==3650==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d9ab2a2047e at pc 0x562451bce868 bp 0x7b3aaadc5ee0 sp 0x7b3aaadc5ed8
READ of size 1 at 0x7d9ab2a2047e thread T4 (ThreadPoolForeg)
    #0 0x562451bce867 in dav1d_msac_init third_party/dav1d/libdav1d/src/msac.c:52:25
    #1 0x562451b9e641 in dav1d_decode_frame_init_cdf third_party/dav1d/libdav1d/src/decode.c:2456:5
    #2 0x562451ba1875 in dav1d_decode_frame third_party/dav1d/libdav1d/src/decode.c:3290:21
    #3 0x562451ba4c1f in dav1d_submit_frame third_party/dav1d/libdav1d/src/decode.c:3698:20
    #4 0x562451bd2e20 in dav1d_parse_obus third_party/dav1d/libdav1d/src/obu.c:1660:24
    #5 0x562451b827bb in gen_picture third_party/dav1d/libdav1d/src/lib.c:420:31
    #6 0x562451b826d0 in dav1d_send_data third_party/dav1d/libdav1d/src/lib.c:451:15
    #7 0x562467c53093 in <crabbyavif_3e652670::codecs::dav1d::Dav1d as crabbyavif_3e652670::codecs::Decoder>::get_next_image third_party/crabbyavif/src/src/codecs/dav1d.rs:372:36
    #8 0x562467bd896d in <crabbyavif_3e652670::decoder::Decoder>::decode_tile third_party/crabbyavif/src/src/decoder/mod.rs:1714:39
    #9 0x562467bd896d in <crabbyavif_3e652670::decoder::Decoder>::decode_tiles third_party/crabbyavif/src/src/decoder/mod.rs:1977:26
    #10 0x562467bd896d in <crabbyavif_3e652670::decoder::Decoder>::next_image third_party/crabbyavif/src/src/decoder/mod.rs:2033:14
    #11 0x562467bf41fd in <crabbyavif_3e652670::decoder::Decoder>::nth_image third_party/crabbyavif/src/src/decoder/mod.rs:2069:25
    #12 0x562467bd36fa in crabby_avifDecoderNthImage third_party/crabbyavif/src/src/capi/decoder.rs:333:28
    #13 0x56245d9349dd in blink::AVIFImageDecoder::DecodeImage(unsigned int) third_party/blink/renderer/platform/image-decoders/avif/avif_image_decoder.cc:1020:7
    #14 0x56245d93816a in blink::AVIFImageDecoder::Decode(unsigned int) third_party/blink/renderer/platform/image-decoders/avif/avif_image_decoder.cc:586:14
    #15 0x56245d8e172b in blink::ImageDecoder::DecodeFrameBufferAtIndex(unsigned int) third_party/blink/renderer/platform/image-decoders/image_decoder.cc:618:5
    #16 0x56245d4db2f7 in blink::ImageDecoderWrapper::Decode(blink::ImageDecoderFactory*, bool*) third_party/blink/renderer/platform/graphics/image_decoder_wrapper.cc:142:22
    #17 0x56245d4c94dd in blink::ImageFrameGenerator::DecodeAndScale(blink::SegmentReader*, bool, unsigned int, SkPixmap const&, int) third_party/blink/renderer/platform/graphics/image_frame_generator.cc:144:25
    #18 0x56245d483d8c in blink::DecodingImageGenerator::GetPixels(SkPixmap, unsigned long, int, unsigned int) third_party/blink/renderer/platform/graphics/decoding_image_generator.cc:207:33
    #19 0x5624501a16e2 in cc::PaintImage::Decode(SkPixmap, unsigned long, cc::AuxImage, int) const cc/paint/paint_image.cc
    #20 0x562452953111 in cc::SoftwareImageDecodeCacheUtils::DoDecodeImage(cc::SoftwareImageDecodeCacheUtils::CacheKey const&, cc::PaintImage const&, SkColorType, int, base::OnceCallback<void ()>) cc/tiles/software_image_decode_cache_utils.cc:161:29
    #21 0x56245294438b in cc::SoftwareImageDecodeCache::DecodeImageIfNecessary(cc::SoftwareImageDecodeCacheUtils::CacheKey const&, cc::PaintImage const&, cc::SoftwareImageDecodeCacheUtils::CacheEntry*) cc/tiles/software_image_decode_cache.cc:381:25
    #22 0x562452943693 in cc::SoftwareImageDecodeCache::DecodeImageInTask(cc::SoftwareImageDecodeCacheUtils::CacheKey const&, cc::PaintImage const&, cc::ImageDecodeCache::TaskType) cc/tiles/software_image_decode_cache.cc:348:7
    #23 0x56245294f133 in cc::(anonymous namespace)::SoftwareImageDecodeTaskImpl::RunOnWorkerThread() cc/tiles/software_image_decode_cache.cc:94:17
    #24 0x56245d7dbc90 in cc::CategorizedWorkerPoolJob::Run(base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>, base::JobDelegate*) cc/raster/categorized_worker_pool.cc:276:29
    #25 0x56245d7e62b6 in base::internal::Invoker<base::internal::FunctorTraits<void (cc::CategorizedWorkerPoolJob::* const&)(base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>, base::JobDelegate*), cc::CategorizedWorkerPoolJob*, base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*> const&>, base::internal::BindState<true, true, false, void (cc::CategorizedWorkerPoolJob::*)(base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>, base::JobDelegate*), base::internal::UnretainedWrapper<cc::CategorizedWorkerPoolJob, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>>, void (base::JobDelegate*)>::Run(base::internal::BindStateBase*, base::JobDelegate*) base/functional/bind_internal.h:740:12
    #26 0x56244cc666cf in base::RepeatingCallback<void (base::JobDelegate*)>::Run(base::JobDelegate*) const & base/functional/callback.h:346:12
    #27 0x56244cc67f69 in base::internal::Invoker<base::internal::FunctorTraits<base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::ThreadType, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0 const&, base::internal::JobTaskSource*>, base::internal::BindState<false, false, false, base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::ThreadType, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0, base::internal::UnretainedWrapper<base::internal::JobTaskSource, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/task/thread_pool/job_task_source.cc:114:32
    #28 0x56244cbd1326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #29 0x56244cc70502 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5
    #30 0x56244cc7074c in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:675:3
    #31 0x56244cc6ed39 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:705:7
    #32 0x56244cc6dfc2 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5
    #33 0x56244ccb2cf3 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36
    #34 0x56244ccb1e34 in base::internal::WorkerThread::RunPooledWorker() base/task/thread_pool/worker_thread.cc:359:3
    #35 0x56244ccb189b in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:339:7
    #36 0x56244cd3abee in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #37 0x562434bdfc46 in asan_thread_start(void*) asan_interceptors.cpp

0x7d9ab2a2047e is located 4990 bytes inside of 10000-byte region [0x7d9ab2a1f100,0x7d9ab2a21810)
freed by thread T4 (ThreadPoolForeg) here:
    #0 0x562434c1c002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e09002) (BuildId: 0440b075dbd4a9a3)
    #1 0x56245d939db0 in blink::AVIFImageDecoder::ReadFromSegmentReader(crabbyavif::avifIO*, unsigned int, unsigned long, unsigned long, crabbyavif::avifROData*) third_party/blink/renderer/platform/image-decoders/avif/avif_image_decoder.cc:709:19
    #2 0x562467b77f74 in <crabbyavif_3e652670::capi::io::avifIOWrapper as crabbyavif_3e652670::decoder::IO>::read third_party/crabbyavif/src/src/capi/io.rs:214:13
    #3 0x562467bd888a in <crabbyavif_3e652670::decoder::tile::DecodeSample>::data::<dyn crabbyavif_3e652670::decoder::IO> third_party/crabbyavif/src/src/decoder/tile.rs:61:14
    #4 0x562467bd888a in <crabbyavif_3e652670::decoder::Decoder>::decode_tile third_party/crabbyavif/src/src/decoder/mod.rs:1706:20
    #5 0x562467bd888a in <crabbyavif_3e652670::decoder::Decoder>::decode_tiles third_party/crabbyavif/src/src/decoder/mod.rs:1977:26
    #6 0x562467bd888a in <crabbyavif_3e652670::decoder::Decoder>::next_image third_party/crabbyavif/src/src/decoder/mod.rs:2033:14
    #7 0x562467bf41fd in <crabbyavif_3e652670::decoder::Decoder>::nth_image third_party/crabbyavif/src/src/decoder/mod.rs:2069:25
    #8 0x562467bd36fa in crabby_avifDecoderNthImage third_party/crabbyavif/src/src/capi/decoder.rs:333:28
    #9 0x56245d9349dd in blink::AVIFImageDecoder::DecodeImage(unsigned int) third_party/blink/renderer/platform/image-decoders/avif/avif_image_decoder.cc:1020:7
    #10 0x56245d93816a in blink::AVIFImageDecoder::Decode(unsigned int) third_party/blink/renderer/platform/image-decoders/avif/avif_image_decoder.cc:586:14
    #11 0x56245d8e172b in blink::ImageDecoder::DecodeFrameBufferAtIndex(unsigned int) third_party/blink/renderer/platform/image-decoders/image_decoder.cc:618:5
    #12 0x56245d4db2f7 in blink::ImageDecoderWrapper::Decode(blink::ImageDecoderFactory*, bool*) third_party/blink/renderer/platform/graphics/image_decoder_wrapper.cc:142:22
    #13 0x56245d4c94dd in blink::ImageFrameGenerator::DecodeAndScale(blink::SegmentReader*, bool, unsigned int, SkPixmap const&, int) third_party/blink/renderer/platform/graphics/image_frame_generator.cc:144:25
    #14 0x56245d483d8c in blink::DecodingImageGenerator::GetPixels(SkPixmap, unsigned long, int, unsigned int) third_party/blink/renderer/platform/graphics/decoding_image_generator.cc:207:33
    #15 0x5624501a16e2 in cc::PaintImage::Decode(SkPixmap, unsigned long, cc::AuxImage, int) const cc/paint/paint_image.cc
    #16 0x562452953111 in cc::SoftwareImageDecodeCacheUtils::DoDecodeImage(cc::SoftwareImageDecodeCacheUtils::CacheKey const&, cc::PaintImage const&, SkColorType, int, base::OnceCallback<void ()>) cc/tiles/software_image_decode_cache_utils.cc:161:29
    #17 0x56245294438b in cc::SoftwareImageDecodeCache::DecodeImageIfNecessary(cc::SoftwareImageDecodeCacheUtils::CacheKey const&, cc::PaintImage const&, cc::SoftwareImageDecodeCacheUtils::CacheEntry*) cc/tiles/software_image_decode_cache.cc:381:25
    #18 0x562452943693 in cc::SoftwareImageDecodeCache::DecodeImageInTask(cc::SoftwareImageDecodeCacheUtils::CacheKey const&, cc::PaintImage const&, cc::ImageDecodeCache::TaskType) cc/tiles/software_image_decode_cache.cc:348:7
    #19 0x56245294f133 in cc::(anonymous namespace)::SoftwareImageDecodeTaskImpl::RunOnWorkerThread() cc/tiles/software_image_decode_cache.cc:94:17
    #20 0x56245d7dbc90 in cc::CategorizedWorkerPoolJob::Run(base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>, base::JobDelegate*) cc/raster/categorized_worker_pool.cc:276:29
    #21 0x56245d7e62b6 in base::internal::Invoker<base::internal::FunctorTraits<void (cc::CategorizedWorkerPoolJob::* const&)(base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>, base::JobDelegate*), cc::CategorizedWorkerPoolJob*, base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*> const&>, base::internal::BindState<true, true, false, void (cc::CategorizedWorkerPoolJob::*)(base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>, base::JobDelegate*), base::internal::UnretainedWrapper<cc::CategorizedWorkerPoolJob, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>>, void (base::JobDelegate*)>::Run(base::internal::BindStateBase*, base::JobDelegate*) base/functional/bind_internal.h:740:12
    #22 0x56244cc666cf in base::RepeatingCallback<void (base::JobDelegate*)>::Run(base::JobDelegate*) const & base/functional/callback.h:346:12
    #23 0x56244cc67f69 in base::internal::Invoker<base::internal::FunctorTraits<base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::ThreadType, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0 const&, base::internal::JobTaskSource*>, base::internal::BindState<false, false, false, base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::ThreadType, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0, base::internal::UnretainedWrapper<base::internal::JobTaskSource, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/task/thread_pool/job_task_source.cc:114:32
    #24 0x56244cbd1326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #25 0x56244cc70502 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5
    #26 0x56244cc7074c in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:675:3
    #27 0x56244cc6ed39 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:705:7
    #28 0x56244cc6dfc2 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5
    #29 0x56244ccb2cf3 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36
    #30 0x56244ccb1e34 in base::internal::WorkerThread::RunPooledWorker() base/task/thread_pool/worker_thread.cc:359:3
    #31 0x56244ccb189b in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:339:7
    #32 0x56244cd3abee in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13

previously allocated by thread T8 (ThreadPoolForeg) here:
    #0 0x562434c1b3fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e083fd) (BuildId: 0440b075dbd4a9a3)
    #1 0x56243807c645 in std::__Cr::__wrap_iter<unsigned char*> std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>::__insert_with_size<std::__Cr::_ClassicAlgPolicy, base::CheckedContiguousIterator<unsigned char const>, base::CheckedContiguousIterator<unsigned char const>>(std::__Cr::__wrap_iter<unsigned char const*>, base::CheckedContiguousIterator<unsigned char const>, base::CheckedContiguousIterator<unsigned char const>, long) gen/third_party/libc++/src/include/__new/allocate.h:43:28
    #2 0x56245d93a347 in blink::AVIFImageDecoder::ReadFromSegmentReader(crabbyavif::avifIO*, unsigned int, unsigned long, unsigned long, crabbyavif::avifROData*) gen/third_party/libc++/src/include/__vector/vector.h:521:12
    #3 0x562467b77f74 in <crabbyavif_3e652670::capi::io::avifIOWrapper as crabbyavif_3e652670::decoder::IO>::read third_party/crabbyavif/src/src/capi/io.rs:214:13
    #4 0x562467bd888a in <crabbyavif_3e652670::decoder::tile::DecodeSample>::data::<dyn crabbyavif_3e652670::decoder::IO> third_party/crabbyavif/src/src/decoder/tile.rs:61:14
    #5 0x562467bd888a in <crabbyavif_3e652670::decoder::Decoder>::decode_tile third_party/crabbyavif/src/src/decoder/mod.rs:1706:20
    #6 0x562467bd888a in <crabbyavif_3e652670::decoder::Decoder>::decode_tiles third_party/crabbyavif/src/src/decoder/mod.rs:1977:26
    #7 0x562467bd888a in <crabbyavif_3e652670::decoder::Decoder>::next_image third_party/crabbyavif/src/src/decoder/mod.rs:2033:14
    #8 0x562467bf41fd in <crabbyavif_3e652670::decoder::Decoder>::nth_image third_party/crabbyavif/src/src/decoder/mod.rs:2069:25
    #9 0x562467bd36fa in crabby_avifDecoderNthImage third_party/crabbyavif/src/src/capi/decoder.rs:333:28
    #10 0x56245d9349dd in blink::AVIFImageDecoder::DecodeImage(unsigned int) third_party/blink/renderer/platform/image-decoders/avif/avif_image_decoder.cc:1020:7
    #11 0x56245d93816a in blink::AVIFImageDecoder::Decode(unsigned int) third_party/blink/renderer/platform/image-decoders/avif/avif_image_decoder.cc:586:14
    #12 0x56245d8e172b in blink::ImageDecoder::DecodeFrameBufferAtIndex(unsigned int) third_party/blink/renderer/platform/image-decoders/image_decoder.cc:618:5
    #13 0x56245d4db2f7 in blink::ImageDecoderWrapper::Decode(blink::ImageDecoderFactory*, bool*) third_party/blink/renderer/platform/graphics/image_decoder_wrapper.cc:142:22
    #14 0x56245d4c94dd in blink::ImageFrameGenerator::DecodeAndScale(blink::SegmentReader*, bool, unsigned int, SkPixmap const&, int) third_party/blink/renderer/platform/graphics/image_frame_generator.cc:144:25
    #15 0x56245d483d8c in blink::DecodingImageGenerator::GetPixels(SkPixmap, unsigned long, int, unsigned int) third_party/blink/renderer/platform/graphics/decoding_image_generator.cc:207:33
    #16 0x5624501a16e2 in cc::PaintImage::Decode(SkPixmap, unsigned long, cc::AuxImage, int) const cc/paint/paint_image.cc
    #17 0x562452953111 in cc::SoftwareImageDecodeCacheUtils::DoDecodeImage(cc::SoftwareImageDecodeCacheUtils::CacheKey const&, cc::PaintImage const&, SkColorType, int, base::OnceCallback<void ()>) cc/tiles/software_image_decode_cache_utils.cc:161:29
    #18 0x56245294438b in cc::SoftwareImageDecodeCache::DecodeImageIfNecessary(cc::SoftwareImageDecodeCacheUtils::CacheKey const&, cc::PaintImage const&, cc::SoftwareImageDecodeCacheUtils::CacheEntry*) cc/tiles/software_image_decode_cache.cc:381:25
    #19 0x562452943693 in cc::SoftwareImageDecodeCache::DecodeImageInTask(cc::SoftwareImageDecodeCacheUtils::CacheKey const&, cc::PaintImage const&, cc::ImageDecodeCache::TaskType) cc/tiles/software_image_decode_cache.cc:348:7
    #20 0x56245294f133 in cc::(anonymous namespace)::SoftwareImageDecodeTaskImpl::RunOnWorkerThread() cc/tiles/software_image_decode_cache.cc:94:17
    #21 0x56245d7dbc90 in cc::CategorizedWorkerPoolJob::Run(base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>, base::JobDelegate*) cc/raster/categorized_worker_pool.cc:276:29
    #22 0x56245d7e62b6 in base::internal::Invoker<base::internal::FunctorTraits<void (cc::CategorizedWorkerPoolJob::* const&)(base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>, base::JobDelegate*), cc::CategorizedWorkerPoolJob*, base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*> const&>, base::internal::BindState<true, true, false, void (cc::CategorizedWorkerPoolJob::*)(base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>, base::JobDelegate*), base::internal::UnretainedWrapper<cc::CategorizedWorkerPoolJob, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::span<cc::TaskCategory const, 18446744073709551615ul, cc::TaskCategory const*>>, void (base::JobDelegate*)>::Run(base::internal::BindStateBase*, base::JobDelegate*) base/functional/bind_internal.h:740:12
    #23 0x56244cc666cf in base::RepeatingCallback<void (base::JobDelegate*)>::Run(base::JobDelegate*) const & base/functional/callback.h:346:12
    #24 0x56244cc67f69 in base::internal::Invoker<base::internal::FunctorTraits<base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::ThreadType, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0 const&, base::internal::JobTaskSource*>, base::internal::BindState<false, false, false, base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::ThreadType, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0, base::internal::UnretainedWrapper<base::internal::JobTaskSource, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/task/thread_pool/job_task_source.cc:114:32
    #25 0x56244cbd1326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #26 0x56244cc70502 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5
    #27 0x56244cc7074c in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:675:3
    #28 0x56244cc6ed39 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:705:7
    #29 0x56244cc6dfc2 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5
    #30 0x56244ccb2cf3 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36
    #31 0x56244ccb1e34 in base::internal::WorkerThread::RunPooledWorker() base/task/thread_pool/worker_thread.cc:359:3
    #32 0x56244ccb189b in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:339:7

Thread T4 (ThreadPoolForeg) created by T0 (chrome) here:
    #0 0x562434bc5a71 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10db2a71) (BuildId: 0440b075dbd4a9a3)
    #1 0x56244cd3a242 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x56244ccb05e4 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*) base/task/thread_pool/worker_thread.cc:185:3
    #3 0x56244cca7bd5 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush() base/task/thread_pool/thread_group.cc:65:13
    #4 0x56244cca7890 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor() base/task/thread_pool/thread_group.cc:56:3
    #5 0x56244cc9d264 in base::internal::ThreadGroupImpl::Start(unsigned long, unsigned long, base::TimeDelta, scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*, base::internal::ThreadGroup::WorkerEnvironment, bool, std::__Cr::optional<base::TimeDelta>) base/task/thread_pool/thread_group_impl.cc:71:3
    #6 0x56244cc76126 in base::internal::ThreadPoolImpl::Start(base::ThreadPoolInstance::InitParams const&, base::WorkerThreadObserver*) base/task/thread_pool/thread_pool_impl.cc:241:35
    #7 0x562458cabdbe in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>, bool) content/child/child_process.cc:112:20
    #8 0x562458e310a0 in content::RenderProcess::RenderProcess(std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>) content/renderer/render_process.cc:18:7
    #9 0x562458e308d8 in content::RenderProcessImpl::RenderProcessImpl() content/renderer/render_process_impl.cc:98:7
    #10 0x562458e30e80 in content::RenderProcessImpl::Create() content/renderer/render_process_impl.cc:223:31
    #11 0x562458ed4e10 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:274:53
    #12 0x5624486e96ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #13 0x5624486eaa1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #14 0x5624486ed728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #15 0x5624486e7101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #16 0x5624486e76fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #17 0x562434c1cb39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #18 0x7f3ab482b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Thread T8 (ThreadPoolForeg) created by T4 (ThreadPoolForeg) here:
    #0 0x562434bc5a71 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10db2a71) (BuildId: 0440b075dbd4a9a3)
    #1 0x56244cd3a242 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x56244ccb05e4 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*) base/task/thread_pool/worker_thread.cc:185:3
    #3 0x56244cca7bd5 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush() base/task/thread_pool/thread_group.cc:65:13
    #4 0x56244cca7890 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor() base/task/thread_pool/thread_group.cc:56:3
    #5 0x56244cc9f7c1 in base::internal::ThreadGroupImpl::WorkerDelegate::GetWork(base::internal::WorkerThread*) base/task/thread_pool/thread_group_impl.cc:71:3
    #6 0x56244ccb2b13 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:460:52
    #7 0x56244ccb1e34 in base::internal::WorkerThread::RunPooledWorker() base/task/thread_pool/worker_thread.cc:359:3
    #8 0x56244ccb189b in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:339:7
    #9 0x56244cd3abee in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #10 0x562434bdfc46 in asan_thread_start(void*) asan_interceptors.cpp

SUMMARY: AddressSanitizer: heap-use-after-free third_party/dav1d/libdav1d/src/msac.c:52:25 in dav1d_msac_init
Shadow bytes around the buggy address:
  0x7d9ab2a20180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d9ab2a20200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d9ab2a20280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d9ab2a20300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d9ab2a20380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d9ab2a20400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]
  0x7d9ab2a20480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d9ab2a20500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d9ab2a20580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d9ab2a20600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d9ab2a20680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==3650==ADDITIONAL INFO

==3650==Note: Please include this section with the ASan report.
Task trace:
    #0 0x56245d7db4ed in cc::CategorizedWorkerPoolJob::Start(int) cc/raster/categorized_worker_pool.cc:161:7
    #1 0x5624529f8380 in cc::ProxyMain::BeginMainFrame(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState, std::__Cr::default_delete<cc::BeginMainFrameAndCommitState>>) cc/trees/proxy_main.cc:517:9
    #2 0x562452a16c6f in cc::ProxyImpl::ScheduledActionSendBeginMainFrame(viz::BeginFrameArgs const&) cc/trees/proxy_impl.cc:763:7


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=3575 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1777060546432874 --launch-time-ticks=77150880365 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,16211776633699176009,4351167215524293943,2097152 --field-trial-handle=3,i,8541998221562430062,5671976806958550825,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,9708667266739673118,8216796739957767952,4 --trace-process-track-uuid=3190708990997080739`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==3650==END OF ADDITIONAL INFO

==3650==ABORTING