[633819:633819:0409/215752.653729:ERROR:base/memory/shared_memory_switch.cc:289] Failed global descriptor lookup: 7 [633743:633773:0409/215756.661837:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT [634158:634158:0409/215759.330668:ERROR:base/memory/shared_memory_switch.cc:289] Failed global descriptor lookup: 7 [634165:634165:0409/215759.740691:ERROR:base/memory/shared_memory_switch.cc:289] Failed global descriptor lookup: 7 [633861:15:0409/215803.349682:ERROR:third_party/webrtc/media/engine/simulcast_encoder_adapter.cc:201] [SEA] StreamContext ctor parent is null [633861:4:0409/215803.351193:ERROR:third_party/webrtc/media/engine/simulcast_encoder_adapter.cc:201] [SEA] StreamContext ctor parent is null [633861:6:0409/215803.354544:ERROR:third_party/webrtc/media/engine/simulcast_encoder_adapter.cc:201] [SEA] StreamContext ctor parent is null [633743:633857:0409/215822.780153:ERROR:content/browser/browser_main_loop.cc:290] GLib: g_main_context_pop_thread_default: assertion 'stack != NULL' failed [633743:633856:0409/215822.780151:ERROR:content/browser/browser_main_loop.cc:290] GLib: g_main_context_pop_thread_default: assertion 'stack != NULL' failed [633743:633855:0409/215822.780152:ERROR:content/browser/browser_main_loop.cc:290] GLib: g_main_context_pop_thread_default: assertion 'stack != NULL' failed [633743:633773:0409/215824.318802:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT ================================================================= ==633743==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d67e27518c0 at pc 0x5570ae8db13c bp 0x7ffeaf3538d0 sp 0x7ffeaf3538c8 READ of size 8 at 0x7d67e27518c0 thread T0 (chrome) #0 0x5570ae8db13b in webrtc::SharedScreenCastStreamPrivate::StartScreenCastStream(unsigned int, int, unsigned int, unsigned int, bool, webrtc::DesktopCapturer::Callback*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:285:21 #1 0x5570ae8c6dd3 in webrtc::BaseCapturerPipeWire::OnScreenCastRequestResult(webrtc::xdg_portal::RequestResponse, unsigned int, int) third_party/webrtc/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc:91:38 #2 0x5570ae8cb908 in webrtc::ScreenCastPortal::OnPortalDone(webrtc::xdg_portal::RequestResponse) third_party/webrtc/modules/desktop_capture/linux/wayland/screencast_portal.cc:147:14 #3 0x5570ae8cdca4 in webrtc::ScreenCastPortal::OnOpenPipeWireRemoteRequested(_GDBusProxy*, _GAsyncResult*, void*) third_party/webrtc/modules/desktop_capture/linux/wayland/screencast_portal.cc #4 0x7ff7e50c194b (/usr/lib/libgio-2.0.so.0+0xa894b) (BuildId: 92572ec52352bd90df624e8870c2ad1f51a8e709) #5 0x7ff7e50c73b1 (/usr/lib/libgio-2.0.so.0+0xae3b1) (BuildId: 92572ec52352bd90df624e8870c2ad1f51a8e709) #6 0x7ff7e513ad3d (/usr/lib/libgio-2.0.so.0+0x121d3d) (BuildId: 92572ec52352bd90df624e8870c2ad1f51a8e709) #7 0x7ff7e50c194b (/usr/lib/libgio-2.0.so.0+0xa894b) (BuildId: 92572ec52352bd90df624e8870c2ad1f51a8e709) #8 0x7ff7e50c73b1 (/usr/lib/libgio-2.0.so.0+0xae3b1) (BuildId: 92572ec52352bd90df624e8870c2ad1f51a8e709) #9 0x7ff7e51310f2 (/usr/lib/libgio-2.0.so.0+0x1180f2) (BuildId: 92572ec52352bd90df624e8870c2ad1f51a8e709) #10 0x7ff7e50c194b (/usr/lib/libgio-2.0.so.0+0xa894b) (BuildId: 92572ec52352bd90df624e8870c2ad1f51a8e709) #11 0x7ff7e50c1994 (/usr/lib/libgio-2.0.so.0+0xa8994) (BuildId: 92572ec52352bd90df624e8870c2ad1f51a8e709) #12 0x7ff7e549bf4c (/usr/lib/libglib-2.0.so.0+0x5ef4c) (BuildId: acd0a84f7025e42789f3e327195a209a4fed6c3f) #13 0x7ff7e549d616 (/usr/lib/libglib-2.0.so.0+0x60616) (BuildId: acd0a84f7025e42789f3e327195a209a4fed6c3f) #14 0x7ff7e549d824 in g_main_context_iteration (/usr/lib/libglib-2.0.so.0+0x60824) (BuildId: acd0a84f7025e42789f3e327195a209a4fed6c3f) #15 0x5570a9e16773 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:770:30 #16 0x5570a9c6e857 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:647:12 #17 0x5570a9b70fd0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #18 0x55709db9dc0c in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1117:18 #19 0x55709dba63ac in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15 #20 0x55709db9452c in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28 #21 0x5570a592a0df in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:696:10 #22 0x5570a592df44 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1312:10 #23 0x5570a592d45a in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1145:12 #24 0x5570a5926f01 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #25 0x5570a59274fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 #26 0x55709280d279 in ChromeMain chrome/app/chrome_main.cc:191:12 #27 0x7ff7e40366c0 (/usr/lib/libc.so.6+0x276c0) (BuildId: 7a8d41a2df4fde040b4c6ac2832311ab645a1e41) #28 0x7ff7e40367f8 in __libc_start_main (/usr/lib/libc.so.6+0x277f8) (BuildId: 7a8d41a2df4fde040b4c6ac2832311ab645a1e41) #29 0x557092730029 in _start (/home/user/projects/chromecrash/asan/chromium-146.0.7680.177-linux-asan/chrome+0x10c27029) (BuildId: 46d49f5b6958dc43) 0x7d67e27518c0 is located 192 bytes inside of 712-byte region [0x7d67e2751800,0x7d67e2751ac8) freed by thread T579 (desktopCaptureT) here: #0 0x55709280c742 in operator delete(void*, unsigned long) (/home/user/projects/chromecrash/asan/chromium-146.0.7680.177-linux-asan/chrome+0x10d03742) (BuildId: 46d49f5b6958dc43) #1 0x5570ae8af30c in webrtc::DesktopCaptureOptions::~DesktopCaptureOptions() third_party/webrtc/api/ref_counted_base.h:81:7 #2 0x5570ae8c688a in webrtc::BaseCapturerPipeWire::~BaseCapturerPipeWire() third_party/webrtc/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc:79:1 #3 0x5570ae8ace15 in webrtc::DesktopAndCursorComposer::~DesktopAndCursorComposer() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #4 0x55709fdc9eb7 in content::DesktopCaptureDevice::Core::~Core() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #5 0x55709fdca3d3 in content::DesktopCaptureDevice::Core::~Core() content/browser/media/capture/desktop_capture_device.cc:436:37 #6 0x5570a9c834be in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #7 0x5570a9bf5d26 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #8 0x5570a9c6d167 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #9 0x5570a9c6c03a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40 #10 0x5570a9ab6799 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #11 0x5570a9c6e857 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:647:12 #12 0x5570a9b70fd0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #13 0x5570a9cf78bc in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:361:13 #14 0x5570a9cf7ec1 in base::Thread::ThreadMain() base/threading/thread.cc:436:3 #15 0x5570a9d5b07e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #16 0x5570927cfc66 in asan_thread_start(void*) asan_interceptors.cpp previously allocated by thread T55 (VideoCaptureThr) here: #0 0x55709280bb3d in operator new(unsigned long) (/home/user/projects/chromecrash/asan/chromium-146.0.7680.177-linux-asan/chrome+0x10d02b3d) (BuildId: 46d49f5b6958dc43) #1 0x5570ae8dd15b in webrtc::SharedScreenCastStream::CreateDefault() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x5570ae8af9ce in webrtc::DesktopCaptureOptions::CreateDefault() third_party/webrtc/modules/desktop_capture/desktop_capture_options.cc:46:32 #3 0x557093df81e3 in content::desktop_capture::CreateDesktopCaptureOptions() content/public/browser/desktop_capture.cc:57:18 #4 0x55709fdd01ca in content::DesktopCaptureDevice::Create(content::DesktopMediaID const&, media::VideoCaptureDevice::Client*) content/browser/media/capture/desktop_capture_device.cc:942:18 #5 0x55709ee44675 in content::InProcessVideoCaptureDeviceLauncher::OnPipScreenCaptureCoordinatorProxyCreated(content::DesktopMediaID const&, media::VideoCaptureParams const&, std::__Cr::unique_ptr>, base::OnceCallback>)>, std::__Cr::unique_ptr>) content/browser/renderer_host/media/in_process_video_capture_device_launcher.cc:212:21 #6 0x55709ee4413e in content::InProcessVideoCaptureDeviceLauncher::DoStartDesktopCaptureOnDeviceThread(content::DesktopMediaID const&, media::VideoCaptureParams const&, std::__Cr::unique_ptr>, base::OnceCallback>)>) content/browser/renderer_host/media/in_process_video_capture_device_launcher.cc:523:3 #7 0x55709ee4680c in base::internal::Invoker>, base::OnceCallback>)>), content::InProcessVideoCaptureDeviceLauncher*, content::DesktopMediaID&&, media::VideoCaptureParams&&, std::__Cr::unique_ptr>&&, base::OnceCallback>)>&&>, base::internal::BindState>, base::OnceCallback>)>), base::internal::UnretainedWrapper, content::DesktopMediaID, media::VideoCaptureParams, std::__Cr::unique_ptr>, base::OnceCallback>)>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #8 0x5570a9bf5d26 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #9 0x5570a9c6d167 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #10 0x5570a9c6c03a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40 #11 0x5570a9ab6799 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #12 0x5570a9c6e857 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:647:12 #13 0x5570a9b70fd0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #14 0x5570a9cf78bc in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:361:13 #15 0x5570a9cf7ec1 in base::Thread::ThreadMain() base/threading/thread.cc:436:3 #16 0x5570a9d5b07e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #17 0x5570927cfc66 in asan_thread_start(void*) asan_interceptors.cpp Thread T579 (desktopCaptureT) created by T55 (VideoCaptureThr) here: #0 0x5570927b5a21 in pthread_create (/home/user/projects/chromecrash/asan/chromium-146.0.7680.177-linux-asan/chrome+0x10caca21) (BuildId: 46d49f5b6958dc43) #1 0x5570a9d5a6d2 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x5570a9cf6ab5 in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:228:26 #3 0x55709fdd1ea5 in content::DesktopCaptureDevice::DesktopCaptureDevice(std::__Cr::unique_ptr>, content::DesktopMediaID::Type) content/browser/media/capture/desktop_capture_device.cc:1127:11 #4 0x55709fdd0554 in content::DesktopCaptureDevice::Create(content::DesktopMediaID const&, media::VideoCaptureDevice::Client*) content/browser/media/capture/desktop_capture_device.cc #5 0x55709ee44675 in content::InProcessVideoCaptureDeviceLauncher::OnPipScreenCaptureCoordinatorProxyCreated(content::DesktopMediaID const&, media::VideoCaptureParams const&, std::__Cr::unique_ptr>, base::OnceCallback>)>, std::__Cr::unique_ptr>) content/browser/renderer_host/media/in_process_video_capture_device_launcher.cc:212:21 #6 0x55709ee4413e in content::InProcessVideoCaptureDeviceLauncher::DoStartDesktopCaptureOnDeviceThread(content::DesktopMediaID const&, media::VideoCaptureParams const&, std::__Cr::unique_ptr>, base::OnceCallback>)>) content/browser/renderer_host/media/in_process_video_capture_device_launcher.cc:523:3 #7 0x55709ee4680c in base::internal::Invoker>, base::OnceCallback>)>), content::InProcessVideoCaptureDeviceLauncher*, content::DesktopMediaID&&, media::VideoCaptureParams&&, std::__Cr::unique_ptr>&&, base::OnceCallback>)>&&>, base::internal::BindState>, base::OnceCallback>)>), base::internal::UnretainedWrapper, content::DesktopMediaID, media::VideoCaptureParams, std::__Cr::unique_ptr>, base::OnceCallback>)>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #8 0x5570a9bf5d26 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #9 0x5570a9c6d167 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #10 0x5570a9c6c03a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40 #11 0x5570a9ab6799 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #12 0x5570a9c6e857 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:647:12 #13 0x5570a9b70fd0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #14 0x5570a9cf78bc in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:361:13 #15 0x5570a9cf7ec1 in base::Thread::ThreadMain() base/threading/thread.cc:436:3 #16 0x5570a9d5b07e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #17 0x5570927cfc66 in asan_thread_start(void*) asan_interceptors.cpp Thread T55 (VideoCaptureThr) created by T0 (chrome) here: #0 0x5570927b5a21 in pthread_create (/home/user/projects/chromecrash/asan/chromium-146.0.7680.177-linux-asan/chrome+0x10caca21) (BuildId: 46d49f5b6958dc43) #1 0x5570a9d5a6d2 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x5570a9cf6ab5 in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:228:26 #3 0x55709eea893f in content::MediaStreamManager::MediaStreamManager(media::AudioSystem*, std::__Cr::unique_ptr>) content/browser/renderer_host/media/media_stream_manager.cc:1598:34 #4 0x55709eea7fa7 in content::MediaStreamManager::MediaStreamManager(media::AudioSystem*) content/browser/renderer_host/media/media_stream_manager.cc:1534:7 #5 0x55709db9c7d2 in content::BrowserMainLoop::PostCreateThreadsImpl() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30 #6 0x55709db9ab8c in content::BrowserMainLoop::PostCreateThreads() content/browser/browser_main_loop.cc:992:3 #7 0x55709dba26c1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #8 0x55709f87966d in content::StartupTaskRunner::RunAllTasksNow(bool) base/functional/callback.h:155:12 #9 0x55709db99e15 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:923:25 #10 0x55709dba5aaf in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams) content/browser/browser_main_runner_impl.cc:138:15 #11 0x55709db9448a in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:28:32 #12 0x5570a592a0df in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:696:10 #13 0x5570a592df44 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1312:10 #14 0x5570a592d45a in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1145:12 #15 0x5570a5926f01 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #16 0x5570a59274fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 #17 0x55709280d279 in ChromeMain chrome/app/chrome_main.cc:191:12 #18 0x7ff7e40366c0 (/usr/lib/libc.so.6+0x276c0) (BuildId: 7a8d41a2df4fde040b4c6ac2832311ab645a1e41) #19 0x7ff7e40367f8 in __libc_start_main (/usr/lib/libc.so.6+0x277f8) (BuildId: 7a8d41a2df4fde040b4c6ac2832311ab645a1e41) #20 0x557092730029 in _start (/home/user/projects/chromecrash/asan/chromium-146.0.7680.177-linux-asan/chrome+0x10c27029) (BuildId: 46d49f5b6958dc43) SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__memory/unique_ptr.h:285:21 in webrtc::SharedScreenCastStreamPrivate::StartScreenCastStream(unsigned int, int, unsigned int, unsigned int, bool, webrtc::DesktopCapturer::Callback*) Shadow bytes around the buggy address: 0x7d67e2751600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7d67e2751680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7d67e2751700: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa 0x7d67e2751780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x7d67e2751800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x7d67e2751880: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd 0x7d67e2751900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d67e2751980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d67e2751a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7d67e2751a80: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x7d67e2751b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==633743==ADDITIONAL INFO ==633743==Note: Please include this section with the ASan report. Task trace: Command line: `./chrome --flag-switches-begin --unsafely-treat-insecure-origin-as-secure --flag-switches-end --ozone-platform=wayland --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --render-node-override=/dev/dri/renderD129 --file-url-path-alias=/gen=/home/user/projects/chromecrash/asan/chromium-146.0.7680.177-linux-asan/gen ../../repro-asan.html` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==633743==END OF ADDITIONAL INFO ==633743==ABORTING [634165:634165:0409/215912.232048:ERROR:gpu/ipc/client/command_buffer_proxy_impl.cc:484] GPU state invalid after WaitForGetOffsetInRange.