[POC] after:  current_generation_item_ = 0x7cec40c75000 (old struct FREED)
=================================================================
==3755==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cec40c74f4e at pc 0x5600d3ea1e7b bp 0x7fff9ec99230 sp 0x7fff9ec99228
WRITE of size 1 at 0x7cec40c74f4e thread T0 (chrome)
    #0 0x5600d3ea1e7a in autofill::PasswordGenerationAgent::PasswordNoLongerGenerated() base/auto_reset.h:62:25
    #1 0x5600d3ea9da8 in base::internal::Invoker<base::internal::FunctorTraits<autofill::PasswordGenerationAgent::DidCommitProvisionalLoad(ui::PageTransition)::$_0&&, autofill::PasswordGenerationAgent*>, base::internal::BindState<false, false, false, autofill::PasswordGenerationAgent::DidCommitProvisionalLoad(ui::PageTransition)::$_0, base::internal::UnretainedWrapper<autofill::PasswordGenerationAgent, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) components/autofill/content/renderer/password_generation_agent.cc:394:24
    #2 0x5600b99d9bf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #3 0x5600b9a51299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #4 0x5600b9a5010a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #5 0x5600b98981f7 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #6 0x5600b9a529a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #7 0x5600b9954570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #8 0x5600c5cdddcb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #9 0x5600b54f1a2f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #10 0x5600b54f2d5f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #11 0x5600b54f5a68 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #12 0x5600b54ef441 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #13 0x5600b54efa3c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #14 0x5600a1a24b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #15 0x7f7c42a2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7cec40c74f4e is located 718 bytes inside of 720-byte region [0x7cec40c74c80,0x7cec40c74f50)
freed by thread T0 (chrome) here:
    #0 0x5600a1a24002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e15002) (BuildId: 384720b479d04497)
    #1 0x5600d3ea6133 in autofill::PasswordGenerationAgent::MaybeCreateCurrentGenerationItem(blink::WebInputElement, autofill::FieldRendererId, autofill::SynchronousFormCache const&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5600d3ea1dab in autofill::PasswordGenerationAgent::PasswordNoLongerGenerated() components/autofill/content/renderer/password_generation_agent.cc:927:9
    #3 0x5600d3ea9da8 in base::internal::Invoker<base::internal::FunctorTraits<autofill::PasswordGenerationAgent::DidCommitProvisionalLoad(ui::PageTransition)::$_0&&, autofill::PasswordGenerationAgent*>, base::internal::BindState<false, false, false, autofill::PasswordGenerationAgent::DidCommitProvisionalLoad(ui::PageTransition)::$_0, base::internal::UnretainedWrapper<autofill::PasswordGenerationAgent, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) components/autofill/content/renderer/password_generation_agent.cc:394:24
    #4 0x5600b99d9bf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #5 0x5600b9a51299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #6 0x5600b9a5010a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #7 0x5600b98981f7 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #8 0x5600b9a529a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #9 0x5600b9954570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #10 0x5600c5cdddcb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #11 0x5600b54f1a2f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #12 0x5600b54f2d5f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #13 0x5600b54f5a68 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #14 0x5600b54ef441 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #15 0x5600b54efa3c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #16 0x5600a1a24b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #17 0x7f7c42a2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 (chrome) here:
    #0 0x5600a1a233fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e143fd) (BuildId: 384720b479d04497)
    #1 0x5600d3ea89ab in std::__Cr::unique_ptr<autofill::PasswordGenerationAgent::GenerationItemInfo, std::__Cr::default_delete<autofill::PasswordGenerationAgent::GenerationItemInfo>> std::__Cr::make_unique<autofill::PasswordGenerationAgent::GenerationItemInfo, blink::WebInputElement&, autofill::FormData, std::__Cr::vector<blink::WebInputElement, std::__Cr::allocator<blink::WebInputElement>>, 0>(blink::WebInputElement&, autofill::FormData&&, std::__Cr::vector<blink::WebInputElement, std::__Cr::allocator<blink::WebInputElement>>&&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x5600d3ea9c5c in base::internal::Invoker<base::internal::FunctorTraits<autofill::PasswordGenerationAgent::DidCommitProvisionalLoad(ui::PageTransition)::$_0&&, autofill::PasswordGenerationAgent*>, base::internal::BindState<false, false, false, autofill::PasswordGenerationAgent::DidCommitProvisionalLoad(ui::PageTransition)::$_0, base::internal::UnretainedWrapper<autofill::PasswordGenerationAgent, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) components/autofill/content/renderer/password_generation_agent.cc:373:21
    #3 0x5600b99d9bf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #4 0x5600b9a51299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #5 0x5600b9a5010a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #6 0x5600b98981f7 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #7 0x5600b9a529a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #8 0x5600b9954570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #9 0x5600c5cdddcb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #10 0x5600b54f1a2f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #11 0x5600b54f2d5f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #12 0x5600b54f5a68 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #13 0x5600b54ef441 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #14 0x5600b54efa3c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #15 0x5600a1a24b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #16 0x7f7c42a2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free base/auto_reset.h:62:25 in autofill::PasswordGenerationAgent::PasswordNoLongerGenerated()
Shadow bytes around the buggy address:
  0x7cec40c74c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cec40c74d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cec40c74d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cec40c74e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cec40c74e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7cec40c74f00: fd fd fd fd fd fd fd fd fd[fd]fa fa fa fa fa fa
  0x7cec40c74f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x7cec40c75000: 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 02
  0x7cec40c75080: fc 00 00 06 00 00 00 00 01 fc 00 00 00 00 00 00
  0x7cec40c75100: 00 00 00 00 00 00 00 01 fc 00 00 00 00 00 00 00
  0x7cec40c75180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==3755==ADDITIONAL INFO

==3755==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5600d3ea10f8 in autofill::PasswordGenerationAgent::DidCommitProvisionalLoad(ui::PageTransition) components/autofill/content/renderer/password_generation_agent.cc:322:11
    #1 0x5600bd6b96b7 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=3676 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1775028800899198 --launch-time-ticks=141668192716 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,9186104384831959445,3710735855520923482,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,11069573990488481324,12598367560681026764,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==3755==END OF ADDITIONAL INFO

==3755==ABORTING