==2222155==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x76118c6c7d68 at pc 0x5c9fa242bf1f bp 0x7fff31605a70 sp 0x7fff31605a68
READ of size 8 at 0x76118c6c7d68 thread T0 (chrome)
    #0 0x5c9fa242bf1e in base::ObserverList<OmniboxEditModel::Observer, false, (base::ObserverListReentrancyPolicy)0, base::internal::CheckedObserverAdapter>::RemoveObserver(OmniboxEditModel::Observer const*) gen/third_party/libc++/src/include/__vector/vector.h:349:57
    #1 0x5c9fa1bec952 in base::ScopedObservation<OmniboxEditModel, OmniboxEditModel::Observer, (partition_alloc::internal::RawPtrTraits)0>::~ScopedObservation() base/scoped_observation_traits.h:74:13
    #2 0x5c9fa1bec756 in WebuiOmniboxHandler::~WebuiOmniboxHandler() chrome/browser/ui/webui/searchbox/webui_omnibox_handler.cc:137:43
    #3 0x5c9fa1becbe3 in WebuiOmniboxHandler::~WebuiOmniboxHandler() chrome/browser/ui/webui/searchbox/webui_omnibox_handler.cc:137:43
    #4 0x5c9fbf1be84f in OmniboxPopupUI::~OmniboxPopupUI() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #5 0x5c9fbf1bea73 in OmniboxPopupUI::~OmniboxPopupUI() chrome/browser/ui/webui/omnibox_popup/omnibox_popup_ui.cc:194:33
    #6 0x5c9f9c090ef3 in content::WebUIImpl::~WebUIImpl() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #7 0x5c9f9c091513 in content::WebUIImpl::~WebUIImpl() content/browser/webui/web_ui_impl.cc:217:25
    #8 0x5c9f9b4fc03a in content::RenderFrameHostImpl::OnUnloaded()
    #9 0x5c9f9b4d4c9e in content::RenderFrameHostImpl::PendingDeletionCheckCompleted() content/browser/renderer_host/render_frame_host_impl.cc:12625:7
    #10 0x5c9f9b4e8f33 in content::RenderFrameHostImpl::PendingDeletionCheckCompletedOnSubtree() content/browser/renderer_host/render_frame_host_impl.cc:12641:5
    #11 0x5c9f9b4f97ae in content::RenderFrameHostImpl::Unload(...) content/browser/renderer_host/render_frame_host_impl.cc:6816:3
    ... (navigation-commit frames)

Address 0x76118c6c7d68 is a wild pointer inside of access range of size 0x000000000008.
SUMMARY: AddressSanitizer: heap-buffer-overflow in base::ObserverList<OmniboxEditModel::Observer,...>::RemoveObserver(...)

Shadow bytes around the buggy address:
  0x76118c6c7c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x76118c6c7d00: fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa
  0x76118c6c7d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Note: shadow bytes around the access are `fa` (heap left redzone) rather than `fd` (freed). This indicates the chunk containing the freed OmniboxEditModel has been reallocated and released by intervening allocations between the free and the read. ASAN reclassifies the access as heap-buffer-overflow on a "wild pointer" at the same 3304-byte offset that was a freed read in scenario 1. The underlying bug is identical; this run corroborates that the freed region is reachable to other allocations in the browser process.

Command line: `./chrome --no-sandbox --user-data-dir=/tmp/h1 --enable-features=WebUIOmniboxPopup,WebUIOmniboxAimPopup --ozone-platform=x11`