==47396==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000cb1768 at pc 0x00012a888e50 bp 0x00016b29d8f0 sp 0x00016b29d8e8 READ of size 8 at 0x604000cb1768 thread T0 ==47396==WARNING: invalid path to external symbolizer! ==47396==WARNING: Failed to use and restart external symbolizer! #0 0x00012a888e4c in autofill::FormFiller::UndoAutofill(autofill::mojom::ActionPersistence, autofill::FormData, autofill::FormStructure&, autofill::FormFieldData const&, autofill::FillingProduct)+0x18a0 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x9324e4c) #1 0x00012a8c73e0 in autofill::BrowserAutofillManager::UndoAutofill(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::FormFieldData const&)+0x1dc (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x93633e0) #2 0x00012abaa85c in autofill::AutofillExternalDelegate::DidAcceptSuggestion(autofill::Suggestion const&, autofill::AutofillSuggestionDelegate::SuggestionMetadata const&)+0x1430 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x964685c) #3 0x0001259a7c74 in autofill::AutofillPopupControllerImpl::AcceptSuggestion(int, autofill::AutofillMetrics::SuggestionAcceptedMethod)+0x51c (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x4443c74) #4 0x00012dcb261c in autofill::PopupRowView::OnMouseReleased(ui::MouseEvent const&)+0x224 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0xc74e61c) #5 0x00010a4fddcc in ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*)+0x22c (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x19dcc) #6 0x00010a4fc8e4 in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*)+0x57c (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x188e4) #7 0x00010a4fbfc0 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*)+0x1b0 (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x17fc0) #8 0x00010a4fbb18 in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)+0x1dc (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x17b18) #9 0x00013fed15fc in views::internal::RootView::OnMouseReleased(ui::MouseEvent const&)+0x218 (/Users/ellyjones/p/cr/src/out/rel/libui_views.dylib:arm64+0x4b55fc) #10 0x00013ff0107c in views::Widget::OnMouseEvent(ui::MouseEvent*)+0x39c (/Users/ellyjones/p/cr/src/out/rel/libui_views.dylib:arm64+0x4e507c) #11 0x00012dca6d04 in autofill::PopupBaseView::Widget::OnMouseEvent(ui::MouseEvent*)+0x3f4 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0xc742d04) #12 0x00013ff6f09c in views::NativeWidgetMacNSWindowHost::OnMouseEvent(std::__Cr::unique_ptr>)+0xf0 (/Users/ellyjones/p/cr/src/out/rel/libui_views.dylib:arm64+0x55309c) #13 0x000141bfe44c in -[BridgedContentView mouseEvent:]+0x248 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x1244c) #14 0x000141bfbc28 in -[BridgedContentView processCapturedMouseEvent:]+0x314 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0xfc28) #15 0x000141c4ab5c in non-virtual thunk to remote_cocoa::NativeWidgetNSWindowBridge::PostCapturedEvent(NSEvent*)+0x34 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x5eb5c) #16 0x000141c1cf50 in invocation function for block in remote_cocoa::CocoaMouseCapture::ActiveEventTap::Init()+0x160 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x30f50) #17 0x0001872705b8 in _NSSendEventToObservers+0xf8 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0xb05b8) #18 0x000187ca55d0 in -[NSApplication(NSEventRouting) sendEvent:]+0x70 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0xae55d0) #19 0x00012819f014 in __34-[BrowserCrApplication sendEvent:]_block_invoke+0x270 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x6c3b014) #20 0x000107697cb8 in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/ellyjones/p/cr/src/out/rel/libbase.dylib:arm64+0x4d3cb8) #21 0x00012819e83c in -[BrowserCrApplication sendEvent:]+0x83c (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x6c3a83c) #22 0x00018773dbb8 in -[NSApplication _handleEvent:]+0x38 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x57dbb8) #23 0x0001871d87a4 in -[NSApplication run]+0x194 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x187a4) #24 0x0001076b4390 in base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)+0x32c (/Users/ellyjones/p/cr/src/out/rel/libbase.dylib:arm64+0x4f0390) #25 0x0001076ae0c0 in base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)+0x290 (/Users/ellyjones/p/cr/src/out/rel/libbase.dylib:arm64+0x4ea0c0) #26 0x0001074c39a0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x658 (/Users/ellyjones/p/cr/src/out/rel/libbase.dylib:arm64+0x2ff9a0) #27 0x00010736d34c in base::RunLoop::Run(base::Location const&)+0x4e0 (/Users/ellyjones/p/cr/src/out/rel/libbase.dylib:arm64+0x1a934c) #28 0x000147b96414 in content::BrowserMainLoop::RunMainMessageLoop()+0x240 (/Users/ellyjones/p/cr/src/out/rel/libcontent.dylib:arm64+0x1526414) #29 0x000147b9e268 in content::BrowserMainRunnerImpl::Run()+0x1b4 (/Users/ellyjones/p/cr/src/out/rel/libcontent.dylib:arm64+0x152e268) #30 0x000147b8e910 in content::BrowserMain(content::MainFunctionParams)+0x1c0 (/Users/ellyjones/p/cr/src/out/rel/libcontent.dylib:arm64+0x151e910) #31 0x00014b004f20 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*)+0x1d0 (/Users/ellyjones/p/cr/src/out/rel/libcontent.dylib:arm64+0x4994f20) #32 0x00014b008b20 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool)+0xc00 (/Users/ellyjones/p/cr/src/out/rel/libcontent.dylib:arm64+0x4998b20) #33 0x00014b007c48 in content::ContentMainRunnerImpl::Run()+0x6bc (/Users/ellyjones/p/cr/src/out/rel/libcontent.dylib:arm64+0x4997c48) #34 0x00014b002f9c in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x8bc (/Users/ellyjones/p/cr/src/out/rel/libcontent.dylib:arm64+0x4992f9c) #35 0x00014b0034c4 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/ellyjones/p/cr/src/out/rel/libcontent.dylib:arm64+0x49934c4) #36 0x00012156f890 in ChromeMain+0x4b8 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0xb890) #37 0x000104b60ad0 in main+0x1f8 (/Users/ellyjones/p/cr/src/out/rel/Chromium.app/Contents/MacOS/Chromium:arm64+0x100000ad0) #38 0x00018295dd50 in start+0x1c0c (/usr/lib/dyld:arm64e+0x8d50) 0x604000cb1768 is located 24 bytes inside of 40-byte region [0x604000cb1750,0x604000cb1778) freed by thread T0 here: #0 0x0001054017b4 in __sanitizer_finish_switch_fiber+0xa14 (/Users/ellyjones/p/cr/src/out/rel/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x657b4) #1 0x00012a86fc00 in std::__Cr::list, autofill::FormAutofillHistory::FieldFillingEntry, std::__Cr::less>, std::__Cr::allocator const, autofill::FormAutofillHistory::FieldFillingEntry>>>, std::__Cr::allocator, autofill::FormAutofillHistory::FieldFillingEntry, std::__Cr::less>, std::__Cr::allocator const, autofill::FormAutofillHistory::FieldFillingEntry>>>>>::erase(std::__Cr::__list_const_iterator, autofill::FormAutofillHistory::FieldFillingEntry, std::__Cr::less>, std::__Cr::allocator const, autofill::FormAutofillHistory::FieldFillingEntry>>>, void*>)+0xc4 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x930bc00) #2 0x00012a88847c in autofill::FormFiller::UndoAutofill(autofill::mojom::ActionPersistence, autofill::FormData, autofill::FormStructure&, autofill::FormFieldData const&, autofill::FillingProduct)+0xed0 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x932447c) #3 0x00012a8c73e0 in autofill::BrowserAutofillManager::UndoAutofill(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::FormFieldData const&)+0x1dc (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x93633e0) #4 0x00012abaa85c in autofill::AutofillExternalDelegate::DidAcceptSuggestion(autofill::Suggestion const&, autofill::AutofillSuggestionDelegate::SuggestionMetadata const&)+0x1430 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x964685c) #5 0x0001259a7c74 in autofill::AutofillPopupControllerImpl::AcceptSuggestion(int, autofill::AutofillMetrics::SuggestionAcceptedMethod)+0x51c (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x4443c74) #6 0x00012dcb261c in autofill::PopupRowView::OnMouseReleased(ui::MouseEvent const&)+0x224 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0xc74e61c) #7 0x00010a4fddcc in ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*)+0x22c (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x19dcc) #8 0x00010a4fc8e4 in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*)+0x57c (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x188e4) #9 0x00010a4fbfc0 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*)+0x1b0 (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x17fc0) #10 0x00010a4fbb18 in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)+0x1dc (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x17b18) #11 0x00013fed15fc in views::internal::RootView::OnMouseReleased(ui::MouseEvent const&)+0x218 (/Users/ellyjones/p/cr/src/out/rel/libui_views.dylib:arm64+0x4b55fc) #12 0x00013ff0107c in views::Widget::OnMouseEvent(ui::MouseEvent*)+0x39c (/Users/ellyjones/p/cr/src/out/rel/libui_views.dylib:arm64+0x4e507c) #13 0x00012dca6d04 in autofill::PopupBaseView::Widget::OnMouseEvent(ui::MouseEvent*)+0x3f4 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0xc742d04) #14 0x00013ff6f09c in views::NativeWidgetMacNSWindowHost::OnMouseEvent(std::__Cr::unique_ptr>)+0xf0 (/Users/ellyjones/p/cr/src/out/rel/libui_views.dylib:arm64+0x55309c) #15 0x000141bfe44c in -[BridgedContentView mouseEvent:]+0x248 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x1244c) #16 0x000141bfbc28 in -[BridgedContentView processCapturedMouseEvent:]+0x314 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0xfc28) #17 0x000141c4ab5c in non-virtual thunk to remote_cocoa::NativeWidgetNSWindowBridge::PostCapturedEvent(NSEvent*)+0x34 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x5eb5c) #18 0x000141c1cf50 in invocation function for block in remote_cocoa::CocoaMouseCapture::ActiveEventTap::Init()+0x160 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x30f50) #19 0x0001872705b8 in _NSSendEventToObservers+0xf8 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0xb05b8) #20 0x000187ca55d0 in -[NSApplication(NSEventRouting) sendEvent:]+0x70 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0xae55d0) #21 0x00012819f014 in __34-[BrowserCrApplication sendEvent:]_block_invoke+0x270 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x6c3b014) #22 0x000107697cb8 in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/ellyjones/p/cr/src/out/rel/libbase.dylib:arm64+0x4d3cb8) #23 0x00012819e83c in -[BrowserCrApplication sendEvent:]+0x83c (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x6c3a83c) #24 0x00018773dbb8 in -[NSApplication _handleEvent:]+0x38 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x57dbb8) #25 0x0001871d87a4 in -[NSApplication run]+0x194 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x187a4) #26 0x0001076b4390 in base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)+0x32c (/Users/ellyjones/p/cr/src/out/rel/libbase.dylib:arm64+0x4f0390) #27 0x0001076ae0c0 in base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)+0x290 (/Users/ellyjones/p/cr/src/out/rel/libbase.dylib:arm64+0x4ea0c0) #28 0x0001074c39a0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x658 (/Users/ellyjones/p/cr/src/out/rel/libbase.dylib:arm64+0x2ff9a0) #29 0x00010736d34c in base::RunLoop::Run(base::Location const&)+0x4e0 (/Users/ellyjones/p/cr/src/out/rel/libbase.dylib:arm64+0x1a934c) previously allocated by thread T0 here: #0 0x0001054013bc in __sanitizer_finish_switch_fiber+0x61c (/Users/ellyjones/p/cr/src/out/rel/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x653bc) #1 0x00012a86ea84 in autofill::FormAutofillHistory::AddFormFillingEntry(base::span, base::span, autofill::FillingProduct, bool)+0x19c (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x930aa84) #2 0x00012a88c778 in autofill::FormFiller::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::FormStructure&, autofill::AutofillField&, autofill::AutofillTriggerSource, std::__Cr::optional, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)+0x2db8 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x9328778) #3 0x00012a8e7530 in decltype(auto) std::__Cr::__variant_detail::__visitation::__base::__dispatcher<0ul>::__dispatch const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)::$_0, autofill::BrowserAutofillManager::FillOrPreviewFields(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)::$_1, autofill::BrowserAutofillManager::FillOrPreviewFields(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)::$_2, autofill::BrowserAutofillManager::FillOrPreviewFields(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)::$_3, autofill::BrowserAutofillManager::FillOrPreviewFields(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)::$_4>>&&, std::__Cr::__variant_detail::__base<(std::__Cr::__variant_detail::_Trait)0, autofill::AutofillProfile const*, autofill::CreditCard const*, autofill::EntityInstance const*, std::__Cr::map, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&>(std::__Cr::__variant_detail::__visitation::__variant::__value_visitor const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)::$_0, autofill::BrowserAutofillManager::FillOrPreviewFields(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)::$_1, autofill::BrowserAutofillManager::FillOrPreviewFields(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)::$_2, autofill::BrowserAutofillManager::FillOrPreviewFields(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)::$_3, autofill::BrowserAutofillManager::FillOrPreviewFields(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)::$_4>>&&, std::__Cr::__variant_detail::__base<(std::__Cr::__variant_detail::_Trait)0, autofill::AutofillProfile const*, autofill::CreditCard const*, autofill::EntityInstance const*, std::__Cr::map, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&)+0x260 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x9383530) #4 0x00012a8c66c0 in autofill::BrowserAutofillManager::FillOrPreviewFields(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource, base::internal::flat_tree, std::__Cr::identity, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>>> const&)+0x408 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x93626c0) #5 0x00012a8c6204 in autofill::BrowserAutofillManager::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)+0x124 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x9362204) #6 0x00012aba8630 in autofill::AutofillExternalDelegate::AutofillForm(autofill::SuggestionType, std::__Cr::variant, std::__Cr::allocator>>, base::StrongAlias, autofill::Suggestion::AutofillProfilePayload, GURL, autofill::Suggestion::PasswordSuggestionDetails, autofill::Suggestion::PlusAddressPayload, autofill::Suggestion::AutofillAiPayload, autofill::Suggestion::PaymentsPayload, autofill::Suggestion::IdentityCredentialPayload, autofill::AutocompleteEntry, base::StrongAlias, autofill::Suggestion::AtMemoryPayload> const&, std::__Cr::optional, bool, autofill::AutofillTriggerSource)+0x80c (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x9644630) #7 0x00012abad33c in autofill::AutofillExternalDelegate::DidAcceptAddressSuggestion(autofill::Suggestion const&, autofill::AutofillSuggestionDelegate::SuggestionMetadata const&)+0xdbc (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x964933c) #8 0x00012aba9b50 in autofill::AutofillExternalDelegate::DidAcceptSuggestion(autofill::Suggestion const&, autofill::AutofillSuggestionDelegate::SuggestionMetadata const&)+0x724 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x9645b50) #9 0x0001259a7c74 in autofill::AutofillPopupControllerImpl::AcceptSuggestion(int, autofill::AutofillMetrics::SuggestionAcceptedMethod)+0x51c (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x4443c74) #10 0x00012dcb261c in autofill::PopupRowView::OnMouseReleased(ui::MouseEvent const&)+0x224 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0xc74e61c) #11 0x00010a4fddcc in ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*)+0x22c (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x19dcc) #12 0x00010a4fc8e4 in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*)+0x57c (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x188e4) #13 0x00010a4fbfc0 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*)+0x1b0 (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x17fc0) #14 0x00010a4fbb18 in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)+0x1dc (/Users/ellyjones/p/cr/src/out/rel/libui_events.dylib:arm64+0x17b18) #15 0x00013fed15fc in views::internal::RootView::OnMouseReleased(ui::MouseEvent const&)+0x218 (/Users/ellyjones/p/cr/src/out/rel/libui_views.dylib:arm64+0x4b55fc) #16 0x00013ff0107c in views::Widget::OnMouseEvent(ui::MouseEvent*)+0x39c (/Users/ellyjones/p/cr/src/out/rel/libui_views.dylib:arm64+0x4e507c) #17 0x00012dca6d04 in autofill::PopupBaseView::Widget::OnMouseEvent(ui::MouseEvent*)+0x3f4 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0xc742d04) #18 0x00013ff6f09c in views::NativeWidgetMacNSWindowHost::OnMouseEvent(std::__Cr::unique_ptr>)+0xf0 (/Users/ellyjones/p/cr/src/out/rel/libui_views.dylib:arm64+0x55309c) #19 0x000141bfe44c in -[BridgedContentView mouseEvent:]+0x248 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x1244c) #20 0x000141bfbc28 in -[BridgedContentView processCapturedMouseEvent:]+0x314 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0xfc28) #21 0x000141c4ab5c in non-virtual thunk to remote_cocoa::NativeWidgetNSWindowBridge::PostCapturedEvent(NSEvent*)+0x34 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x5eb5c) #22 0x000141c1cf50 in invocation function for block in remote_cocoa::CocoaMouseCapture::ActiveEventTap::Init()+0x160 (/Users/ellyjones/p/cr/src/out/rel/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x30f50) #23 0x0001872705b8 in _NSSendEventToObservers+0xf8 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0xb05b8) #24 0x000187ca55d0 in -[NSApplication(NSEventRouting) sendEvent:]+0x70 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0xae55d0) #25 0x00012819f014 in __34-[BrowserCrApplication sendEvent:]_block_invoke+0x270 (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x6c3b014) #26 0x000107697cb8 in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/ellyjones/p/cr/src/out/rel/libbase.dylib:arm64+0x4d3cb8) #27 0x00012819e83c in -[BrowserCrApplication sendEvent:]+0x83c (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x6c3a83c) #28 0x00018773dbb8 in -[NSApplication _handleEvent:]+0x38 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x57dbb8) #29 0x0001871d87a4 in -[NSApplication run]+0x194 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x187a4) SUMMARY: AddressSanitizer: heap-use-after-free (/Users/ellyjones/p/cr/src/out/rel/libchrome_dll.dylib:arm64+0x9324e4c) in autofill::FormFiller::UndoAutofill(autofill::mojom::ActionPersistence, autofill::FormData, autofill::FormStructure&, autofill::FormFieldData const&, autofill::FillingProduct)+0x18a0 Shadow bytes around the buggy address: 0x604000cb1480: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd 0x604000cb1500: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd 0x604000cb1580: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd 0x604000cb1600: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd 0x604000cb1680: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd =>0x604000cb1700: f7 fa fd fd fd fd fd fd f7 fa fd fd fd[fd]fd fa 0x604000cb1780: f7 fa fd fd fd fd fd fa f7 fa fd fd fd fd fd fd 0x604000cb1800: f7 fa fd fd fd fd fd fa f7 fa fd fd fd fd fd fd 0x604000cb1880: f7 fa fd fd fd fd fd fa f7 fa fd fd fd fd fd fa 0x604000cb1900: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fa 0x604000cb1980: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==47396==ADDITIONAL INFO ==47396==Note: Please include this section with the ASan report. Task trace: Command line: `out/rel/Chromium.app/Contents/MacOS/Chromium --user-data-dir=/tmp/poc --flag-switches-begin --flag-switches-end` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==47396==END OF ADDITIONAL INFO ==47396==ABORTING