Note: Google Test filter = HashMapTest.DeletedSentinelKeyUseAfterFree
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from HashMapTest
[ RUN      ] HashMapTest.DeletedSentinelKeyUseAfterFree
[poc] Set(-2): assigning into destructed scoped_refptr at slot 51 (colliding key was 181)
=================================================================
==2048==ERROR: AddressSanitizer: heap-use-after-free on address 0x7bf6ebff5e90 at pc 0x55bf76ecbf51 bp 0x7ffff7ed3890 sp 0x7ffff7ed3888
WRITE of size 4 at 0x7bf6ebff5e90 thread T0
    #0 0x55bf76ecbf50 in blink::HashTableAddResult<blink::HashTable<int, blink::KeyValuePair<int, scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>>, blink::KeyValuePairExtractor, blink::HashMapValueTraits<blink::IntHashTraits<int, -1, -2>, blink::HashTraits<scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>>>, blink::IntHashTraits<int, -1, -2>, blink::PartitionAllocator>, blink::KeyValuePair<int, scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>>> blink::HashMap<int, scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>, blink::IntHashTraits<int, -1, -2>, blink::HashTraits<scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>>, blink::PartitionAllocator>::Set<int const&, scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>>(int const&, scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>&&) gen/third_party/libc++/src/include/__atomic/support/c11.h:207:10
    #1 0x55bf76eca680 in blink::(anonymous namespace)::HashMapTest_DeletedSentinelKeyUseAfterFree_Test::TestBody() third_party/blink/renderer/platform/wtf/hash_map_test.cc:864:7
    #2 0x55bf7b86beab in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x55bf7b86eb57 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x55bf7b870c63 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x55bf7b8a0aba in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x55bf7b89f51e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x55bf80418c5c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x55bf8041b0a1 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), base::TestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::TestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x55bf804215fb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x55bf80420f1b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x55bf804189ca in base::RunUnitTestsUsingBaseTestSuite(int, char**) base/test/test_suite.cc:363:10
    #12 0x55bf770c5907 in main third_party/blink/renderer/platform/wtf/testing/run_all_tests.cc:46:10
    #13 0x7f86ed71e249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7bf6ebff5e90 is located 0 bytes inside of 68-byte region [0x7bf6ebff5e90,0x7bf6ebff5ed4)
freed by thread T0 here:
    #0 0x55bf76d10142 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/wtf_unittests+0x3ffe142) (BuildId: e22fc886c10d3100)
    #1 0x55bf76eca30f in blink::(anonymous namespace)::HashMapTest_DeletedSentinelKeyUseAfterFree_Test::TestBody() base/memory/ref_counted.h:438:5
    #2 0x55bf7b86beab in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x55bf7b86eb57 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x55bf7b870c63 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x55bf7b8a0aba in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x55bf7b89f51e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x55bf80418c5c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x55bf8041b0a1 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), base::TestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::TestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x55bf804215fb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x55bf80420f1b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x55bf804189ca in base::RunUnitTestsUsingBaseTestSuite(int, char**) base/test/test_suite.cc:363:10
    #12 0x55bf770c5907 in main third_party/blink/renderer/platform/wtf/testing/run_all_tests.cc:46:10
    #13 0x7f86ed71e249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 here:
    #0 0x55bf76d0f53d in operator new(unsigned long) (/chromium/chromium/src/out/asan/wtf_unittests+0x3ffd53d) (BuildId: e22fc886c10d3100)
    #1 0x55bf76ecb310 in scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload> base::MakeRefCounted<blink::(anonymous namespace)::SentinelPocPayload>() base/memory/scoped_refptr.h:151:12
    #2 0x55bf76ec97bc in blink::(anonymous namespace)::HashMapTest_DeletedSentinelKeyUseAfterFree_Test::TestBody() third_party/blink/renderer/platform/wtf/hash_map_test.cc:822:24
    #3 0x55bf7b86beab in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #4 0x55bf7b86eb57 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #5 0x55bf7b870c63 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #6 0x55bf7b8a0aba in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #7 0x55bf7b89f51e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x55bf80418c5c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #9 0x55bf8041b0a1 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), base::TestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::TestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #10 0x55bf804215fb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #11 0x55bf80420f1b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #12 0x55bf804189ca in base::RunUnitTestsUsingBaseTestSuite(int, char**) base/test/test_suite.cc:363:10
    #13 0x55bf770c5907 in main third_party/blink/renderer/platform/wtf/testing/run_all_tests.cc:46:10
    #14 0x7f86ed71e249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__atomic/support/c11.h:207:10 in blink::HashTableAddResult<blink::HashTable<int, blink::KeyValuePair<int, scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>>, blink::KeyValuePairExtractor, blink::HashMapValueTraits<blink::IntHashTraits<int, -1, -2>, blink::HashTraits<scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>>>, blink::IntHashTraits<int, -1, -2>, blink::PartitionAllocator>, blink::KeyValuePair<int, scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>>> blink::HashMap<int, scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>, blink::IntHashTraits<int, -1, -2>, blink::HashTraits<scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>>, blink::PartitionAllocator>::Set<int const&, scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>>(int const&, scoped_refptr<blink::(anonymous namespace)::SentinelPocPayload>&&)
Shadow bytes around the buggy address:
  0x7bf6ebff5c00: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x7bf6ebff5c80: fd fd fd fd fd fd fa fa fa fa fd fd fd fd fd fd
  0x7bf6ebff5d00: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x7bf6ebff5d80: fd fd fa fa fa fa fd fd fd fd fd fd fd fd fd fd
  0x7bf6ebff5e00: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fa fa
=>0x7bf6ebff5e80: fa fa[fd]fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x7bf6ebff5f00: 00 00 00 00 00 00 00 00 04 fa fa fa fa fa 00 00
  0x7bf6ebff5f80: 00 00 00 00 00 00 04 fa fa fa fa fa 00 00 00 00
  0x7bf6ebff6000: 00 00 00 00 04 fa fa fa fa fa 00 00 00 00 00 00
  0x7bf6ebff6080: 00 00 04 fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x7bf6ebff6100: 04 fa fa fa fa fa 00 00 00 00 00 00 00 00 04 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2048==ADDITIONAL INFO

==2048==Note: Please include this section with the ASan report.
Task trace:


==2048==END OF ADDITIONAL INFO

==2048==ABORTING