface::Options const&, bool, std::__Cr::unique_ptr>, webrtc::PeerConnectionDependencies&, std::__Cr::set, std::__Cr::allocator> const&, std::__Cr::vector> const&, bool) third_party/webrtc/pc/peer_connection.cc:488:7 #5 0x625151d1e368 in webrtc::RefCountedObject::RefCountedObject&, webrtc::PeerConnectionFactoryInterface::Options const&, bool&, std::__Cr::unique_ptr>, webrtc::PeerConnectionDependencies&, std::__Cr::set, std::__Cr::allocator> const&, std::__Cr::vector> const&, bool&>(webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::Environment const&, webrtc::scoped_refptr&, webrtc::PeerConnectionFactoryInterface::Options const&, bool&, std::__Cr::unique_ptr>&&, webrtc::PeerConnectionDependencies&, std::__Cr::set, std::__Cr::allocator> const&, std::__Cr::vector> const&, bool&) third_party/webrtc/rtc_base/ref_counted_object.h:33:9 #6 0x625151cecf34 in webrtc::PeerConnection::Create(webrtc::Environment const&, webrtc::scoped_refptr, webrtc::PeerConnectionFactoryInterface::Options const&, std::__Cr::unique_ptr>, webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::PeerConnectionDependencies&, std::__Cr::set, std::__Cr::allocator> const&, std::__Cr::vector> const&) third_party/webrtc/api/make_ref_counted.h:90:31 #7 0x625151b73d62 in webrtc::PeerConnectionFactory::CreatePeerConnectionOrError(webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::PeerConnectionDependencies) third_party/webrtc/pc/peer_connection_factory.cc:310:13 #8 0x625151b6c005 in void webrtc::ReturnType>>::Invoke> (webrtc::PeerConnectionFactoryInterface::*)(webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::PeerConnectionDependencies), webrtc::PeerConnectionInterface::RTCConfiguration const, webrtc::PeerConnectionDependencies>(webrtc::PeerConnectionFactoryInterface*, webrtc::RTCErrorOr> (webrtc::PeerConnectionFactoryInterface::*)(webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::PeerConnectionDependencies), webrtc::PeerConnectionInterface::RTCConfiguration const&&, webrtc::PeerConnectionDependencies&&) third_party/webrtc/pc/proxy.h:80:10 #9 0x625151b6c452 in void absl::internal_any_invocable::LocalInvoker>, webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::PeerConnectionDependencies>::Marshal(webrtc::Thread*)::'lambda'()&&>(absl::internal_any_invocable::TypeErasedState*) third_party/webrtc/pc/proxy.h:125:8 #10 0x625135c60b39 in webrtc::ThreadWrapper::RunTaskQueueTask(absl::AnyInvocable) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:774:1 #11 0x625135c63478 in void base::internal::Invoker), base::WeakPtr&&, absl::AnyInvocable&&>, base::internal::BindState), base::WeakPtr, absl::AnyInvocable>, void ()>::RunImpl), std::__Cr::tuple, absl::AnyInvocable>, 0ul, 1ul>(void (webrtc::ThreadWrapper::*&&)(absl::AnyInvocable), std::__Cr::tuple, absl::AnyInvocable>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:740:12 #12 0x62513cfbb4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #13 0x62513d02a4ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #14 0x62513d02938a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #15 0x62513ce7c6e2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #16 0x62513d02bbd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #17 0x62513cf36b70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #18 0x62513d0b852c in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13 #19 0x62513d0b8a6f in base::Thread::ThreadMain() base/threading/thread.cc:426:3 #20 0x62513d11f08e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #21 0x625124deef16 in asan_thread_start(void*) asan_interceptors.cpp previously allocated by thread T12 (WebRTC_W_and_N) here: #0 0x625124e2a59d in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2e59d) (BuildId: e3c3958ddee81f4f) #1 0x62514f609a1c in webrtc::RTCCertificate::Create(std::__Cr::unique_ptr>) third_party/webrtc/rtc_base/rtc_certificate.cc:28:40 #2 0x625151c8c473 in webrtc::RTCCertificateGenerator::GenerateCertificate(webrtc::KeyParams const&, std::__Cr::optional const&) third_party/webrtc/rtc_base/rtc_certificate_generator.cc:63:10 #3 0x62515205c7d2 in blink::(anonymous namespace)::RTCCertificateGeneratorRequest::GenerateCertificateOnWorkerThread(webrtc::KeyParams, std::__Cr::optional, blink::CrossThreadOnceFunction)>) third_party/blink/renderer/modules/peerconnection/rtc_certificate_generator.cc:67:9 #4 0x62515205d19e in base::internal::Invoker, blink::CrossThreadOnceFunction)>), blink::(anonymous namespace)::RTCCertificateGeneratorRequest*, webrtc::KeyParams&&, std::__Cr::optional&&, blink::CrossThreadOnceFunction)>&&>, base::internal::BindState, blink::CrossThreadOnceFunction)>), blink::RetainedRefWrapper, webrtc::KeyParams, std::__Cr::optional, blink::CrossThreadOnceFunction)>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #5 0x62513cfbb4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #6 0x62513d02a4ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #7 0x62513d02938a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #8 0x62513ce7c6e2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #9 0x62513d02bbd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #10 0x62513cf36b70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #11 0x62513d0b852c in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13 #12 0x62513d0b8a6f in base::Thread::ThreadMain() base/threading/thread.cc:426:3 #13 0x62513d11f08e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #14 0x625124deef16 in asan_thread_start(void*) asan_interceptors.cpp Thread T11 (WebRTC_Signalin) created by T0 (chrome) here: #0 0x625124dd4d91 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10dd8d91) (BuildId: e3c3958ddee81f4f) #1 0x62513d11e6e2 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x62513d0b75bc in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:232:26 #3 0x6251512ebf5a in blink::PeerConnectionDependencyFactory::CreatePeerConnectionFactory() third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc:427:32 #4 0x6251512ebaba in blink::PeerConnectionDependencyFactory::GetPcFactory() third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc:734:5 #5 0x62515205a7f3 in blink::(anonymous namespace)::GenerateCertificateWithOptionalExpiration(webrtc::KeyParams const&, std::__Cr::optional const&, blink::CrossThreadOnceFunction)>, blink::ExecutionContext&, scoped_refptr) third_party/blink/renderer/modules/peerconnection/rtc_certificate_generator.cc:109:25 #6 0x62515205a42e in blink::RTCCertificateGenerator::GenerateCertificate(webrtc::KeyParams const&, blink::CrossThreadOnceFunction)>, blink::ExecutionContext&, scoped_refptr) third_party/blink/renderer/modules/peerconnection/rtc_certificate_generator.cc:125:3 #7 0x6251520bcc47 in blink::RTCPeerConnection::generateCertificate(blink::ScriptState*, blink::V8UnionObjectOrString const*, blink::ExceptionState&) third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc:1508:28 #8 0x62514f9df7bf in blink::(anonymous namespace)::v8_rtc_peer_connection::GenerateCertificateStaticOperationCallback(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_rtc_peer_connection.cc:1694:23 #9 0x62512fd086d3 in Builtins_CallApiCallbackGeneric crtstuff.c #10 0x62512fd06956 in Builtins_InterpreterEntryTrampoline crtstuff.c #11 0x62512fd06956 in Builtins_InterpreterEntryTrampoline crtstuff.c #12 0x62512fd036db in Builtins_JSEntryTrampoline crtstuff.c #13 0x62512fd0342a in Builtins_JSEntry crtstuff.c #14 0x62512b0554d1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22 #15 0x62512b057e32 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::internal::DirectHandle) v8/src/execution/execution.cc:575:10 #16 0x62512ac6cae3 in v8::Script::Run(v8::Local, v8::Local) v8/src/api/api.cc:2042:7 #17 0x6251497324ad in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local, v8::Local, blink::ExecutionContext*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:509:22 #18 0x625149733e46 in blink::V8ScriptRunner::CompileAndRunScript(blink::ScriptState*, blink::ClassicScript*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:633:22 #19 0x62514ce10012 in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/core/script/classic_script.cc:227:10 #20 0x62514ce72be7 in blink::Script::RunScriptOnScriptState(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/core/script/script.cc:35:17 #21 0x62514ce7301b in blink::Script::RunScript(blink::LocalDOMWindow*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/core/script/script.cc:42:3 #22 0x62514ce9f066 in blink::PendingScript::ExecuteScriptBlockInternal(blink::Script*, blink::ScriptElementBase*, bool, bool, bool, base::TimeTicks, bool) third_party/blink/renderer/core/script/pending_script.cc:312:13 #23 0x62514ce9dfd6 in blink::PendingScript::ExecuteScriptBlock() third_party/blink/renderer/core/script/pending_script.cc:209:3 #24 0x62514ce7972a in blink::ScriptLoader::PrepareScript(blink::ScriptLoader::ParserBlockingInlineOption, blink::TextPosition const&) third_party/blink/renderer/core/script/script_loader.cc:1179:60 #25 0x62514e67ffbf in blink::HTMLParserScriptRunner::ProcessScriptElementInternal(blink::Element*, blink::TextPosition const&) third_party/blink/renderer/core/script/html_parser_script_runner.cc:587:52 #26 0x62514e67f766 in blink::HTMLParserScriptRunner::ProcessScriptElement(blink::Element*, blink::TextPosition const&) third_party/blink/renderer/core/script/html_parser_script_runner.cc:297:3 #27 0x62514e658f3c in blink::HTMLDocumentParser::RunScriptsForPausedTreeBuilder() third_party/blink/renderer/core/html/parser/html_document_parser.cc:672:21 #28 0x62514e65539d in blink::HTMLDocumentParser::PumpTokenizer() third_party/blink/renderer/core/html/parser/html_document_parser.h:232:7 #29 0x62514e65384d in blink::HTMLDocumentParser::PumpTokenizerIfPossible() third_party/blink/renderer/core/html/parser/html_document_parser.cc:635:15 #30 0x62514e662114 in blink::HTMLDocumentParser::FinishAppend() third_party/blink/renderer/core/html/parser/html_document_parser.cc:1038:5 #31 0x62514e66288a in blink::HTMLDocumentParser::CommitPreloadedData() third_party/blink/renderer/core/html/parser/html_document_parser.cc:1053:5 #32 0x62514c548452 in blink::DocumentLoader::StartLoadingResponse() third_party/blink/renderer/core/loader/document_loader.cc:2169:14 #33 0x62514c558cb8 in blink::DocumentLoader::CommitNavigation() third_party/blink/renderer/core/loader/document_loader.cc:3256:3 #34 0x62514c5cecce in blink::FrameLoader::CommitDocumentLoader(blink::DocumentLoader*, blink::HistoryItem*, blink::CommitReason) third_party/blink/renderer/core/loader/frame_loader.cc:1498:21 #35 0x62514c5daf7f in blink::FrameLoader::CommitNavigation(std::__Cr::unique_ptr>, std::__Cr::unique_ptr>, blink::CommitReason) third_party/blink/renderer/core/loader/frame_loader.cc:1310:3 #36 0x62514af02928 in blink::WebLocalFrameImpl::CommitNavigation(std::__Cr::unique_ptr>, std::__Cr::unique_ptr>) third_party/blink/renderer/core/frame/web_local_frame_impl.cc:2840:24 #37 0x6251493f99ad in content::RenderFrameImpl::CommitNavigationWithParams(mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>) content/renderer/render_frame_impl.cc:2974:11 #38 0x62514945dc52 in void base::internal::DecayedFunctorTraits, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>), base::WeakPtr&&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&, std::__Cr::optional, std::__Cr::allocator>>>&&, mojo::StructPtr&&, mojo::StructPtr&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::PendingAssociatedRemote&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&>::Invoke, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>), base::WeakPtr const&, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>>(void (content::RenderFrameImpl::*)(mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>), base::WeakPtr const&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&, std::__Cr::optional, std::__Cr::allocator>>>&&, mojo::StructPtr&&, mojo::StructPtr&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::PendingAssociatedRemote&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:740:12 #39 0x62514945d70b in base::internal::Invoker, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>), base::WeakPtr&&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&, std::__Cr::optional, std::__Cr::allocator>>>&&, mojo::StructPtr&&, mojo::StructPtr&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::PendingAssociatedRemote&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&>, base::internal::BindState, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>), base::WeakPtr, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>>, void (std::__Cr::unique_ptr>)>::RunOnce(base::internal::BindStateBase*, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:956:5 #40 0x6251493faa9b in base::OnceCallback>)>::Run(std::__Cr::unique_ptr>) && base/functional/callback.h:155:12 #41 0x6251493f4615 in content::RenderFrameImpl::CommitNavigation(mojo::StructPtr, mojo::StructPtr, mojo::StructPtr, mojo::ScopedHandleBase, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, base::TokenType const&, base::UnguessableToken const&, base::Uuid const&, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, base::OnceCallback, mojo::StructPtr)>) content/renderer/render_frame_impl.cc:2832:33 #42 0x6251494da820 in content::NavigationClient::CommitNavigation(mojo::StructPtr, mojo::StructPtr, mojo::StructPtr, mojo::ScopedHandleBase, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, base::TokenType const&, base::UnguessableToken const&, base::Uuid const&, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, base::OnceCallback, mojo::StructPtr)>) content/renderer/navigation_client.cc:87:18 #43 0x62512aae4f72 in content::mojom::NavigationClientStubDispatch::AcceptWithResponder(content::mojom::NavigationClient*, mojo::Message*, std::__Cr::unique_ptr>) gen/content/common/navigation_client.mojom.cc:1743:13 #44 0x62513dd75667 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #45 0x62513dd93291 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #46 0x62513dd7b973 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #47 0x625140e8f833 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24 #48 0x625140e91cb5 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #49 0x62513cfbb4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #50 0x62513d02a4ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #51 0x62513d02938a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #52 0x62513ce7c6e2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #53 0x62513d02bbd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #54 0x62513cf36b70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #55 0x6251495c7043 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16 #56 0x6251397b7d29 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14 #57 0x6251397b8fdb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12 #58 0x6251397bbe55 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10 #59 0x6251397b5788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #60 0x6251397b5d8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #61 0x625124e2c266 in ChromeMain chrome/app/chrome_main.cc:194:12 #62 0x77c56a42b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) Thread T12 (WebRTC_W_and_N) created by T0 (chrome) here: #0 0x625124dd4d91 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10dd8d91) (BuildId: e3c3958ddee81f4f) #1 0x62513d11e6e2 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x62513d0b75bc in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:232:26 #3 0x6251512ebfbb in blink::PeerConnectionDependencyFactory::CreatePeerConnectionFactory() third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc:432:29 #4 0x6251512ebaba in blink::PeerConnectionDependencyFactory::GetPcFactory() third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc:734:5 #5 0x62515205a7f3 in blink::(anonymous namespace)::GenerateCertificateWithOptionalExpiration(webrtc::KeyParams const&, std::__Cr::optional const&, blink::CrossThreadOnceFunction)>, blink::ExecutionContext&, scoped_refptr) third_party/blink/renderer/modules/peerconnection/rtc_certificate_generator.cc:109:25 #6 0x62515205a42e in blink::RTCCertificateGenerator::GenerateCertificate(webrtc::KeyParams const&, blink::CrossThreadOnceFunction)>, blink::ExecutionContext&, scoped_refptr) third_party/blink/renderer/modules/peerconnection/rtc_certificate_generator.cc:125:3 #7 0x6251520bcc47 in blink::RTCPeerConnection::generateCertificate(blink::ScriptState*, blink::V8UnionObjectOrString const*, blink::ExceptionState&) third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc:1508:28 #8 0x62514f9df7bf in blink::(anonymous namespace)::v8_rtc_peer_connection::GenerateCertificateStaticOperationCallback(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_rtc_peer_connection.cc:1694:23 #9 0x62512fd086d3 in Builtins_CallApiCallbackGeneric crtstuff.c #10 0x62512fd06956 in Builtins_InterpreterEntryTrampoline crtstuff.c #11 0x62512fd06956 in Builtins_InterpreterEntryTrampoline crtstuff.c #12 0x62512fd036db in Builtins_JSEntryTrampoline crtstuff.c #13 0x62512fd0342a in Builtins_JSEntry crtstuff.c #14 0x62512b0554d1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22 #15 0x62512b057e32 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::internal::DirectHandle) v8/src/execution/execution.cc:575:10 #16 0x62512ac6cae3 in v8::Script::Run(v8::Local, v8::Local) v8/src/api/api.cc:2042:7 #17 0x6251497324ad in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local, v8::Local, blink::ExecutionContext*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:509:22 #18 0x625149733e46 in blink::V8ScriptRunner::CompileAndRunScript(blink::ScriptState*, blink::ClassicScript*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:633:22 #19 0x62514ce10012 in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/core/script/classic_script.cc:227:10 #20 0x62514ce72be7 in blink::Script::RunScriptOnScriptState(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/core/script/script.cc:35:17 #21 0x62514ce7301b in blink::Script::RunScript(blink::LocalDOMWindow*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/core/script/script.cc:42:3 #22 0x62514ce9f066 in blink::PendingScript::ExecuteScriptBlockInternal(blink::Script*, blink::ScriptElementBase*, bool, bool, bool, base::TimeTicks, bool) third_party/blink/renderer/core/script/pending_script.cc:312:13 #23 0x62514ce9dfd6 in blink::PendingScript::ExecuteScriptBlock() third_party/blink/renderer/core/script/pending_script.cc:209:3 #24 0x62514ce7972a in blink::ScriptLoader::PrepareScript(blink::ScriptLoader::ParserBlockingInlineOption, blink::TextPosition const&) third_party/blink/renderer/core/script/script_loader.cc:1179:60 #25 0x62514e67ffbf in blink::HTMLParserScriptRunner::ProcessScriptElementInternal(blink::Element*, blink::TextPosition const&) third_party/blink/renderer/core/script/html_parser_script_runner.cc:587:52 #26 0x62514e67f766 in blink::HTMLParserScriptRunner::ProcessScriptElement(blink::Element*, blink::TextPosition const&) third_party/blink/renderer/core/script/html_parser_script_runner.cc:297:3 #27 0x62514e658f3c in blink::HTMLDocumentParser::RunScriptsForPausedTreeBuilder() third_party/blink/renderer/core/html/parser/html_document_parser.cc:672:21 #28 0x62514e65539d in blink::HTMLDocumentParser::PumpTokenizer() third_party/blink/renderer/core/html/parser/html_document_parser.h:232:7 #29 0x62514e65384d in blink::HTMLDocumentParser::PumpTokenizerIfPossible() third_party/blink/renderer/core/html/parser/html_document_parser.cc:635:15 #30 0x62514e662114 in blink::HTMLDocumentParser::FinishAppend() third_party/blink/renderer/core/html/parser/html_document_parser.cc:1038:5 #31 0x62514e66288a in blink::HTMLDocumentParser::CommitPreloadedData() third_party/blink/renderer/core/html/parser/html_document_parser.cc:1053:5 #32 0x62514c548452 in blink::DocumentLoader::StartLoadingResponse() third_party/blink/renderer/core/loader/document_loader.cc:2169:14 #33 0x62514c558cb8 in blink::DocumentLoader::CommitNavigation() third_party/blink/renderer/core/loader/document_loader.cc:3256:3 #34 0x62514c5cecce in blink::FrameLoader::CommitDocumentLoader(blink::DocumentLoader*, blink::HistoryItem*, blink::CommitReason) third_party/blink/renderer/core/loader/frame_loader.cc:1498:21 #35 0x62514c5daf7f in blink::FrameLoader::CommitNavigation(std::__Cr::unique_ptr>, std::__Cr::unique_ptr>, blink::CommitReason) third_party/blink/renderer/core/loader/frame_loader.cc:1310:3 #36 0x62514af02928 in blink::WebLocalFrameImpl::CommitNavigation(std::__Cr::unique_ptr>, std::__Cr::unique_ptr>) third_party/blink/renderer/core/frame/web_local_frame_impl.cc:2840:24 #37 0x6251493f99ad in content::RenderFrameImpl::CommitNavigationWithParams(mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>) content/renderer/render_frame_impl.cc:2974:11 #38 0x62514945dc52 in void base::internal::DecayedFunctorTraits, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>), base::WeakPtr&&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&, std::__Cr::optional, std::__Cr::allocator>>>&&, mojo::StructPtr&&, mojo::StructPtr&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::PendingAssociatedRemote&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&>::Invoke, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>), base::WeakPtr const&, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>>(void (content::RenderFrameImpl::*)(mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>), base::WeakPtr const&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&, std::__Cr::optional, std::__Cr::allocator>>>&&, mojo::StructPtr&&, mojo::StructPtr&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::PendingAssociatedRemote&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:740:12 #39 0x62514945d70b in base::internal::Invoker, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>), base::WeakPtr&&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&, std::__Cr::optional, std::__Cr::allocator>>>&&, mojo::StructPtr&&, mojo::StructPtr&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::PendingAssociatedRemote&&, mojo::PendingRemote&&, mojo::PendingRemote&&, mojo::StructPtr&&, mojo::StructPtr&&, std::__Cr::unique_ptr>&&>, base::internal::BindState, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>), base::WeakPtr, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>>, void (std::__Cr::unique_ptr>)>::RunOnce(base::internal::BindStateBase*, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:956:5 #40 0x6251493faa9b in base::OnceCallback>)>::Run(std::__Cr::unique_ptr>) && base/functional/callback.h:155:12 #41 0x6251493f4615 in content::RenderFrameImpl::CommitNavigation(mojo::StructPtr, mojo::StructPtr, mojo::StructPtr, mojo::ScopedHandleBase, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, base::TokenType const&, base::UnguessableToken const&, base::Uuid const&, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, base::OnceCallback, mojo::StructPtr)>) content/renderer/render_frame_impl.cc:2832:33 #42 0x6251494da820 in content::NavigationClient::CommitNavigation(mojo::StructPtr, mojo::StructPtr, mojo::StructPtr, mojo::ScopedHandleBase, mojo::StructPtr, std::__Cr::unique_ptr>, std::__Cr::optional, std::__Cr::allocator>>>, mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingAssociatedRemote, base::TokenType const&, base::UnguessableToken const&, base::Uuid const&, mojo::StructPtr, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, base::OnceCallback, mojo::StructPtr)>) content/renderer/navigation_client.cc:87:18 #43 0x62512aae4f72 in content::mojom::NavigationClientStubDispatch::AcceptWithResponder(content::mojom::NavigationClient*, mojo::Message*, std::__Cr::unique_ptr>) gen/content/common/navigation_client.mojom.cc:1743:13 #44 0x62513dd75667 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #45 0x62513dd93291 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #46 0x62513dd7b973 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #47 0x625140e8f833 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24 #48 0x625140e91cb5 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #49 0x62513cfbb4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #50 0x62513d02a4ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #51 0x62513d02938a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #52 0x62513ce7c6e2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #53 0x62513d02bbd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #54 0x62513cf36b70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #55 0x6251495c7043 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16 #56 0x6251397b7d29 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14 #57 0x6251397b8fdb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12 #58 0x6251397bbe55 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10 #59 0x6251397b5788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #60 0x6251397b5d8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #61 0x625124e2c266 in ChromeMain chrome/app/chrome_main.cc:194:12 #62 0x77c56a42b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__atomic/support/c11.h:207:10 in std::__Cr::vector, std::__Cr::allocator>>::clear() Shadow bytes around the buggy address: 0x73e568628f80: f7 fa 00 fa f7 fa 00 00 f7 fa fa fa f7 fa 00 fa 0x73e568629000: f7 fa 04 fa f7 fa 00 00 f7 fa 00 fa f7 fa 00 fa 0x73e568629080: f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa 0x73e568629100: f7 fa 00 fa f7 fa 00 00 f7 fa 00 00 f7 fa 00 fa 0x73e568629180: f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa f7 fa 00 00 =>0x73e568629200: f7 fa fd fa f7 fa fd fd f7 fa fd fa f7 fa[fd]fd 0x73e568629280: f7 fa 00 fa f7 fa 00 fa f7 fa 00 00 f7 fa 00 fa 0x73e568629300: f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa 0x73e568629380: f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa 0x73e568629400: f7 fa 00 00 f7 fa 00 00 f7 fa 00 fa f7 fa 00 fa 0x73e568629480: f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==4445==ADDITIONAL INFO ==4445==Note: Please include this section with the ASan report. Task trace: #0 0x625151b6bbe7 in webrtc::MethodCall>, webrtc::PeerConnectionInterface::RTCConfiguration const&, webrtc::PeerConnectionDependencies>::Marshal(webrtc::Thread*) third_party/webrtc/pc/proxy.h:113:10 #1 0x62514fbcc431 in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool) third_party/blink/renderer/core/scheduler/dom_timer.cc:343:27 #2 0x62514fbcc431 in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool) third_party/blink/renderer/core/scheduler/dom_timer.cc:343:27 #3 0x62514fbcc431 in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool) third_party/blink/renderer/core/scheduler/dom_timer.cc:343:27 Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=4357 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --js-flags=--expose-gc --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1778580823322105 --launch-time-ticks=194202083906 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,15894528827671750777,15759811778596378705,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,15006015333819743619,5846664767292237755,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr --v=0` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==4445==END OF ADDITIONAL INFO ==4445==ABORTING