=================================================================
==20802==ERROR: AddressSanitizer: use-after-poison on address 0x7b4c021a13a0 at pc 0x556b5d494fb7 bp 0x7fff1e04c070 sp 0x7fff1e04c068
READ of size 8 at 0x7b4c021a13a0 thread T0 (chrome)
    #0 0x556b5d494fb6 in CFXJSE_Engine::NormalPropTypeGetter(v8::Isolate*, v8::Local<v8::Object>, fxcrt::StringViewTemplate<char>, bool) third_party/pdfium/fxjs/xfa/cfxjse_engine.cpp:118:37
    #1 0x556b5d48ec8f in (anonymous namespace)::NamedPropertyGetterCallback(v8::Local<v8::Name>, v8::PropertyCallbackInfo<v8::Value> const&) third_party/pdfium/fxjs/xfa/cfxjse_class.cpp:148:13
    #2 0x556b4dc3bed5 in v8::internal::PropertyCallbackArguments::CallNamedGetter(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::InterceptorInfo>, v8::internal::DirectHandle<v8::internal::Name>) v8/src/api/api-arguments-inl.h:324:33
    #3 0x556b4dc17f6c in v8::internal::(anonymous namespace)::GetPropertyWithInterceptorInternal(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::InterceptorInfo>, bool*) v8/src/objects/js-objects.cc:1293:19
    #4 0x556b4dd14e7f in v8::internal::Object::GetProperty(v8::internal::LookupIterator*, bool) v8/src/objects/objects.cc:1327:13
    #5 0x556b4d4df550 in v8::internal::LoadIC::Load(v8::internal::Handle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::Handle<v8::internal::Name>, bool, v8::internal::DirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>) v8/src/ic/ic.cc:468:32
    #6 0x556b4d507a61 in v8::internal::Runtime_LoadNoFeedbackIC_Miss(int, unsigned long*, v8::internal::Isolate*) v8/src/ic/ic.cc:3151:40
    #7 0x556b51d7abb5 in Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit setup-isolate-deserialize.cc
    #8 0x556b51e7f212 in Builtins_GetNamedPropertyHandler setup-isolate-deserialize.cc
    #9 0x556b51cc6902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc
    #10 0x556b51cc369b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc
    #11 0x556b51cc33ea in Builtins_JSEntry setup-isolate-deserialize.cc
    #12 0x556b4cf197ad in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12
    #13 0x556b4cf1bf54 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) v8/src/execution/execution.cc:574:10
    #14 0x556b4ca95228 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) v8/src/api/api.cc:2042:7
    #15 0x556b5d3c95bb in CFXJS_Engine::Execute(fxcrt::WideString const&) third_party/pdfium/fxjs/cfxjs_engine.cpp:611:25
    #16 0x556b5d420170 in CJS_EventContext::RunScript(fxcrt::WideString const&) third_party/pdfium/fxjs/cjs_event_context.cpp:49:21
    #17 0x556b5d3d2095 in CJS_App::RunJsScript(CJS_Runtime*, fxcrt::WideString const&) third_party/pdfium/fxjs/cjs_app.cpp:436:12
    #18 0x556b5d3d1e02 in CJS_App::TimerProc(GlobalTimer*) third_party/pdfium/fxjs/cjs_app.cpp:417:5
    #19 0x556b5d48b828 in GlobalTimer::Trigger(int) third_party/pdfium/fxjs/global_timer.cpp:80:25
    #20 0x556b5cab9064 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(int), int const&>, base::internal::BindState<false, true, false, void (*)(int), int>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #21 0x556b475e6eaf in base::RepeatingCallback<void ()>::Run() const & base/functional/callback.h:346:12
    #22 0x556b5ee93de2 in base::RepeatingTimer::RunUserTask() base/timer/timer.cc:215:8
    #23 0x556b5ee959f0 in base::internal::Invoker<base::internal::FunctorTraits<void (base::internal::DelayTimerBase::* const&)(), base::internal::DelayTimerBase*>, base::internal::BindState<true, true, false, void (base::internal::DelayTimerBase::*)(), base::internal::UnretainedWrapper<base::internal::DelayTimerBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #24 0x556b5ed6d326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #25 0x556b5ede49c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #26 0x556b5ede383a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #27 0x556b5ec2b927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #28 0x556b5ede60d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #29 0x556b5ece7ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #30 0x556b6b0711fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #31 0x556b5a8856ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #32 0x556b5a886a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #33 0x556b5a889728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #34 0x556b5a883101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #35 0x556b5a8836fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #36 0x556b46db8b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #37 0x7f5f5962b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Address 0x7b4c021a13a0 is a wild pointer inside of access range of size 0x000000000008.
SUMMARY: AddressSanitizer: use-after-poison third_party/pdfium/fxjs/xfa/cfxjse_engine.cpp:118:37 in CFXJSE_Engine::NormalPropTypeGetter(v8::Isolate*, v8::Local<v8::Object>, fxcrt::StringViewTemplate<char>, bool)
Shadow bytes around the buggy address:
  0x7b4c021a1100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b4c021a1180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b4c021a1200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b4c021a1280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b4c021a1300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7b4c021a1380: 00 00 00 00[f7]f7 f7 f7 f7 f7 f7 f7 00 f7 f7 f7
  0x7b4c021a1400: f7 f7 f7 f7 f7 00 00 00 00 00 00 00 00 00 00 00
  0x7b4c021a1480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b4c021a1500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b4c021a1580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b4c021a1600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

NOTE: the stack trace above identifies the code that *accessed* the poisoned memory.
To identify the code that *poisoned* the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=<size>.

==20802==ADDITIONAL INFO

==20802==Note: Please include this section with the ASan report.
Task trace:
    #0 0x556b5cab867f in chrome_pdf::PDFiumFormFiller::SetTimer(base::TimeDelta, void (*)(int)) pdf/pdfium/pdfium_form_filler.cc:780:16
    #1 0x556b5ccf8331 in chrome_pdf::URLLoaderWrapperImpl::ReadResponseBody(base::span<unsigned char, 18446744073709551615ul, unsigned char*>, base::OnceCallback<void (int)>) pdf/loader/url_loader_wrapper_impl.cc:166:7
    #2 0x556b5f9be0c3 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13
    #3 0x556b700a24c2 in blink::HTMLParserScriptRunner::PendingScriptFinished(blink::PendingScript*) third_party/blink/renderer/core/script/html_parser_script_runner.cc:277:18


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=20686 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --pdf-renderer --no-sandbox --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --js-flags=--jitless --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1776541186905799 --launch-time-ticks=111290844667 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,5074200026854757771,4536220187224136062,2097152 --field-trial-handle=3,i,8354086455379556952,8501472996214201876,262144 --enable-features=PdfXfaSupport --variations-seed-version --pseudonymization-salt-handle=7,i,1510491288299960303,14634289427185235861,4 --trace-process-track-uuid=3190708993808206286 --enable-logging=stderr --v=0`


==20802==END OF ADDITIONAL INFO

==20802==ABORTING
[20684:20699:0420/023507.868759:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT