Note: Google Test filter = CFWLCaretTimerUAFTest.TimerSurvivesPreFinalize
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from CFWLCaretTimerUAFTest
[ RUN      ] CFWLCaretTimerUAFTest.TimerSurvivesPreFinalize
=================================================================
==1269==ERROR: AddressSanitizer: use-after-poison on address 0x7bcc020408f8 at pc 0x55560a39b180 bp 0x7ffc531e26b0 sp 0x7ffc531e26a8
READ of size 8 at 0x7bcc020408f8 thread T0
    #0 0x55560a39b17f in CFX_Timer::TimerProc(int) third_party/pdfium/core/fxcrt/cfx_timer.cpp:58:34
    #1 0x55560aa58bac in pdfium::CFWLCaretTimerUAFTest_TimerSurvivesPreFinalize_Test::TestBody() third_party/pdfium/xfa/fwl/cfwl_caret_timer_uaf_unittest.cpp:52:7
    #2 0x55561168301b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x555611685cc7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x555611687c33 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x5556116b789a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x5556116b62fe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x55560a0378d9 in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73
    #8 0x7fe03ace3249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Address 0x7bcc020408f8 is a wild pointer inside of access range of size 0x000000000008.
SUMMARY: AddressSanitizer: use-after-poison third_party/pdfium/core/fxcrt/cfx_timer.cpp:58:34 in CFX_Timer::TimerProc(int)
Shadow bytes around the buggy address:
  0x7bcc02040600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7bcc02040680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7bcc02040700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7bcc02040780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7bcc02040800: 00 00 00 00 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7
=>0x7bcc02040880: f7 f7 f7 f7 f7 00 f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]
  0x7bcc02040900: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7bcc02040980: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7bcc02040a00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7bcc02040a80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7bcc02040b00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

NOTE: the stack trace above identifies the code that *accessed* the poisoned memory.
To identify the code that *poisoned* the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=<size>.
==1269==ABORTING