================================================================= ==7173==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110000e9948 at pc 0x000306717170 bp 0x00016f8a0290 sp 0x00016f8a0288 READ of size 1 at 0x6110000e9948 thread T0 ==7173==WARNING: invalid path to external symbolizer! ==7173==WARNING: Failed to use and restart external symbolizer! #0 0x00030671716c in v8_inspector::InjectedScript::wrapObjectMirror(v8_inspector::ValueMirror const&, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, v8::MaybeLocal, int, std::__Cr::unique_ptr>*)+0xbfc (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x671716c) #1 0x0003067150e8 in v8_inspector::InjectedScript::getProperties(v8::Local, v8_inspector::String16 const&, bool, bool, bool, v8_inspector::WrapOptions const&, std::__Cr::unique_ptr>, std::__Cr::allocator>>>, std::__Cr::default_delete>, std::__Cr::allocator>>>>>*, std::__Cr::unique_ptr>*)+0x504 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x67150e8) #2 0x0003067ecb54 in v8_inspector::V8RuntimeAgentImpl::getProperties(v8_inspector::String16 const&, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::unique_ptr>, std::__Cr::allocator>>>, std::__Cr::default_delete>, std::__Cr::allocator>>>>>*, std::__Cr::unique_ptr>, std::__Cr::allocator>>>, std::__Cr::default_delete>, std::__Cr::allocator>>>>>*, std::__Cr::unique_ptr>, std::__Cr::allocator>>>, std::__Cr::default_delete>, std::__Cr::allocator>>>>>*, std::__Cr::unique_ptr>*)+0x2c4 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x67ecb54) #3 0x0003066fe948 in v8_inspector::protocol::Runtime::DomainDispatcherImpl::getProperties(v8_crdtp::Dispatchable const&)+0x2b0 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x66fe948) #4 0x000306833890 in v8_crdtp::UberDispatcher::DispatchResult::Run()+0x74 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x6833890) #5 0x0003067d7f48 in v8_inspector::V8InspectorSessionImpl::dispatchProtocolMessage(v8_inspector::StringView)+0x3cc (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x67d7f48) #6 0x00031e6bee58 in blink::DevToolsSession::DispatchProtocolCommandImpl(int, blink::String const&, base::span)+0x3cc (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1e6bee58) #7 0x00031e6bf438 in non-virtual thunk to blink::DevToolsSession::DispatchProtocolCommand(int, blink::String const&, base::span)+0x19c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1e6bf438) #8 0x00030c40f52c in blink::mojom::blink::DevToolsSessionStubDispatch::Accept(blink::mojom::blink::DevToolsSession*, mojo::Message*)+0x290 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0xc40f52c) #9 0x000312accf04 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*)+0x8fc (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12accf04) #10 0x000312ae1ebc in mojo::MessageDispatcher::Accept(mojo::Message*)+0x2f0 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12ae1ebc) #11 0x000312ad20f8 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*)+0x148 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12ad20f8) #12 0x0003160e50a4 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification)+0x3e8 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x160e50a4) #13 0x0003160e70c8 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*)+0x1bc (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x160e70c8) #14 0x000312cc483c in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12cc483c) #15 0x000312d2c508 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x88c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12d2c508) #16 0x000312d2b8c0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12d2b8c0) #17 0x000312bab74c in base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+0x228 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12bab74c) #18 0x000312d2d8bc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x380 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12d2d8bc) #19 0x000312c51a8c in base::RunLoop::Run(base::Location const&)+0x430 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12c51a8c) #20 0x00031c78ea10 in content::(anonymous namespace)::NestedMessageLoopRunnerImpl::Run()+0x198 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1c78ea10) #21 0x0003210f9f98 in blink::ClientMessageLoopAdapter::RunLoop(blink::WebLocalFrameImpl*)+0x568 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x210f9f98) #22 0x00030679d7bc in v8_inspector::V8Debugger::handleProgramBreak(v8::Local, v8::Local, std::__Cr::vector> const&, v8::base::EnumSet, v8::debug::ExceptionType, bool)+0x6b0 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x679d7bc) #23 0x0003046889d4 in v8::internal::Debug::OnDebugBreak(v8::internal::DirectHandle, v8::internal::StepAction, v8::base::EnumSet)+0x594 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x46889d4) #24 0x0003046a0cb0 in v8::internal::Debug::HandleDebugBreak(v8::internal::IgnoreBreakMode, v8::base::EnumSet)+0x814 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x46a0cb0) #25 0x0003056892e0 in v8::internal::Runtime_HandleDebuggerStatement(int, unsigned long*, v8::internal::Isolate*)+0x9c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x56892e0) #26 0x0003f7e7bd48 () #27 0x0003f7f87cb8 () #28 0x0003f7dce344 () #29 0x0003f7dce344 () #30 0x0003f7dcb340 () #31 0x0003f7dcb038 () #32 0x0003047705c4 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&)+0x1b90 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x47705c4) #33 0x00030476e9a0 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>)+0x170 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x476e9a0) #34 0x0003043b141c in v8::Function::Call(v8::Isolate*, v8::Local, v8::Local, int, v8::Local*)+0x3a0 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x43b141c) #35 0x00031c8e5f78 in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*)+0x590 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1c8e5f78) #36 0x000321221b38 in blink::bindings::CallbackInvokeHelper::Call(int, v8::Local*)+0x210 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x21221b38) #37 0x0003212365c8 in blink::V8Function::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&)+0x534 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x212365c8) #38 0x000321236d58 in blink::V8Function::InvokeAndReportException(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&)+0x184 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x21236d58) #39 0x0003221f2530 in blink::ScheduledAction::Execute(blink::ExecutionContext*)+0x45c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x221f2530) #40 0x0003221f7b28 in blink::DOMTimer::Fired()+0x500 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x221f7b28) #41 0x00032044613c in blink::TimerBase::RunInternal()+0xb0 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x2044613c) #42 0x00031c85c040 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*)+0x11c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1c85c040) #43 0x000312cc483c in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12cc483c) #44 0x000312d2c508 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x88c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12d2c508) #45 0x000312d2b8c0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12d2b8c0) #46 0x000312bab74c in base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+0x228 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12bab74c) #47 0x000312d2d868 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x32c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12d2d868) #48 0x000312c51a8c in base::RunLoop::Run(base::Location const&)+0x430 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12c51a8c) #49 0x00031c7a5030 in content::RendererMain(content::MainFunctionParams)+0x8b4 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1c7a5030) #50 0x00030f2e5404 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*)+0x42c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0xf2e5404) #51 0x00030f2e7584 in content::ContentMainRunnerImpl::Run()+0x53c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0xf2e7584) #52 0x00030f2e30d8 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x858 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0xf2e30d8) #53 0x00030f2e35c8 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0xf2e35c8) #54 0x000300005cb4 in ChromeMain+0x490 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x5cb4) #55 0x00010055cc94 in main+0x254 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer):arm64+0x100000c94) #56 0x00019c5b6b94 in start+0x17b8 (/usr/lib/dyld:arm64e+0x6b94) 0x6110000e9948 is located 200 bytes inside of 208-byte region [0x6110000e9880,0x6110000e9950) freed by thread T0 here: #0 0x0001009b9074 in __asan_memmove+0x308c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x55074) #1 0x000306730f68 in std::__Cr::__hash_table>>, std::__Cr::__unordered_map_hasher>>, std::__Cr::hash, std::__Cr::equal_to>, std::__Cr::__unordered_map_equal>>, std::__Cr::equal_to, std::__Cr::hash>, std::__Cr::allocator>>>>::~__hash_table()+0xe4 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x6730f68) #2 0x00030672fb4c in v8_inspector::InspectedContext::~InspectedContext()+0x8c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x672fb4c) #3 0x0003067d1d60 in std::__Cr::__shared_ptr_pointer::__shared_ptr_default_delete, std::__Cr::allocator>::__on_zero_shared()+0x2c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x67d1d60) #4 0x0003067c83ec in v8_inspector::V8InspectorImpl::contextCollected(int, int)+0x310 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x67c83ec) #5 0x00031e690548 in blink::MainThreadDebugger::ContextWillBeDestroyed(blink::ScriptState*)+0x250 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1e690548) #6 0x00031c902b44 in blink::LocalWindowProxy::DisposeContext(blink::WindowProxy::Lifecycle, blink::WindowProxy::FrameReuseStatus)+0x5ac (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1c902b44) #7 0x00031c910b0c in blink::WindowProxyManager::ClearForClose()+0x64 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1c910b0c) #8 0x00031d9fb040 in blink::Frame::Detach(blink::FrameDetachType)+0x430 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1d9fb040) #9 0x00031e0e67ec in blink::HTMLFrameOwnerElement::DisconnectContentFrame()+0x18c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1e0e67ec) #10 0x00031dabc674 in blink::ChildFrameDisconnector::DisconnectCollectedFrameOwners()+0x210 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1dabc674) #11 0x00032084070c in blink::ContainerNode::WillRemoveChild(blink::Node&)+0x25c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x2084070c) #12 0x00032083ece8 in blink::ContainerNode::RemoveChild(blink::Node*, blink::ExceptionState&)+0x224 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x2083ece8) #13 0x0003214497cc in blink::(anonymous namespace)::v8_element::RemoveOperationCallback(v8::FunctionCallbackInfo const&)+0x190 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x214497cc) #14 0x0003f7dd0354 () #15 0x0003f7dce344 () #16 0x0003f7dcb340 () #17 0x0003f7dcb038 () #18 0x0003047705c4 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&)+0x1b90 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x47705c4) #19 0x00030476e9a0 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>)+0x170 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x476e9a0) #20 0x0003047eca2c in v8::internal::ErrorUtils::FormatStackTrace(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle)+0x49c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x47eca2c) #21 0x0003047f4390 in v8::internal::ErrorUtils::GetFormattedStack(v8::internal::Isolate*, v8::internal::DirectHandle)+0x43c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x47f4390) #22 0x000304483480 in v8::internal::Accessors::ErrorStackGetter(v8::FunctionCallbackInfo const&)+0x124 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x4483480) #23 0x000304489e50 in v8::internal::FunctionCallbackArguments::CallOrConstruct(v8::internal::Isolate*, v8::internal::Tagged, bool)+0x270 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x4489e50) #24 0x0003044886d8 in v8::internal::Builtins::InvokeApiFunction(v8::internal::Isolate*, bool, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>, v8::internal::DirectHandle)+0x1274 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x44886d8) #25 0x000304770220 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&)+0x17ec (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x4770220) #26 0x00030476e9a0 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>)+0x170 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x476e9a0) #27 0x0003052c16e4 in v8::internal::Object::GetPropertyWithAccessor(v8::internal::LookupIterator*)+0x6cc (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x52c16e4) #28 0x0003052bf89c in v8::internal::Object::GetProperty(v8::internal::LookupIterator*, bool)+0x20c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x52bf89c) #29 0x0003056e9588 in v8::internal::Runtime::GetObjectProperty(v8::internal::Isolate*, v8::internal::DirectHandle>, v8::internal::DirectHandle, v8::internal::DirectHandle>, bool*)+0x178 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x56e9588) previously allocated by thread T0 here: #0 0x0001009b8f84 in __asan_memmove+0x2f9c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x54f84) #1 0x0003295d857c in operator new(unsigned long)+0x18 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x295d857c) #2 0x0003067303b0 in v8_inspector::InspectedContext::createInjectedScript(int)+0xc0 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x67303b0) #3 0x0003067d5fbc in v8_inspector::V8InspectorSessionImpl::findInjectedScript(int, v8_inspector::InjectedScript*&)+0x174 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x67d5fbc) #4 0x00030677f8cc in v8_inspector::V8DebuggerAgentImpl::currentCallFrames(std::__Cr::unique_ptr>, std::__Cr::allocator>>>, std::__Cr::default_delete>, std::__Cr::allocator>>>>>*)+0x520 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x677f8cc) #5 0x000306767c40 in v8_inspector::V8DebuggerAgentImpl::didPause(int, v8::Local, std::__Cr::vector> const&, v8::debug::ExceptionType, bool, v8::base::EnumSet)+0x14c0 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x6767c40) #6 0x0003067c7bbc in v8_inspector::V8InspectorImpl::forEachSession(int, std::__Cr::function const&)+0x488 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x67c7bbc) #7 0x00030679d6d0 in v8_inspector::V8Debugger::handleProgramBreak(v8::Local, v8::Local, std::__Cr::vector> const&, v8::base::EnumSet, v8::debug::ExceptionType, bool)+0x5c4 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x679d6d0) #8 0x0003046889d4 in v8::internal::Debug::OnDebugBreak(v8::internal::DirectHandle, v8::internal::StepAction, v8::base::EnumSet)+0x594 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x46889d4) #9 0x0003046a0cb0 in v8::internal::Debug::HandleDebugBreak(v8::internal::IgnoreBreakMode, v8::base::EnumSet)+0x814 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x46a0cb0) #10 0x0003056892e0 in v8::internal::Runtime_HandleDebuggerStatement(int, unsigned long*, v8::internal::Isolate*)+0x9c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x56892e0) #11 0x0003f7e7bd48 () #12 0x0003f7f87cb8 () #13 0x0003f7dce344 () #14 0x0003f7dce344 () #15 0x0003f7dcb340 () #16 0x0003f7dcb038 () #17 0x0003047705c4 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&)+0x1b90 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x47705c4) #18 0x00030476e9a0 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>)+0x170 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x476e9a0) #19 0x0003043b141c in v8::Function::Call(v8::Isolate*, v8::Local, v8::Local, int, v8::Local*)+0x3a0 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x43b141c) #20 0x00031c8e5f78 in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*)+0x590 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1c8e5f78) #21 0x000321221b38 in blink::bindings::CallbackInvokeHelper::Call(int, v8::Local*)+0x210 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x21221b38) #22 0x0003212365c8 in blink::V8Function::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&)+0x534 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x212365c8) #23 0x000321236d58 in blink::V8Function::InvokeAndReportException(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&)+0x184 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x21236d58) #24 0x0003221f2530 in blink::ScheduledAction::Execute(blink::ExecutionContext*)+0x45c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x221f2530) #25 0x0003221f7b28 in blink::DOMTimer::Fired()+0x500 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x221f7b28) #26 0x00032044613c in blink::TimerBase::RunInternal()+0xb0 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x2044613c) #27 0x00031c85c040 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*)+0x11c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x1c85c040) #28 0x000312cc483c in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12cc483c) #29 0x000312d2c508 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x88c (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x12d2c508) SUMMARY: AddressSanitizer: heap-use-after-free (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x671716c) in v8_inspector::InjectedScript::wrapObjectMirror(v8_inspector::ValueMirror const&, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, v8::MaybeLocal, int, std::__Cr::unique_ptr>*)+0xbfc Shadow bytes around the buggy address: 0x6110000e9680: 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa 0x6110000e9700: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd 0x6110000e9780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x6110000e9800: fd fd fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x6110000e9880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x6110000e9900: fd fd fd fd fd fd fd fd fd[fd]fa fa fa fa fa fa 0x6110000e9980: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd 0x6110000e9a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x6110000e9a80: fd fd fd fd fd fd fd fd fa fa fa fa fa fa f7 fa 0x6110000e9b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x6110000e9b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==7173==ADDITIONAL INFO ==7173==Note: Please include this section with the ASan report. Task trace: #0 0x0003160de6cc in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*)+0x7c4 (/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Chromium Framework:arm64+0x160de6cc) Command line: `/Users/alisa/Documents/Code/googlestuff/chrome-asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7779.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer) --type=renderer --user-data-dir=/tmp/chrome-asan --no-sandbox --file-url-path-alias=/gen=/Users/alisa/Documents/Code/googlestuff/chrome-asan/gen --js-flags=--expose-gc --allow-natives-syntax --enable-blink-features=MojoJS,MojoJSTest --lang=en-US --num-raster-threads=4 --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources --enable-main-frame-before-activation --renderer-client-id=67 --time-ticks-at-unix-epoch=-1775925858331855 --launch-time-ticks=488648505843 --shared-files --metrics-shmem-handle=1752395122,r,13200767321502020156,8087822750979582627,2097152 --field-trial-handle=1718379636,r,11048359909989359910,6745670114945284298,262144 --enable-features=WebMachineLearningNeuralNetwork,WebNNCoreMLExplicitGPUOrNPU --disable-features=WebNNCoreML --variations-seed-version --pseudonymization-salt-handle=1935764596,r,13434608299011006442,11257493517387136236,4 --trace-process-track-uuid=3190709049093675377 --enable-logging=stderr --v=1` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==7173==END OF ADDITIONAL INFO ==7173==ABORTING