==1367==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c140245c938 at pc 0x5646aab3f10f bp 0x7bd3f655faf0 sp 0x7bd3f655fae8
READ of size 8 at 0x7c140245c938 thread T7 (Chrome_ChildIOT)
    #0 0x5646aab3f10e in net::SpdySession::CloseActiveStreamIterator(std::__Cr::__map_iterator<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>>, int) net/spdy/spdy_session.cc:1844:48
    #1 0x5646aab56c29 in net::SpdySession::OnWindowUpdate(unsigned int, int) net/spdy/spdy_session.cc:1892:3
    #2 0x5646aaf4cd4f in http2::WindowUpdatePayloadDecoder::StartDecodingPayload(http2::FrameDecoderState*, http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/payload_decoders/window_update_payload_decoder.cc
    #3 0x5646aaf42fde in http2::Http2FrameDecoder::StartDecodingPayload(http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/http2_frame_decoder.cc:425:41
    #4 0x5646aaf426c5 in http2::Http2FrameDecoder::DecodeFrame(http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/http2_frame_decoder.cc:57:16
    #5 0x5646aaf1e7bc in http2::Http2DecoderAdapter::ProcessInputFrame(char const*, unsigned long) net/third_party/quiche/src/quiche/http2/core/http2_frame_decoder_adapter.cc:800:40
    #6 0x5646aaf1e5c2 in http2::Http2DecoderAdapter::ProcessInput(char const*, unsigned long) net/third_party/quiche/src/quiche/http2/core/http2_frame_decoder_adapter.cc:272:30
    #7 0x5646aab4b0af in net::SpdySession::DoReadComplete(int) net/spdy/spdy_session.cc:2049:53
    #8 0x5646aab4996c in net::SpdySession::DoReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1967:18
    #9 0x5646aab460f2 in net::SpdySession::PumpReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1943:17
    #10 0x5646aab5f1a1 in base::internal::Invoker<base::internal::FunctorTraits<void (net::SpdySession::*&&)(net::SpdySession::ReadState, int), base::WeakPtr<net::SpdySession>&&, net::SpdySession::ReadState&&>, base::internal::BindState<true, true, false, void (net::SpdySession::*)(net::SpdySession::ReadState, int), base::WeakPtr<net::SpdySession>, net::SpdySession::ReadState>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #11 0x5646aaa73804 in net::SSLClientSocketImpl::DoReadCallback(int) base/functional/callback.h:155:12
    #12 0x5646aaa72c58 in net::SSLClientSocketImpl::RetryAllOperations() net/socket/ssl_client_socket_impl.cc:1501:5
    #13 0x5646aaa801b0 in net::SocketBIOAdapter::OnSocketReadIfReadyComplete(int) net/socket/socket_bio_adapter.cc:212:14
    #14 0x5646aaa83724 in base::internal::Invoker<base::internal::FunctorTraits<void (net::SocketBIOAdapter::*&&)(int), base::WeakPtr<net::SocketBIOAdapter>&&>, base::internal::BindState<true, true, false, void (net::SocketBIOAdapter::*)(int), base::WeakPtr<net::SocketBIOAdapter>>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #15 0x5646aaaa7728 in net::TCPClientSocket::DidCompleteRead(int) base/functional/callback.h:155:12
    #16 0x5646aaaaa966 in base::internal::Invoker<base::internal::FunctorTraits<void (net::TCPClientSocket::*&&)(int), net::TCPClientSocket*>, base::internal::BindState<true, true, false, void (net::TCPClientSocket::*)(int), base::internal::UnretainedWrapper<net::TCPClientSocket, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #17 0x5646aac74a9c in net::TCPSocketPosix::ReadIfReadyCompleted(base::OnceCallback<void (int)>, int) base/functional/callback.h:155:12
    #18 0x5646aac77bf0 in base::internal::Invoker<base::internal::FunctorTraits<void (net::TCPSocketPosix::*&&)(base::OnceCallback<void (int)>, int), net::TCPSocketPosix*, base::OnceCallback<void (int)>&&>, base::internal::BindState<true, true, false, void (net::TCPSocketPosix::*)(base::OnceCallback<void (int)>, int), base::internal::UnretainedWrapper<net::TCPSocketPosix, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::OnceCallback<void (int)>>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #19 0x5646aac7d71d in net::SocketPosix::OnFileCanReadWithoutBlocking(int) base/functional/callback.h:155:12
    #20 0x5646a999373d in base::MessagePumpEpoll::HandleEvent(int, bool, bool, base::MessagePumpEpoll::FdWatchController*) base/message_loop/message_pump_epoll.cc:760:13
    #21 0x5646a9992707 in base::MessagePumpEpoll::OnEpollEvent(base::MessagePumpEpoll::EpollEventEntry&, unsigned int) base/message_loop/message_pump_epoll.cc:614:7
    #22 0x5646a99908a3 in base::MessagePumpEpoll::WaitForEpollEvents(base::TimeDelta) base/message_loop/message_pump_epoll.cc:506:7
    #23 0x5646a998f408 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:285:5
    #24 0x5646a980a9a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #25 0x5646a970c570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #26 0x5646a98971cc in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:355:13
    #27 0x5646b586dd53 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19
    #28 0x5646a9897767 in base::Thread::ThreadMain() base/threading/thread.cc:425:3
    #29 0x5646a98fb4be in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #30 0x56469179fc46 in asan_thread_start(void*) asan_interceptors.cpp

0x7c140245c938 is located 40 bytes inside of 48-byte region [0x7c140245c910,0x7c140245c940)
freed by thread T7 (Chrome_ChildIOT) here:
    #0 0x5646917dc002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e14002) (BuildId: da0ee3b2563a2e85)
    #1 0x5646aab3ed08 in net::SpdySession::CloseActiveStreamIterator(std::__Cr::__map_iterator<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>>, int) gen/third_party/libc++/src/include/__new/allocate.h:63:10
    #2 0x5646aab413b0 in net::SpdySession::StartGoingAway(unsigned int, net::Error) net/spdy/spdy_session.cc:1389:5
    #3 0x5646aab3a2d8 in net::SpdySession::DoDrainSession(net::Error, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, bool) net/spdy/spdy_session.cc:2724:5
    #4 0x5646aab48b7e in net::SpdySession::EnqueueSessionWrite(net::RequestPriority, spdy::SpdyFrameType, std::__Cr::unique_ptr<spdy::SpdySerializedFrame, std::__Cr::default_delete<spdy::SpdySerializedFrame>>) net/spdy/spdy_session.cc:2546:5
    #5 0x5646aab485c0 in net::SpdySession::EnqueueResetStreamFrame(unsigned int, net::RequestPriority, spdy::SpdyErrorCode, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) net/spdy/spdy_session.cc:1909:3
    #6 0x5646aab56c19 in net::SpdySession::OnWindowUpdate(unsigned int, int) net/spdy/spdy_session.cc:1888:3
    #7 0x5646aaf4cd4f in http2::WindowUpdatePayloadDecoder::StartDecodingPayload(http2::FrameDecoderState*, http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/payload_decoders/window_update_payload_decoder.cc
    #8 0x5646aaf42fde in http2::Http2FrameDecoder::StartDecodingPayload(http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/http2_frame_decoder.cc:425:41
    #9 0x5646aaf426c5 in http2::Http2FrameDecoder::DecodeFrame(http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/http2_frame_decoder.cc:57:16
    #10 0x5646aaf1e7bc in http2::Http2DecoderAdapter::ProcessInputFrame(char const*, unsigned long) net/third_party/quiche/src/quiche/http2/core/http2_frame_decoder_adapter.cc:800:40
    #11 0x5646aaf1e5c2 in http2::Http2DecoderAdapter::ProcessInput(char const*, unsigned long) net/third_party/quiche/src/quiche/http2/core/http2_frame_decoder_adapter.cc:272:30
    #12 0x5646aab4b0af in net::SpdySession::DoReadComplete(int) net/spdy/spdy_session.cc:2049:53
    #13 0x5646aab4996c in net::SpdySession::DoReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1967:18
    #14 0x5646aab460f2 in net::SpdySession::PumpReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1943:17
    #15 0x5646aab5f1a1 in base::internal::Invoker<base::internal::FunctorTraits<void (net::SpdySession::*&&)(net::SpdySession::ReadState, int), base::WeakPtr<net::SpdySession>&&, net::SpdySession::ReadState&&>, base::internal::BindState<true, true, false, void (net::SpdySession::*)(net::SpdySession::ReadState, int), base::WeakPtr<net::SpdySession>, net::SpdySession::ReadState>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #16 0x5646aaa73804 in net::SSLClientSocketImpl::DoReadCallback(int) base/functional/callback.h:155:12
    #17 0x5646aaa72c58 in net::SSLClientSocketImpl::RetryAllOperations() net/socket/ssl_client_socket_impl.cc:1501:5
    #18 0x5646aaa801b0 in net::SocketBIOAdapter::OnSocketReadIfReadyComplete(int) net/socket/socket_bio_adapter.cc:212:14
    #19 0x5646aaa83724 in base::internal::Invoker<base::internal::FunctorTraits<void (net::SocketBIOAdapter::*&&)(int), base::WeakPtr<net::SocketBIOAdapter>&&>, base::internal::BindState<true, true, false, void (net::SocketBIOAdapter::*)(int), base::WeakPtr<net::SocketBIOAdapter>>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #20 0x5646aaaa7728 in net::TCPClientSocket::DidCompleteRead(int) base/functional/callback.h:155:12
    #21 0x5646aaaaa966 in base::internal::Invoker<base::internal::FunctorTraits<void (net::TCPClientSocket::*&&)(int), net::TCPClientSocket*>, base::internal::BindState<true, true, false, void (net::TCPClientSocket::*)(int), base::internal::UnretainedWrapper<net::TCPClientSocket, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #22 0x5646aac74a9c in net::TCPSocketPosix::ReadIfReadyCompleted(base::OnceCallback<void (int)>, int) base/functional/callback.h:155:12
    #23 0x5646aac77bf0 in base::internal::Invoker<base::internal::FunctorTraits<void (net::TCPSocketPosix::*&&)(base::OnceCallback<void (int)>, int), net::TCPSocketPosix*, base::OnceCallback<void (int)>&&>, base::internal::BindState<true, true, false, void (net::TCPSocketPosix::*)(base::OnceCallback<void (int)>, int), base::internal::UnretainedWrapper<net::TCPSocketPosix, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::OnceCallback<void (int)>>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #24 0x5646aac7d71d in net::SocketPosix::OnFileCanReadWithoutBlocking(int) base/functional/callback.h:155:12
    #25 0x5646a999373d in base::MessagePumpEpoll::HandleEvent(int, bool, bool, base::MessagePumpEpoll::FdWatchController*) base/message_loop/message_pump_epoll.cc:760:13
    #26 0x5646a9992707 in base::MessagePumpEpoll::OnEpollEvent(base::MessagePumpEpoll::EpollEventEntry&, unsigned int) base/message_loop/message_pump_epoll.cc:614:7
    #27 0x5646a99908a3 in base::MessagePumpEpoll::WaitForEpollEvents(base::TimeDelta) base/message_loop/message_pump_epoll.cc:506:7
    #28 0x5646a998f408 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:285:5
    #29 0x5646a980a9a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12

previously allocated by thread T7 (Chrome_ChildIOT) here:
    #0 0x5646917db3fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e133fd) (BuildId: da0ee3b2563a2e85)
    #1 0x5646aab6a147 in std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>, bool> std::__Cr::__try_key_extraction_impl<unsigned int, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>, bool>, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__map_value_compare<unsigned int, std::__Cr::pair<unsigned int const, net::SpdyStream*>, std::__Cr::less<unsigned int>>, std::__Cr::allocator<std::__Cr::pair<unsigned int const, net::SpdyStream*>>>::__emplace_unique<unsigned int&, net::SpdyStream*>(unsigned int&, net::SpdyStream*&&)::'lambda'(unsigned int const&, unsigned int&, net::SpdyStream*&&), std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__map_value_compare<unsigned int, std::__Cr::pair<unsigned int const, net::SpdyStream*>, std::__Cr::less<unsigned int>>, std::__Cr::allocator<std::__Cr::pair<unsigned int const, net::SpdyStream*>>>::__emplace_unique<unsigned int&, net::SpdyStream*>(unsigned int&, net::SpdyStream*&&)::'lambda'(unsigned int&, net::SpdyStream*&&), unsigned int&, net::SpdyStream*, 0>(std::__Cr::__priority_tag<1ul>, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__map_value_compare<unsigned int, std::__Cr::pair<unsigned int const, net::SpdyStream*>, std::__Cr::less<unsigned int>>, std::__Cr::allocator<std::__Cr::pair<unsigned int const, net::SpdyStream*>>>::__emplace_unique<unsigned int&, net::SpdyStream*>(unsigned int&, net::SpdyStream*&&)::'lambda'(unsigned int const&, unsigned int&, net::SpdyStream*&&), std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__map_value_compare<unsigned int, std::__Cr::pair<unsigned int const, net::SpdyStream*>, std::__Cr::less<unsigned int>>, std::__Cr::allocator<std::__Cr::pair<unsigned int const, net::SpdyStream*>>>::__emplace_unique<unsigned int&, net::SpdyStream*>(unsigned int&, net::SpdyStream*&&)::'lambda'(unsigned int&, net::SpdyStream*&&), unsigned int&, net::SpdyStream*&&) gen/third_party/libc++/src/include/__new/allocate.h:43:28
    #2 0x5646aab4eded in net::SpdySession::InsertActivatedStream(std::__Cr::unique_ptr<net::SpdyStream, std::__Cr::default_delete<net::SpdyStream>>) gen/third_party/libc++/src/include/__utility/try_key_extraction.h:108:10
    #3 0x5646aab4cffd in net::SpdySession::DoWrite() net/spdy/spdy_session.cc:2154:7
    #4 0x5646aab4c206 in net::SpdySession::DoWriteLoop(net::SpdySession::WriteState, int) net/spdy/spdy_session.cc:2102:18
    #5 0x5646aab4bcbb in net::SpdySession::PumpWriteLoop(net::SpdySession::WriteState, int) net/spdy/spdy_session.cc:2070:3
    #6 0x5646aab5f6e1 in base::internal::Invoker<base::internal::FunctorTraits<void (net::SpdySession::*&&)(net::SpdySession::WriteState, int), base::WeakPtr<net::SpdySession>&&, net::SpdySession::WriteState&&, net::Error&&>, base::internal::BindState<true, true, false, void (net::SpdySession::*)(net::SpdySession::WriteState, int), base::WeakPtr<net::SpdySession>, net::SpdySession::WriteState, net::Error>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #7 0x5646a9791bf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #8 0x5646a9809299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #9 0x5646a980810a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #10 0x5646a998f476 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55
    #11 0x5646a980a9a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #12 0x5646a970c570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #13 0x5646a98971cc in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:355:13
    #14 0x5646b586dd53 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19
    #15 0x5646a9897767 in base::Thread::ThreadMain() base/threading/thread.cc:425:3
    #16 0x5646a98fb4be in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #17 0x56469179fc46 in asan_thread_start(void*) asan_interceptors.cpp

Thread T7 (Chrome_ChildIOT) created by T0 (chrome) here:
    #0 0x564691785a71 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10dbda71) (BuildId: da0ee3b2563a2e85)
    #1 0x5646a98fab12 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x5646a9896408 in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:231:26
    #3 0x5646b586cad1 in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>, bool) content/child/child_process.cc:152:21
    #4 0x5646a25a9537 in content::UtilityMain(content::MainFunctionParams) content/utility/utility_main.cc:459:16
    #5 0x5646a52aabb5 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:762:14
    #6 0x5646a52ada68 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #7 0x5646a52a7441 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #8 0x5646a52a7a3c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #9 0x5646917dcb39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #10 0x7fd40442b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free net/spdy/spdy_session.cc:1844:48 in net::SpdySession::CloseActiveStreamIterator(std::__Cr::__map_iterator<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>>, int)
Shadow bytes around the buggy address:
  0x7c140245c680: f7 fa 00 00 00 00 00 01 f7 fa 00 00 00 00 00 fa
  0x7c140245c700: f7 fa 00 00 00 00 07 fa f7 fa 00 00 00 00 00 fa
  0x7c140245c780: f7 fa 00 00 00 00 03 fa f7 fa 00 00 00 00 00 fa
  0x7c140245c800: f7 fa 00 00 00 00 00 fa f7 fa 00 00 00 00 00 fa
  0x7c140245c880: f7 fa fd fd fd fd fd fa f7 fa fd fd fd fd fd fd
=>0x7c140245c900: f7 fa fd fd fd fd fd[fd]f7 fa fd fd fd fd fd fd
  0x7c140245c980: f7 fa 00 03 00 00 07 00 f7 fa fd fd fd fd fd fa
  0x7c140245ca00: f7 fa fd fd fd fd fd fd f7 fa 00 00 00 00 00 01
  0x7c140245ca80: f7 fa 00 02 00 00 00 00 f7 fa 00 00 00 03 fc 00
  0x7c140245cb00: f7 fa 00 00 00 00 fc 00 f7 fa 00 00 00 00 07 00
  0x7c140245cb80: f7 fa 00 00 00 02 fc 00 f7 fa 00 03 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==1367==ADDITIONAL INFO

==1367==Note: Please include this section with the ASan report.
Task trace:


Command line: `/proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --ignore-certificate-errors --crashpad-handler-pid=1333 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,6044796035962995963,18117500950329243002,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,9982680213860289981,15550748863475580697,4 --trace-process-track-uuid=3190708989122997041`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==1367==END OF ADDITIONAL INFO

==1367==ABORTING