serving on http://127.0.0.1:28765/
launching: /chromium/chromium/src/out/asan/chrome --no-first-run --no-default-browser-check --use-gl=angle --use-angle=swiftshader --ignore-gpu-blocklist --enable-unsafe-swiftshader --in-process-gpu --user-data-dir=/tmp/chrome-poc-profile --enable-blink-features=MojoJS,MojoJSTest --js-flags=--expose-gc --no-sandbox --disable-crash-reporter --disable-breakpad --disable-in-process-stack-traces --remote-debugging-port=29222 --remote-allow-origins=* --headless=new --enable-logging=stderr --v=0 http://127.0.0.1:28765/poc.html

DevTools listening on ws://127.0.0.1:29222/devtools/browser/716da08c-89f0-4177-8b68-11ed12c065d9

[5442:5442:0516/181712.897964:INFO:CONSOLE:29] "[POC] module loaded; awaiting user-activation injection", source: http://127.0.0.1:28765/poc.html (29)
>>> injecting user-activated startPOC()
[5442:5442:0516/181712.936166:INFO:CONSOLE:29] "[POC] starting", source: http://127.0.0.1:28765/poc.html (29)
[5442:5442:0516/181712.939913:INFO:CONSOLE:29] "[POC] fake device connected", source: http://127.0.0.1:28765/poc.html (29)
[5442:5442:0516/181713.056368:INFO:CONSOLE:29] "[POC] immersive-vr session created", source: http://127.0.0.1:28765/poc.html (29)
[5442:5442:0516/181713.058840:INFO:CONSOLE:29] "[POC] reference spaces created", source: http://127.0.0.1:28765/poc.html (29)
[5442:5442:0516/181713.080091:INFO:CONSOLE:29] "[POC] RAF: building 32 fresh bounded clones", source: http://127.0.0.1:28765/poc.html (29)
[5442:5442:0516/181713.081276:INFO:CONSOLE:29] "[POC] calling frame.fillPoses() ...", source: http://127.0.0.1:28765/poc.html (29)
[5442:5442:0516/181713.081539:INFO:CONSOLE:29] "[POC]   transforms.byteLength before = 2048", source: http://127.0.0.1:28765/poc.html (29)
[5442:5442:0516/181713.082204:INFO:CONSOLE:29] "[POC] reset[0] firing INSIDE fillPoses; detaching buffer", source: http://127.0.0.1:28765/poc.html (29)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==5554==ERROR: AddressSanitizer: SEGV on unknown address 0x796800204040 (pc 0x7eadb6d716d8 bp 0x7ffeb30a0050 sp 0x7ffeb309f808 T0)
==5554==The signal is caused by a WRITE memory access.
    #0 0x7eadb6d716d8  (/lib/x86_64-linux-gnu/libc.so.6+0x16d6d8) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)
    #1 0x5a881c6f2b42 in std::__Cr::pair<base::CheckedContiguousIterator<float const>, base::CheckedContiguousIterator<float>> std::__Cr::__copy_move_unwrap_iters<std::__Cr::__copy_backward_impl<std::__Cr::_RangeAlgPolicy>, base::CheckedContiguousIterator<float const>, base::CheckedContiguousIterator<float const>, base::CheckedContiguousIterator<float>, 0>(base::CheckedContiguousIterator<float const>, base::CheckedContiguousIterator<float const>, base::CheckedContiguousIterator<float>) gen/third_party/libc++/src/include/__string/constexpr_c_functions.h:227:5
    #2 0x5a88477950b2 in base::span<float, 16ul, float*>::copy_from(base::span<float const, 16ul, float const*>) requires !std::is_const_v<T> gen/third_party/libc++/src/include/__algorithm/copy_backward.h:237:10
    #3 0x5a8847793ffe in blink::XRFrame::fillPoses(blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember<blink::XRSpace, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 0u> const&, blink::XRSpace*, blink::NotShared<blink::DOMTypedArray<float, v8::Float32Array, false>>, blink::ExceptionState&) const base/containers/span.h:700:7
    #4 0x5a8844569f76 in blink::(anonymous namespace)::v8_xr_frame::FillPosesOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_xr_frame.cc:325:39
    #5 0x5a8823fdf6d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #6 0x5a8823fdd956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #7 0x5a8823fda6db in Builtins_JSEntryTrampoline crtstuff.c
    #8 0x5a8823fda42a in Builtins_JSEntry crtstuff.c
    #9 0x5a881f32c4d1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #10 0x5a881f32ae11 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) v8/src/execution/execution.cc:565:10
    #11 0x5a881ef775ad in v8::Function::Call(v8::Isolate*, v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) v8/src/api/api.cc:5612:27
    #12 0x5a883da0e7af in blink::V8ScriptRunner::CallFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:851:48
    #13 0x5a8843116166 in blink::bindings::CallbackInvokeHelper<blink::CallbackFunctionBase, (blink::bindings::CallbackInvokeHelperMode)0, (blink::bindings::CallbackReturnTypeIsPromise)0>::Call(int, v8::Local<v8::Value>*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:123:12
    #14 0x5a88445ac2f4 in blink::V8XRFrameRequestCallback::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, double, blink::XRFrame*) gen/third_party/blink/renderer/bindings/modules/v8/v8_xr_frame_request_callback.cc:66:13
    #15 0x5a88445acc0e in blink::V8XRFrameRequestCallback::InvokeAndReportException(blink::bindings::V8ValueOrScriptWrappableAdapter, double, blink::XRFrame*) gen/third_party/blink/renderer/bindings/modules/v8/v8_xr_frame_request_callback.cc:118:15
    #16 0x5a884789d8d1 in blink::XRFrameRequestCallbackCollection::ExecuteCallbacks(blink::XRSession*, double, blink::XRFrame*) third_party/blink/renderer/modules/xr/xr_frame_request_callback_collection.cc:90:30
    #17 0x5a8847853a9e in blink::XRSession::OnFrame(double, blink::Vector<blink::XRSharedImageData, 0u, blink::PartitionAllocator>) third_party/blink/renderer/modules/xr/xr_session.cc:2323:27
    #18 0x5a88477ae90f in void base::internal::DecayedFunctorTraits<void (blink::XRSession::*)(double, blink::Vector<blink::XRSharedImageData, 0u, blink::PartitionAllocator>), cppgc::internal::BasicPersistent<blink::XRSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, double&&, blink::Vector<blink::XRSharedImageData, 0u, blink::PartitionAllocator>&&>::Invoke<void (blink::XRSession::*)(double, blink::Vector<blink::XRSharedImageData, 0u, blink::PartitionAllocator>), cppgc::internal::BasicPersistent<blink::XRSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> const&, double, blink::Vector<blink::XRSharedImageData, 0u, blink::PartitionAllocator>>(void (blink::XRSession::*)(double, blink::Vector<blink::XRSharedImageData, 0u, blink::PartitionAllocator>), cppgc::internal::BasicPersistent<blink::XRSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> const&, double&&, blink::Vector<blink::XRSharedImageData, 0u, blink::PartitionAllocator>&&) base/functional/bind_internal.h:740:12
    #19 0x5a88477ae6dd in base::internal::Invoker<base::internal::FunctorTraits<void (blink::XRSession::*&&)(double, blink::Vector<blink::XRSharedImageData, 0u, blink::PartitionAllocator>), cppgc::internal::BasicPersistent<blink::XRSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, double&&, blink::Vector<blink::XRSharedImageData, 0u, blink::PartitionAllocator>&&>, base::internal::BindState<true, true, false, void (blink::XRSession::*)(double, blink::Vector<blink::XRSharedImageData, 0u, blink::PartitionAllocator>), cppgc::internal::BasicPersistent<blink::XRSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, double, blink::Vector<blink::XRSharedImageData, 0u, blink::PartitionAllocator>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:956:5
    #20 0x5a88312924c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #21 0x5a88313014ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #22 0x5a883130038a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #23 0x5a88311536e2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #24 0x5a8831302bd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #25 0x5a883120db70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #26 0x5a883d89e043 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16
    #27 0x5a882da8ed29 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #28 0x5a882da8ffdb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #29 0x5a882da92e55 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #30 0x5a882da8c788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #31 0x5a882da8cd8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #32 0x5a8819103266 in ChromeMain chrome/app/chrome_main.cc:194:12
    #33 0x7eadb6c2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

==5554==Register values:
rax = 0x0000796800204040  rbx = 0x0000000000000000  rcx = 0x00000f2d8003880f  rdx = 0x0000000000000040  
rdi = 0x0000796800204040  rsi = 0x0000796800008000  rbp = 0x00007ffeb30a0050  rsp = 0x00007ffeb309f808  
 r8 = 0x00000f2d00040808   r9 = 0x000079680020407f  r10 = 0x00000f2d0004080f  r11 = 0x00000f2d80038808  
r12 = 0x00000f2d80038808  r13 = 0xffffffffffffffff  r14 = 0x00007aadb3d0d400  r15 = 0x00007aadb3d0d6a0  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x16d6d8) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 

==5554==ADDITIONAL INFO

==5554==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5a88477a439d in blink::XRFrameProvider::ProcessScheduledFrame(mojo::StructPtr<device::mojom::blink::XRFrameData>, double, blink::XRFrameProvider::ScheduledFrameType) third_party/blink/renderer/modules/xr/xr_frame_provider.cc:567:20
    #1 0x5a88477a2834 in blink::XRFrameProvider::OnImmersiveFrameData(mojo::StructPtr<device::mojom::blink::XRFrameData>) third_party/blink/renderer/modules/xr/xr_frame_provider.cc:407:18
    #2 0x5a88320e6b43 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13
    #3 0x5a8843ea3431 in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool) third_party/blink/renderer/core/scheduler/dom_timer.cc:343:27


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=5445 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --disable-in-process-stack-traces --no-sandbox --disable-breakpad --remote-debugging-port=29222 --js-flags=--expose-gc --ozone-platform=headless --enable-blink-features=MojoJS,MojoJSTest --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1778580823322104 --launch-time-ticks=374607923899 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,13445121104223014225,9414471026350293723,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,8045161647341196908,6476292271069022004,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr --v=0`


==5554==END OF ADDITIONAL INFO

==5554==ABORTING