==9864==ERROR: AddressSanitizer: heap-use-after-free on address 0x7bda2de8d830 at pc 0x55de38ed00c4 bp 0x7ba9974cd4f0 sp 0x7ba9974cd4e8
READ of size 4 at 0x7bda2de8d830 thread T9 (Compositor)
    #0 0x55de38ed00c3 in cc::DrawVerticesOp::~DrawVerticesOp() cc/paint/paint_op.cc:2672:20
    #1 0x55de38f188a6 in cc::PaintOpBuffer::DestroyOps() cc/paint/paint_op_buffer.cc:279:11
    #2 0x55de38f18a40 in cc::PaintOpBuffer::~PaintOpBuffer() cc/paint/paint_op_buffer.cc:248:3
    #3 0x55de38f188a6 in cc::PaintOpBuffer::DestroyOps() cc/paint/paint_op_buffer.cc:279:11
    #4 0x55de38f18a40 in cc::PaintOpBuffer::~PaintOpBuffer() cc/paint/paint_op_buffer.cc:248:3
    #5 0x55de38f6c25b in cc::PaintShader::~PaintShader() gen/third_party/libc++/src/include/optional:387:15
    #6 0x55de38f6c323 in cc::PaintShader::~PaintShader() cc/paint/paint_shader.cc:317:27
    #7 0x55de38eaa9a6 in cc::PaintFlags::~PaintFlags() third_party/skia/include/core/SkRefCnt.h:78:19
    #8 0x55de38f188a6 in cc::PaintOpBuffer::DestroyOps() cc/paint/paint_op_buffer.cc:279:11
    #9 0x55de38f18a40 in cc::PaintOpBuffer::~PaintOpBuffer() cc/paint/paint_op_buffer.cc:248:3
    #10 0x55de38f188a6 in cc::PaintOpBuffer::DestroyOps() cc/paint/paint_op_buffer.cc:279:11
    #11 0x55de38f18690 in cc::PaintOpBuffer::~PaintOpBuffer() cc/paint/paint_op_buffer.cc:248:3
    #12 0x55de38ef1b53 in cc::DisplayItemList::~DisplayItemList() cc/paint/display_item_list.cc:82:35
    #13 0x55de3b2ef5d5 in cc::RasterSource::~RasterSource() base/memory/ref_counted.h:438:5
    #14 0x55de3b2ef643 in cc::RasterSource::~RasterSource() cc/raster/raster_source.cc:42:29
    #15 0x55de3b3094e3 in cc::PictureLayerTiling::SetRasterSourceAndResize(scoped_refptr<cc::RasterSource>) base/memory/ref_counted.h:438:5
    #16 0x55de3b308d25 in cc::PictureLayerTiling::TakeTilesAndPropertiesFrom(cc::PictureLayerTiling*, cc::Region const&) cc/tiles/picture_layer_tiling.cc:141:3
    #17 0x55de3b31ae12 in cc::PictureLayerTilingSet::CopyTilingsAndPropertiesFromPendingTwin(cc::PictureLayerTilingSet const*, scoped_refptr<cc::RasterSource>, cc::Region const&) cc/tiles/picture_layer_tiling_set.cc:110:18
    #18 0x55de3b31baa1 in cc::PictureLayerTilingSet::UpdateTilingsToCurrentRasterSourceForActivation(scoped_refptr<cc::RasterSource>, cc::PictureLayerTilingSet const*, cc::Region const&, float, float) cc/tiles/picture_layer_tiling_set.cc:134:3
    #19 0x55de3b2bbc69 in cc::PictureLayerImpl::UpdateRasterSourceInternal(scoped_refptr<cc::RasterSource>, cc::Region, cc::PictureLayerTilingSet const*, base::flat_map<scoped_refptr<cc::PaintWorkletInput const>, std::__Cr::pair<int, std::__Cr::optional<cc::PaintRecord>>, std::__Cr::less<void>, std::__Cr::vector<std::__Cr::pair<scoped_refptr<cc::PaintWorkletInput const>, std::__Cr::pair<int, std::__Cr::optional<cc::PaintRecord>>>, std::__Cr::allocator<std::__Cr::pair<scoped_refptr<cc::PaintWorkletInput const>, std::__Cr::pair<int, std::__Cr::optional<cc::PaintRecord>>>>>> const*, cc::DiscardableImageMap const*) cc/layers/picture_layer_impl.cc:646:15
    #20 0x55de3b2ba2b3 in cc::PictureLayerImpl::MovePropertiesToActiveLayer(cc::LayerImpl*) cc/layers/picture_layer_impl.cc:214:17
    #21 0x55de3b78c210 in cc::TreeSynchronizer::PushLayerProperties(cc::LayerTreeImpl*, cc::LayerTreeImpl*) cc/trees/tree_synchronizer.cc:165:19
    #22 0x55de3b4f5822 in cc::LayerTreeHostImpl::ActivateSyncTree() cc/trees/layer_tree_host_impl.cc:4235:5
    #23 0x55de3b739e68 in cc::Scheduler::ProcessScheduledActions() cc/scheduler/scheduler.cc:959:18
    #24 0x55de3b7242d4 in cc::ProxyImpl::NotifyReadyToActivate() cc/trees/proxy_impl.cc:462:15
    #25 0x55de3b3440a7 in cc::TileManager::IssueSignals() cc/tiles/tile_manager.cc:1845:16
    #26 0x55de3b33aa9c in cc::TileManager::CheckPendingGpuWorkAndIssueSignals() cc/tiles/tile_manager.cc:2129:3
    #27 0x55de3b32e7f1 in cc::TileManager::CheckForCompletedTasksAndIssueSignals() cc/tiles/tile_manager.cc:1831:3
    #28 0x55de3b3460d1 in base::internal::Invoker<base::internal::FunctorTraits<void (cc::TileManager::* const&)(), cc::TileManager*>, base::internal::BindState<true, true, false, void (cc::TileManager::*)(), base::internal::UnretainedWrapper<cc::TileManager, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #29 0x55de1e15beaf in base::RepeatingCallback<void ()>::Run() const & base/functional/callback.h:346:12
    #30 0x55de3b37de70 in base::internal::Invoker<base::internal::FunctorTraits<void (cc::UniqueNotifier::*&&)(), base::WeakPtr<cc::UniqueNotifier>&&>, base::internal::BindState<true, true, false, void (cc::UniqueNotifier::*)(), base::WeakPtr<cc::UniqueNotifier>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #31 0x55de358e2326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #32 0x55de359599c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #33 0x55de3595883a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #34 0x55de35adfba6 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55
    #35 0x55de3595b0d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #36 0x55de3585cca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #37 0x55de2e124253 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:178:14
    #38 0x55de35a4bbee in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #39 0x55de1d8f0c46 in asan_thread_start(void*) asan_interceptors.cpp

0x7bda2de8d830 is located 0 bytes inside of 32-byte region [0x7bda2de8d830,0x7bda2de8d850)
freed by thread T9 (Compositor) here:
    #0 0x55de1d92d002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e09002) (BuildId: d58718b12683a3d8)
    #1 0x55de38ecfbb3 in cc::DrawVerticesOp::~DrawVerticesOp() cc/paint/refcounted_buffer.h:60:7
    #2 0x55de38f188a6 in cc::PaintOpBuffer::DestroyOps() cc/paint/paint_op_buffer.cc:279:11
    #3 0x55de38f18a40 in cc::PaintOpBuffer::~PaintOpBuffer() cc/paint/paint_op_buffer.cc:248:3
    #4 0x55de38f188a6 in cc::PaintOpBuffer::DestroyOps() cc/paint/paint_op_buffer.cc:279:11
    #5 0x55de38f18a40 in cc::PaintOpBuffer::~PaintOpBuffer() cc/paint/paint_op_buffer.cc:248:3
    #6 0x55de38f6c25b in cc::PaintShader::~PaintShader() gen/third_party/libc++/src/include/optional:387:15
    #7 0x55de38f6c323 in cc::PaintShader::~PaintShader() cc/paint/paint_shader.cc:317:27
    #8 0x55de38eaa9a6 in cc::PaintFlags::~PaintFlags() third_party/skia/include/core/SkRefCnt.h:78:19
    #9 0x55de38f188a6 in cc::PaintOpBuffer::DestroyOps() cc/paint/paint_op_buffer.cc:279:11
    #10 0x55de38f18a40 in cc::PaintOpBuffer::~PaintOpBuffer() cc/paint/paint_op_buffer.cc:248:3
    #11 0x55de38f188a6 in cc::PaintOpBuffer::DestroyOps() cc/paint/paint_op_buffer.cc:279:11
    #12 0x55de38f18690 in cc::PaintOpBuffer::~PaintOpBuffer() cc/paint/paint_op_buffer.cc:248:3
    #13 0x55de38ef1b53 in cc::DisplayItemList::~DisplayItemList() cc/paint/display_item_list.cc:82:35
    #14 0x55de3b2ef5d5 in cc::RasterSource::~RasterSource() base/memory/ref_counted.h:438:5
    #15 0x55de3b2ef643 in cc::RasterSource::~RasterSource() cc/raster/raster_source.cc:42:29
    #16 0x55de3b3094e3 in cc::PictureLayerTiling::SetRasterSourceAndResize(scoped_refptr<cc::RasterSource>) base/memory/ref_counted.h:438:5
    #17 0x55de3b308d25 in cc::PictureLayerTiling::TakeTilesAndPropertiesFrom(cc::PictureLayerTiling*, cc::Region const&) cc/tiles/picture_layer_tiling.cc:141:3
    #18 0x55de3b31ae12 in cc::PictureLayerTilingSet::CopyTilingsAndPropertiesFromPendingTwin(cc::PictureLayerTilingSet const*, scoped_refptr<cc::RasterSource>, cc::Region const&) cc/tiles/picture_layer_tiling_set.cc:110:18
    #19 0x55de3b31baa1 in cc::PictureLayerTilingSet::UpdateTilingsToCurrentRasterSourceForActivation(scoped_refptr<cc::RasterSource>, cc::PictureLayerTilingSet const*, cc::Region const&, float, float) cc/tiles/picture_layer_tiling_set.cc:134:3
    #20 0x55de3b2bbc69 in cc::PictureLayerImpl::UpdateRasterSourceInternal(scoped_refptr<cc::RasterSource>, cc::Region, cc::PictureLayerTilingSet const*, base::flat_map<scoped_refptr<cc::PaintWorkletInput const>, std::__Cr::pair<int, std::__Cr::optional<cc::PaintRecord>>, std::__Cr::less<void>, std::__Cr::vector<std::__Cr::pair<scoped_refptr<cc::PaintWorkletInput const>, std::__Cr::pair<int, std::__Cr::optional<cc::PaintRecord>>>, std::__Cr::allocator<std::__Cr::pair<scoped_refptr<cc::PaintWorkletInput const>, std::__Cr::pair<int, std::__Cr::optional<cc::PaintRecord>>>>>> const*, cc::DiscardableImageMap const*) cc/layers/picture_layer_impl.cc:646:15
    #21 0x55de3b2ba2b3 in cc::PictureLayerImpl::MovePropertiesToActiveLayer(cc::LayerImpl*) cc/layers/picture_layer_impl.cc:214:17
    #22 0x55de3b78c210 in cc::TreeSynchronizer::PushLayerProperties(cc::LayerTreeImpl*, cc::LayerTreeImpl*) cc/trees/tree_synchronizer.cc:165:19
    #23 0x55de3b4f5822 in cc::LayerTreeHostImpl::ActivateSyncTree() cc/trees/layer_tree_host_impl.cc:4235:5
    #24 0x55de3b739e68 in cc::Scheduler::ProcessScheduledActions() cc/scheduler/scheduler.cc:959:18
    #25 0x55de3b7242d4 in cc::ProxyImpl::NotifyReadyToActivate() cc/trees/proxy_impl.cc:462:15
    #26 0x55de3b3440a7 in cc::TileManager::IssueSignals() cc/tiles/tile_manager.cc:1845:16
    #27 0x55de3b33aa9c in cc::TileManager::CheckPendingGpuWorkAndIssueSignals() cc/tiles/tile_manager.cc:2129:3
    #28 0x55de3b32e7f1 in cc::TileManager::CheckForCompletedTasksAndIssueSignals() cc/tiles/tile_manager.cc:1831:3
    #29 0x55de3b3460d1 in base::internal::Invoker<base::internal::FunctorTraits<void (cc::TileManager::* const&)(), cc::TileManager*>, base::internal::BindState<true, true, false, void (cc::TileManager::*)(), base::internal::UnretainedWrapper<cc::TileManager, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12

previously allocated by thread T0 (chrome) here:
    #0 0x55de1d92c3fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e083fd) (BuildId: d58718b12683a3d8)
    #1 0x55de4913899c in blink::(anonymous namespace)::MakeSkPointBuffer(blink::NotShared<blink::DOMTypedArray<float, v8::Float32Array, false>>, blink::ExceptionState&, char const*) base/memory/scoped_refptr.h:151:12
    #2 0x55de491383b5 in blink::Canvas2DRecorderContext::createMesh2DVertexBuffer(blink::NotShared<blink::DOMTypedArray<float, v8::Float32Array, false>>, blink::ExceptionState&) third_party/blink/renderer/modules/canvas/canvas2d/canvas_2d_recorder_context.cc:2525:57
    #3 0x55de48b0a68b in blink::(anonymous namespace)::v8_paint_rendering_context_2d::CreateMesh2DVertexBufferOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_paint_rendering_context_2d.cc:1405:39
    #4 0x55de2883d6e3 in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc
    #5 0x55de2883b902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc
    #6 0x55de2883869b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc
    #7 0x55de288383ea in Builtins_JSEntry setup-isolate-deserialize.cc
    #8 0x55de23a8e7ad in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12
    #9 0x55de23a8ce22 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) v8/src/execution/execution.cc:564:10
    #10 0x55de2363b849 in v8::Function::Call(v8::Isolate*, v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) v8/src/api/api.cc:5603:27
    #11 0x55de41d555ff in blink::V8ScriptRunner::CallFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:851:48
    #12 0x55de473ed896 in blink::bindings::CallbackInvokeHelper<blink::CallbackFunctionBase, (blink::bindings::CallbackInvokeHelperMode)0, (blink::bindings::CallbackReturnTypeIsPromise)0>::Call(int, v8::Local<v8::Value>*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:124:12
    #13 0x55de4b0a4ff6 in blink::V8PaintCallback::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::PaintRenderingContext2D*, blink::PaintSize*, blink::StylePropertyMapReadOnly*, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember<blink::CSSStyleValue, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 0u> const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_paint_callback.cc:75:13
    #14 0x55de4b0a0667 in blink::CSSPaintDefinition::Paint(gfx::SizeF const&, float, blink::StylePropertyMapReadOnly*, blink::BasicHeapVector<(blink::internal::HeapCollectionType)0, cppgc::internal::BasicMember<blink::CSSStyleValue, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 0u> const*) third_party/blink/renderer/modules/csspaint/css_paint_definition.cc:142:13
    #15 0x55de4b09617b in blink::PaintWorklet::Paint(blink::String const&, blink::ImageResourceObserver const&, gfx::SizeF const&, blink::BasicHeapVector<(blink::internal::HeapCollectionType)0, cppgc::internal::BasicMember<blink::CSSStyleValue, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 0u> const*) third_party/blink/renderer/modules/csspaint/paint_worklet.cc:136:25
    #16 0x55de41f546c5 in blink::CSSPaintValue::GetImage(blink::ImageResourceObserver const&, blink::Node const&, blink::ComputedStyle const&, gfx::SizeF const&) third_party/blink/renderer/core/css/css_paint_value.cc:170:20
    #17 0x55de41f4b127 in blink::CSSImageGeneratorValue::GetImage(blink::ImageResourceObserver const&, blink::Node const&, blink::ComputedStyle const&, blink::CSSToLengthConversionData::ContainerSizes const&, gfx::SizeF const&) third_party/blink/renderer/core/css/css_image_generator_value.cc:154:39
    #18 0x55de45054761 in blink::BoxPainterBase::PaintFillLayer(blink::PaintInfo const&, blink::Color const&, blink::FillLayer const&, blink::PhysicalRect const&, blink::BackgroundBleedAvoidance, blink::BoxBackgroundPaintContext const&, bool, blink::PhysicalSize const&) third_party/blink/renderer/core/paint/box_painter_base.cc:1429:36
    #19 0x55de4504cf34 in void blink::FillLayer::IterateFillLayersInReverseOrder<blink::BoxPainterBase::PaintFillLayers(blink::PaintInfo const&, blink::Color const&, blink::FillLayer const&, blink::PhysicalRect const&, blink::BoxBackgroundPaintContext const&, blink::BackgroundBleedAvoidance)::$_0>(blink::FillLayer const*, blink::FillLayer const*, blink::BoxPainterBase::PaintFillLayers(blink::PaintInfo const&, blink::Color const&, blink::FillLayer const&, blink::PhysicalRect const&, blink::BoxBackgroundPaintContext const&, blink::BackgroundBleedAvoidance)::$_0) third_party/blink/renderer/core/paint/box_painter_base.cc:80:9
    #20 0x55de4504ca9f in blink::BoxPainterBase::PaintFillLayers(blink::PaintInfo const&, blink::Color const&, blink::FillLayer const&, blink::PhysicalRect const&, blink::BoxBackgroundPaintContext const&, blink::BackgroundBleedAvoidance) third_party/blink/renderer/core/paint/box_painter_base.cc:76:3
    #21 0x55de44ff7641 in blink::BoxFragmentPainter::PaintBackground(blink::PaintInfo const&, blink::PhysicalRect const&, blink::Color const&, blink::BackgroundBleedAvoidance) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1847:3
    #22 0x55de44ff5d1e in blink::BoxFragmentPainter::PaintBoxDecorationBackgroundWithRectImpl(blink::PaintInfo const&, blink::PhysicalRect const&, blink::BoxDecorationData const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1593:7
    #23 0x55de44ff4a08 in blink::BoxFragmentPainter::PaintBoxDecorationBackgroundWithDecorationData(blink::PaintInfo const&, gfx::Rect const&, blink::PhysicalRect const&, blink::DisplayItemClient const&, blink::DisplayItem::Type, blink::BoxDecorationData const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1465:5
    #24 0x55de44ff21aa in blink::BoxFragmentPainter::PaintBoxDecorationBackgroundWithRect(blink::PaintInfo const&, gfx::Rect const&, blink::PhysicalRect const&, blink::DisplayItemClient const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1383:5
    #25 0x55de44fe494d in blink::BoxFragmentPainter::PaintBoxDecorationBackground(blink::PaintInfo const&, blink::PhysicalFixedOffset<blink::FixedPoint<6u, int>> const&, bool) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1320:5
    #26 0x55de44fe1c60 in blink::BoxFragmentPainter::PaintObject(blink::PaintInfo const&, blink::PhysicalFixedOffset<blink::FixedPoint<6u, int>> const&, bool) third_party/blink/renderer/core/paint/box_fragment_painter.cc:798:7
    #27 0x55de44fdf52d in blink::BoxFragmentPainter::PaintInternal(blink::PaintInfo const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:650:5
    #28 0x55de44fdda58 in blink::BoxFragmentPainter::Paint(blink::PaintInfo const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:581:5
    #29 0x55de4516c6b3 in blink::PaintLayerPainter::PaintFragmentWithPhase(blink::PaintPhase, blink::FragmentData const&, unsigned int, blink::PhysicalBoxFragment const*, blink::GraphicsContext&, unsigned int) third_party/blink/renderer/core/paint/paint_layer_painter.cc:708:44

Thread T9 (Compositor) created by T0 (chrome) here:
    #0 0x55de1d8d6a71 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10db2a71) (BuildId: d58718b12683a3d8)
    #1 0x55de35a4b242 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x55de359e104c in base::SimpleThread::StartAsync() base/threading/simple_thread.cc:55:13
    #3 0x55de2e06f8b7 in blink::Thread::CreateAndSetCompositorThread() third_party/blink/renderer/platform/scheduler/common/thread.cc:85:22
    #4 0x55de41b4ca33 in content::RenderThreadImpl::InitializeCompositorThread() content/renderer/render_thread_impl.cc:761:25
    #5 0x55de41b47d88 in content::RenderThreadImpl::InitializeWebKit(mojo::BinderMap*) content/renderer/render_thread_impl.cc:796:5
    #6 0x55de41b4454c in content::RenderThreadImpl::Init() content/renderer/render_thread_impl.cc:511:3
    #7 0x55de41b47461 in content::RenderThreadImpl::RenderThreadImpl(base::RepeatingCallback<void ()>, std::__Cr::unique_ptr<blink::scheduler::WebThreadScheduler, std::__Cr::default_delete<blink::scheduler::WebThreadScheduler>>) content/renderer/render_thread_impl.cc:473:3
    #8 0x55de41be6651 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:278:9
    #9 0x55de313fa6ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #10 0x55de313fba1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #11 0x55de313fe728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #12 0x55de313f8101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #13 0x55de313f86fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #14 0x55de1d92db39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #15 0x7faa2fc2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free cc/paint/paint_op.cc:2672:20 in cc::DrawVerticesOp::~DrawVerticesOp()
Shadow bytes around the buggy address:
  0x7bda2de8d580: f7 fa fd fd fd fa f7 fa fd fd fd fa f7 fa fd fd
  0x7bda2de8d600: fd fa f7 fa fd fd fd fa f7 fa fd fd fd fa f7 fa
  0x7bda2de8d680: fd fd fd fa f7 fa fd fd fd fa f7 fa fd fd fd fa
  0x7bda2de8d700: f7 fa fd fd fd fa f7 fa fd fd fd fa f7 fa fd fd
  0x7bda2de8d780: fd fa f7 fa fd fd fd fd f7 fa 00 00 00 00 f7 fa
=>0x7bda2de8d800: fd fd fd fa f7 fa[fd]fd fd fd f7 fa 00 00 00 00
  0x7bda2de8d880: f7 fa 00 00 00 fa f7 fa 00 00 00 00 f7 fa 00 00
  0x7bda2de8d900: 00 00 f7 fa 00 00 00 00 f7 fa 00 00 00 fa f7 fa
  0x7bda2de8d980: 00 00 00 00 f7 fa 00 00 00 fa f7 fa 00 00 00 00
  0x7bda2de8da00: f7 fa 00 00 00 00 f7 fa 00 00 00 fa f7 fa 00 00
  0x7bda2de8da80: 00 00 f7 fa 00 00 00 fa f7 fa 00 00 00 00 f7 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==9864==ADDITIONAL INFO

==9864==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55de3b37d901 in cc::UniqueNotifier::Schedule() cc/base/unique_notifier.cc:37:7
    #1 0x55de3b35a08d in cc::(anonymous namespace)::TaskSetFinishedTaskImpl::RunOnWorkerThread() cc/tiles/tile_manager.cc:287:28
    #2 0x55de464ecced in cc::CategorizedWorkerPoolJob::Start(int) cc/raster/categorized_worker_pool.cc:161:7
    #3 0x55de3b709b80 in cc::ProxyMain::BeginMainFrame(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState, std::__Cr::default_delete<cc::BeginMainFrameAndCommitState>>) cc/trees/proxy_main.cc:517:9


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=9786 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --ozone-platform=x11 --disable-gpu-compositing --enable-blink-features=Canvas2dMesh --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1775711236998024 --launch-time-ticks=161909608771 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,4082330498647719485,3091375159055641135,2097152 --field-trial-handle=3,i,2638038512544029986,17565221148727500379,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,477036566682446851,5312458888591092361,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==9864==END OF ADDITIONAL INFO

==9864==ABORTING