[.] Sanitizer coverage enabled. Counter map size: 1039241, Cmp map size: 262144
Note: Google Test filter = ChromeSpeechRecognitionClientRace.MoveAssignVsConsumeUAF
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from ChromeSpeechRecognitionClientRace
[ RUN      ] ChromeSpeechRecognitionClientRace.MoveAssignVsConsumeUAF
=================================================================
==4526==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c12a1718030 at pc 0x5628db6fafa3 bp 0x7bd29dbfd950 sp 0x7bd29dbfd948
READ of size 8 at 0x7c12a1718030 thread T2
    #0 0x5628db6fafa2 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)()>, base::internal::BindState<false, true, false, void (*)()>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #1 0x5628dbb95a66 in void* std::__Cr::__thread_proxy<std::__Cr::tuple<std::__Cr::unique_ptr<std::__Cr::__thread_struct, std::__Cr::default_delete<std::__Cr::__thread_struct>>, ChromeSpeechRecognitionClientRace_MoveAssignVsConsumeUAF_Test::TestBody()::$_1>>(void*) base/functional/callback.h:155:12
    #2 0x5628dabe9846 in asan_thread_start(void*) asan_interceptors.cpp

0x7c12a1718030 is located 32 bytes inside of 48-byte region [0x7c12a1718010,0x7c12a1718040)
freed by thread T1 here:
    #0 0x5628dac25a72 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/base_unittests+0x23ffa72) (BuildId: fe0c2799d312deec)
    #1 0x5628dee2d8a4 in base::internal::BindStateHolder::operator=(base::internal::BindStateHolder&&) base/functional/callback_internal.cc:27:3
    #2 0x5628dbb956bc in void* std::__Cr::__thread_proxy<std::__Cr::tuple<std::__Cr::unique_ptr<std::__Cr::__thread_struct, std::__Cr::default_delete<std::__Cr::__thread_struct>>, ChromeSpeechRecognitionClientRace_MoveAssignVsConsumeUAF_Test::TestBody()::$_0>>(void*) base/functional/callback.h:95:60
    #3 0x5628dabe9846 in asan_thread_start(void*) asan_interceptors.cpp

previously allocated by thread T1 here:
    #0 0x5628dac24e6d in operator new(unsigned long) (/chromium/chromium/src/out/asan/base_unittests+0x23fee6d) (BuildId: fe0c2799d312deec)
    #1 0x5628dbb95631 in void* std::__Cr::__thread_proxy<std::__Cr::tuple<std::__Cr::unique_ptr<std::__Cr::__thread_struct, std::__Cr::default_delete<std::__Cr::__thread_struct>>, ChromeSpeechRecognitionClientRace_MoveAssignVsConsumeUAF_Test::TestBody()::$_0>>(void*) base/functional/bind_internal.h:1142:12
    #2 0x5628dabe9846 in asan_thread_start(void*) asan_interceptors.cpp

Thread T2 created by T0 here:
    #0 0x5628dabcf671 in pthread_create (/chromium/chromium/src/out/asan/base_unittests+0x23a9671) (BuildId: fe0c2799d312deec)
    #1 0x5628dbb94833 in ChromeSpeechRecognitionClientRace_MoveAssignVsConsumeUAF_Test::TestBody() gen/third_party/libc++/src/include/__thread/support/pthread.h:182:10
    #2 0x5628deac3f3b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x5628deac70f7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x5628deac9203 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x5628deaf922a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x5628deaf7c8e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x5628df2e2e1c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x5628df26b441 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), base::(anonymous namespace)::BaseUnittestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::(anonymous namespace)::BaseUnittestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x5628df33fb8b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x5628df33f4ab in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x5628df26b130 in main base/test/run_all_unittests.cc:79:10
    #12 0x7fd2a23ae249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Thread T1 created by T0 here:
    #0 0x5628dabcf671 in pthread_create (/chromium/chromium/src/out/asan/base_unittests+0x23a9671) (BuildId: fe0c2799d312deec)
    #1 0x5628dbb94796 in ChromeSpeechRecognitionClientRace_MoveAssignVsConsumeUAF_Test::TestBody() gen/third_party/libc++/src/include/__thread/support/pthread.h:182:10
    #2 0x5628deac3f3b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x5628deac70f7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x5628deac9203 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x5628deaf922a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x5628deaf7c8e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x5628df2e2e1c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x5628df26b441 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), base::(anonymous namespace)::BaseUnittestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::(anonymous namespace)::BaseUnittestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x5628df33fb8b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x5628df33f4ab in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x5628df26b130 in main base/test/run_all_unittests.cc:79:10
    #12 0x7fd2a23ae249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Shadow bytes around the buggy address:
  0x7c12a1717d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c12a1717e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c12a1717e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c12a1717f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c12a1717f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x7c12a1718000: fa fa fd fd fd fd[fd]fd fa fa fd fd fd fd fd fd
  0x7c12a1718080: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x7c12a1718100: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x7c12a1718180: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x7c12a1718200: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x7c12a1718280: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
E0000 00:00:1775871221.706140    4528 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4526==ADDITIONAL INFO
E0000 00:00:1775871221.706725    4528 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4526==Note: Please include this section with the ASan report.
E0000 00:00:1775871221.706939    4528 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace:
E0000 00:00:1775871221.707072    4528 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
E0000 00:00:1775871221.707213    4528 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4526==END OF ADDITIONAL INFO
E0000 00:00:1775871221.707366    4528 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4526==ABORTING