==723==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b107215ba08 at pc 0x5583ab4b8524 bp 0x7ffff69ec9d0 sp 0x7ffff69ec9c8
READ of size 8 at 0x7b107215ba08 thread T0 (chrome)
[723:736:0526/094841.146975:VERBOSE1:components/update_client/unpacker.cc:123] Unpacking in: /tmp/org.chromium.Chromium.chromium_chrome_Unpacker_BeginUnzipping.AR9LNr
    #0 0x5583ab4b8523 in content::WebContentsImpl::FromRenderFrameHostImpl(content::RenderFrameHostImpl*) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1018:47
    #1 0x5583ab4b801e in content::WebContents::FromRenderFrameHost(content::RenderFrameHost*) content/browser/web_contents/web_contents_impl.cc:829:10
    #2 0x5583a9e262af in content::FileSystemChooser::CreateAndShow(content::RenderFrameHost*, content::FileSystemChooser::Options const&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<content::PathInfo, std::__Cr::allocator<content::PathInfo>>)>, content::FileSystemChooser::ScopedObjects) content/browser/file_system_access/file_system_chooser.cc:319:7
    #3 0x5583a9dacb6b in content::(anonymous namespace)::ShowFilePickerOnUIThread(content::FileSystemAccessPermissionContext*, url::Origin const&, content::GlobalRenderFrameHostId, content::FileSystemChooser::Options const&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<content::PathInfo, std::__Cr::allocator<content::PathInfo>>)>) content/browser/file_system_access/file_system_access_manager_impl.cc:265:3
    #4 0x5583a9daa1ea in content::FileSystemAccessManagerImpl::SetDefaultPathAndShowPicker(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool) content/browser/file_system_access/file_system_access_manager_impl.cc:788:3
    #5 0x5583a9dc8797 in void base::internal::DecayedFunctorTraits<void (content::FileSystemAccessManagerImpl::*)(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool), base::WeakPtr<content::FileSystemAccessManagerImpl>&&, content::FileSystemAccessEntryFactory::BindingContext&&, mojo::StructPtr<blink::mojom::FilePickerOptions>&&, base::FilePath&&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>&&>::Invoke<void (content::FileSystemAccessManagerImpl::*)(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool), base::WeakPtr<content::FileSystemAccessManagerImpl> const&, content::FileSystemAccessEntryFactory::BindingContext, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool>(void (content::FileSystemAccessManagerImpl::*)(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool), base::WeakPtr<content::FileSystemAccessManagerImpl> const&, content::FileSystemAccessEntryFactory::BindingContext&&, mojo::StructPtr<blink::mojom::FilePickerOptions>&&, base::FilePath&&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>&&, bool&&) base/functional/bind_internal.h:740:12
    #6 0x5583a9dc84d4 in base::internal::Invoker<base::internal::FunctorTraits<void (content::FileSystemAccessManagerImpl::*&&)(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool), base::WeakPtr<content::FileSystemAccessManagerImpl>&&, content::FileSystemAccessEntryFactory::BindingContext&&, mojo::StructPtr<blink::mojom::FilePickerOptions>&&, base::FilePath&&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>&&>, base::internal::BindState<true, true, false, void (content::FileSystemAccessManagerImpl::*)(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool), base::WeakPtr<content::FileSystemAccessManagerImpl>, content::FileSystemAccessEntryFactory::BindingContext, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>>, void (bool)>::RunOnce(base::internal::BindStateBase*, bool) base/functional/bind_internal.h:956:5
    #7 0x55839e41060e in void base::internal::ReplyAdapter<std::__Cr::tuple<bool>, bool>(base::OnceCallback<void (bool)>, std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>*) base/functional/callback.h:155:12
    #8 0x55839e410d65 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::OnceCallback<void (bool)>, std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>*), base::OnceCallback<void (bool)>&&, std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>*>, base::internal::BindState<false, true, false, void (*)(base::OnceCallback<void (bool)>, std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>*), base::OnceCallback<void (bool)>, base::internal::OwnedWrapper<std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>, std::__Cr::default_delete<std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>>>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #9 0x5583b6122a1b in base::internal::PostTaskAndReplyRelay::RunReply(base::internal::PostTaskAndReplyRelay) base/functional/callback.h:155:12
    #10 0x5583b612278e in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #11 0x5583b6098583 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #12 0x5583b6107c3c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #13 0x5583b6106ada in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #14 0x5583b62bc278 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #15 0x5583b62bf838 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #16 0x7cf07528d718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)

0x7b107215ba08 is located 264 bytes inside of 5728-byte region [0x7b107215b900,0x7b107215cf60)
freed by thread T0 (chrome) here:
    #0 0x55839da99a91 in operator delete(void*) (/chromium/chromium/src/out/asan/chrome+0x11352a91) (BuildId: 36c5dd40d2891957)
    #1 0x5583aad66c04 in content::RenderFrameHostManager::~RenderFrameHostManager() third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5583aa8940dd in content::FrameTreeNode::~FrameTreeNode() content/browser/renderer_host/frame_tree_node.cc:312:1
    #3 0x5583aa8954f3 in content::FrameTreeNode::~FrameTreeNode() content/browser/renderer_host/frame_tree_node.cc:222:33
    #4 0x5583aac4065c in content::RenderFrameHostImpl::RemoveChild(content::FrameTreeNode*) third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #5 0x5583aac2e22d in content::RenderFrameHostImpl::PendingDeletionCheckCompleted() content/browser/renderer_host/render_frame_host_impl.cc:12450:16
    #6 0x5583aac42633 in content::RenderFrameHostImpl::PendingDeletionCheckCompletedOnSubtree() content/browser/renderer_host/render_frame_host_impl.cc:12463:5
    #7 0x5583aac40b40 in content::RenderFrameHostImpl::Detach() content/browser/renderer_host/render_frame_host_impl.cc:6080:3
    #8 0x5583a26a6ce6 in blink::mojom::LocalFrameHostStubDispatch::Accept(blink::mojom::LocalFrameHost*, mojo::Message*) gen/third_party/blink/public/mojom/frame/frame.mojom.cc
    #9 0x5583b6e81ad8 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #10 0x5583b6e9f8b3 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24
    #11 0x5583b6e87f43 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #12 0x5583b9fb6b53 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #13 0x5583b9fb8fd5 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #14 0x5583b6098583 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #15 0x5583b6107c3c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #16 0x5583b6106ada in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #17 0x5583b62bcbb4 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48
    #18 0x5583b61093a9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:637:12
    #19 0x5583b6012b20 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #20 0x5583ab4ff9ea in content::WebContentsImpl::ExitFullscreenMode(bool) content/browser/web_contents/web_contents_impl.cc:4866:14
    #21 0x5583ab52f4e9 in content::WebContentsImpl::ExitFullscreen(bool) content/browser/web_contents/web_contents_impl.cc:7452:3
    #22 0x5583b009342a in FullscreenController::NotifyTabExclusiveAccessLost() chrome/browser/ui/exclusive_access/fullscreen_controller.cc:517:19
    #23 0x5583b0091b69 in FullscreenController::WindowFullscreenStateChanged() chrome/browser/ui/exclusive_access/fullscreen_controller.cc:392:5
    #24 0x5583ce9cd7f5 in Browser::WindowFullscreenStateChanged() chrome/browser/ui/browser.cc:1341:9
    #25 0x5583cf36d9ad in BrowserView::FullscreenStateChanged() chrome/browser/ui/views/frame/browser_view.cc:2190:13
    #26 0x5583cf36d5e6 in BrowserView::ProcessFullscreen(bool, long) chrome/browser/ui/views/frame/browser_view.cc:5352:3
    #27 0x5583cf392f9a in BrowserView::ExclusiveAccessContextImpl::ExitFullscreen() chrome/browser/ui/views/frame/browser_view.cc:745:22
    #28 0x5583b0090e74 in FullscreenController::ExitFullscreenModeInternal() chrome/browser/ui/exclusive_access/fullscreen_controller.cc:645:42
    #29 0x5583ab4ff88b in content::WebContentsImpl::ExitFullscreenMode(bool) content/browser/web_contents/web_contents_impl.cc:4855:16

previously allocated by thread T0 (chrome) here:
    #0 0x55839da99251 in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x11352251) (BuildId: 36c5dd40d2891957)
    #1 0x5583aabfc375 in content::RenderFrameHostFactory::Create(content::SiteInstance*, scoped_refptr<content::RenderViewHostImpl>, content::RenderFrameHostDelegate*, content::FrameTree*, content::FrameTreeNode*, int, mojo::PendingAssociatedRemote<content::mojom::Frame>, base::TokenType<blink::LocalFrameTokenTypeMarker> const&, base::TokenType<blink::DocumentTokenTypeMarker> const&, base::UnguessableToken, bool, content::RenderFrameHostImpl::LifecycleStateImpl, scoped_refptr<content::BrowsingContextState>) content/public/browser/render_frame_host.h:157:3
    #2 0x5583aad69e02 in content::RenderFrameHostManager::CreateRenderFrameHost(content::RenderFrameHostManager::CreateFrameCase, content::SiteInstanceImpl*, int, mojo::PendingAssociatedRemote<content::mojom::Frame>, base::TokenType<blink::LocalFrameTokenTypeMarker> const&, base::TokenType<blink::DocumentTokenTypeMarker> const&, base::UnguessableToken, bool, scoped_refptr<content::BrowsingContextState>, content::ProcessAllocationContext const&) content/browser/renderer_host/render_frame_host_manager.cc:4406:10
    #3 0x5583aad6ae05 in content::RenderFrameHostManager::InitChild(content::SiteInstanceImpl*, int, mojo::PendingAssociatedRemote<content::mojom::Frame>, base::TokenType<blink::LocalFrameTokenTypeMarker> const&, base::TokenType<blink::DocumentTokenTypeMarker> const&, base::UnguessableToken const&, blink::FramePolicy, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>) content/browser/renderer_host/render_frame_host_manager.cc:908:22
    #4 0x5583aac3faab in content::RenderFrameHostImpl::AddChild(std::__Cr::unique_ptr<content::FrameTreeNode, std::__Cr::default_delete<content::FrameTreeNode>>, int, mojo::PendingAssociatedRemote<content::mojom::Frame>, base::TokenType<blink::LocalFrameTokenTypeMarker> const&, base::TokenType<blink::DocumentTokenTypeMarker> const&, base::UnguessableToken, blink::FramePolicy const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::unique_ptr<base::UnguessableToken, std::__Cr::default_delete<base::UnguessableToken>>) content/browser/renderer_host/render_frame_host_impl.cc:5890:28
    #5 0x5583aa87fb34 in content::FrameTree::AddFrame(content::RenderFrameHostImpl*, int, int, mojo::PendingAssociatedRemote<content::mojom::Frame>, mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>, mojo::StructPtr<blink::mojom::PolicyContainerBindParams>, mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterfaceProvider>, blink::mojom::TreeScopeType, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, bool, base::TokenType<blink::LocalFrameTokenTypeMarker> const&, base::UnguessableToken const&, base::TokenType<blink::DocumentTokenTypeMarker> const&, blink::FramePolicy const&, blink::mojom::FrameOwnerProperties const&, bool, blink::FrameOwnerElementType, bool, std::__Cr::unique_ptr<base::UnguessableToken, std::__Cr::default_delete<base::UnguessableToken>>) content/browser/renderer_host/frame_tree.cc:433:39
    #6 0x5583aac385a2 in content::RenderFrameHostImpl::OnCreateChildFrame(int, mojo::PendingAssociatedRemote<content::mojom::Frame>, mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>, mojo::StructPtr<blink::mojom::PolicyContainerBindParams>, mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterfaceProvider>, blink::mojom::TreeScopeType, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, bool, base::TokenType<blink::LocalFrameTokenTypeMarker> const&, base::UnguessableToken const&, base::TokenType<blink::DocumentTokenTypeMarker> const&, blink::FramePolicy const&, blink::mojom::FrameOwnerProperties const&, blink::FrameOwnerElementType, long, std::__Cr::unique_ptr<base::UnguessableToken, std::__Cr::default_delete<base::UnguessableToken>>) content/browser/renderer_host/render_frame_host_impl.cc:5173:16
    #7 0x5583aac3922e in content::RenderFrameHostImpl::CreateChildFrame(base::TokenType<blink::LocalFrameTokenTypeMarker> const&, mojo::PendingAssociatedRemote<content::mojom::Frame>, mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>, mojo::StructPtr<blink::mojom::PolicyContainerBindParams>, mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterfaceProvider>, blink::mojom::TreeScopeType, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, bool, blink::FramePolicy const&, mojo::StructPtr<blink::mojom::FrameOwnerProperties>, blink::FrameOwnerElementType, long) content/browser/renderer_host/render_frame_host_impl.cc:5239:3
    #8 0x5583aac39485 in non-virtual thunk to content::RenderFrameHostImpl::CreateChildFrame(base::TokenType<blink::LocalFrameTokenTypeMarker> const&, mojo::PendingAssociatedRemote<content::mojom::Frame>, mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>, mojo::StructPtr<blink::mojom::PolicyContainerBindParams>, mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterfaceProvider>, blink::mojom::TreeScopeType, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, bool, blink::FramePolicy const&, mojo::StructPtr<blink::mojom::FrameOwnerProperties>, blink::FrameOwnerElementType, long) content/browser/renderer_host/render_frame_host_impl.cc
    #9 0x5583a37a9c75 in content::mojom::FrameHostStubDispatch::Accept(content::mojom::FrameHost*, mojo::Message*) gen/content/common/frame.mojom.cc:5870:13
    #10 0x5583b6e81ad8 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #11 0x5583b6e9f8b3 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24
    #12 0x5583b6e87f43 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #13 0x5583b9fb6b53 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #14 0x5583b9fb8fd5 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #15 0x5583b6098583 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #16 0x5583b6107c3c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #17 0x5583b6106ada in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #18 0x5583b62bc278 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #19 0x5583b62bf838 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #20 0x7cf07528d718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)

SUMMARY: AddressSanitizer: heap-use-after-free base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1018:47 in content::WebContentsImpl::FromRenderFrameHostImpl(content::RenderFrameHostImpl*)