==17571==ERROR: AddressSanitizer: heap-use-after-free on address 0x741357987ce8 at pc 0x5a95576a8001 bp 0x7fff26270e10 sp 0x7fff26270e08
READ of size 8 at 0x741357987ce8 thread T0 (chrome)
    #0 0x5a95576a8000 in web_app::TabbedWebAppNavigationThrottle::FocusHomeTab(web_app::AppBrowserController const&, TabStripModel&) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:648:14
    #1 0x5a95576a6dc2 in web_app::TabbedWebAppNavigationThrottle::WillStartRequest() chrome/browser/ui/web_applications/tabbed_web_app_navigation_throttle.cc:143:12
    #2 0x5a954f20e9e5 in content::NavigationThrottleRunner::ProcessInternal() content/browser/renderer_host/navigation_throttle_runner.cc
    #3 0x5a954f20dbc7 in content::NavigationThrottleRunner::ProcessNavigationEvent(content::NavigationThrottleEvent) content/browser/renderer_host/navigation_throttle_runner.cc:131:3
    #4 0x5a954f209305 in content::NavigationThrottleRegistryImpl::ProcessNavigationEvent(content::NavigationThrottleEvent) content/browser/renderer_host/navigation_throttle_registry_impl.cc:219:32
    #5 0x5a954f162532 in content::NavigationRequest::WillStartRequest() content/browser/renderer_host/navigation_request.cc:8748:23
    #6 0x5a954f155e52 in content::NavigationRequest::BeginNavigationImpl() content/browser/renderer_host/navigation_request.cc:3195:3
    #7 0x5a954f15119b in content::NavigationRequest::BeginNavigation() content/browser/renderer_host/navigation_request.cc:2645:3
    #8 0x5a954f21c013 in content::Navigator::Navigate(std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, content::ReloadType) content/browser/renderer_host/navigator.cc:1065:44
    #9 0x5a954f0da2b1 in content::NavigationControllerImpl::NavigateWithoutEntry(content::NavigationController::LoadURLParams const&, base::TimeTicks) content/browser/renderer_host/navigation_controller_impl.cc:4354:21
    #10 0x5a954f0d85b7 in content::NavigationControllerImpl::LoadURLWithParams(content::NavigationController::LoadURLParams const&) content/browser/renderer_host/navigation_controller_impl.cc:1767:10
    #11 0x5a954e1078a3 in content::protocol::PageHandler::Navigate(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::unique_ptr<content::protocol::Page::Backend::NavigateCallback, std::__Cr::default_delete<content::protocol::Page::Backend::NavigateCallback>>) content/browser/devtools/protocol/page_handler.cc:1073:49
    #12 0x5a954d7812a9 in content::protocol::Page::DomainDispatcherImpl::navigate(crdtp::Dispatchable const&) gen/content/browser/devtools/protocol/page.cc:1618:16
    #13 0x5a95650f7f90 in crdtp::UberDispatcher::DispatchResult::Run() third_party/libc++/src/include/__functional/function.h:502:12
    #14 0x5a954df6caec in content::DevToolsSession::HandleCommandInternal(crdtp::Dispatchable, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) content/browser/devtools/devtools_session.cc:409:16
    #15 0x5a954df654c8 in content::DevToolsSession::HandleCommand(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) content/browser/devtools/devtools_session.cc:395:3
    #16 0x5a954df7520d in base::internal::Invoker<base::internal::FunctorTraits<void (content::DevToolsSession::* const&)(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>), base::WeakPtr<content::DevToolsSession> const&>, base::internal::BindState<true, true, false, void (content::DevToolsSession::*)(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>), base::WeakPtr<content::DevToolsSession>>, void (base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>)>::Run(base::internal::BindStateBase*, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>&&) base/functional/bind_internal.h:740:12
    #17 0x5a954592fff4 in base::RepeatingCallback<void (base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>)>::Run(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) const & base/functional/callback.h:346:12
    #18 0x5a957485c377 in ChromeDevToolsSession::HandleCommand(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>, base::RepeatingCallback<void (base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>)>) chrome/browser/devtools/chrome_devtools_session.cc:174:14
    #19 0x5a9574852a6c in ChromeDevToolsManagerDelegate::HandleCommand(content::DevToolsAgentHostClientChannel*, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>, base::RepeatingCallback<void (base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>)>) chrome/browser/devtools/chrome_devtools_manager_delegate.cc:299:15
    #20 0x5a954df6c66a in content::DevToolsSession::DispatchProtocolMessageInternal(crdtp::Dispatchable, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) content/browser/devtools/devtools_session.cc:388:15
    #21 0x5a954df6bb87 in content::DevToolsSession::DispatchProtocolMessage(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) content/browser/devtools/devtools_session.cc:366:12
    #22 0x5a954df555d5 in void base::internal::Invoker<base::internal::FunctorTraits<void (content::DevToolsPipeHandler::*&&)(std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>), base::WeakPtr<content::DevToolsPipeHandler>&&, std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>&&>, base::internal::BindState<true, true, false, void (content::DevToolsPipeHandler::*)(std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>), base::WeakPtr<content::DevToolsPipeHandler>, std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>>, void ()>::RunImpl<void (content::DevToolsPipeHandler::*)(std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>), std::__Cr::tuple<base::WeakPtr<content::DevToolsPipeHandler>, std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>>, 0ul, 1ul>(void (content::DevToolsPipeHandler::*&&)(std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>), std::__Cr::tuple<base::WeakPtr<content::DevToolsPipeHandler>, std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>) base/functional/bind_internal.h:740:12
    #23 0x5a955a831593 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #24 0x5a955a8a0c4c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #25 0x5a955a89faea in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #26 0x5a955aa552d8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #27 0x5a955aa58898 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #28 0x77e35a272718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)

0x741357987ce8 is located 8 bytes inside of 32-byte region [0x741357987ce0,0x741357987d00)
freed by thread T0 (chrome) here:
    #0 0x5a95420a9a91 in operator delete(void*) (/chromium/chromium/src/out/asan/chrome+0x1138da91) (BuildId: d4867d9b4d6838b7)
    #1 0x5a954f20b60b in std::__Cr::vector<std::__Cr::unique_ptr<content::NavigationThrottle, std::__Cr::default_delete<content::NavigationThrottle>>, std::__Cr::allocator<std::__Cr::unique_ptr<content::NavigationThrottle, std::__Cr::default_delete<content::NavigationThrottle>>>>::__destroy_vector::operator()() third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5a954f2085fc in content::NavigationThrottleRegistryImpl::~NavigationThrottleRegistryImpl() third_party/libc++/src/include/__vector/vector.h:258:67
    #3 0x5a954f149ab9 in content::NavigationRequest::~NavigationRequest() third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #4 0x5a954f1505b3 in content::NavigationRequest::~NavigationRequest() content/browser/renderer_host/navigation_request.cc:2312:41
    #5 0x5a954eeefe2f in content::FrameTreeNode::ResetNavigationRequestButKeepState(content::NavigationDiscardReason) third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #6 0x5a954eedc18f in content::FrameTree::Shutdown() content/browser/renderer_host/frame_tree.cc:1069:9
    #7 0x5a954fb1bd65 in content::WebContentsImpl::~WebContentsImpl() content/browser/web_contents/web_contents_impl.cc:1450:23
    #8 0x5a954fb20ab3 in content::WebContentsImpl::~WebContentsImpl() content/browser/web_contents/web_contents_impl.cc:1367:37
    #9 0x5a9557a6e66c in tabs::TabModel::~TabModel() third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #10 0x5a9557a89674 in TabStripModel::SendDetachWebContentsNotifications(TabStripModel::DetachNotifications*) third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #11 0x5a9557aa3033 in TabStripModel::CloseTabs(base::span<content::WebContents* const, 18446744073709551615ul, content::WebContents* const*>, unsigned int) chrome/browser/ui/tabs/tab_strip_model.cc:3697:5
    #12 0x5a9557aa4b60 in TabStripModel::CloseWebContentsAt(int, unsigned int) chrome/browser/ui/tabs/tab_strip_model.cc:1326:3
    #13 0x5a95731e9159 in chrome::CloseWebContents(Browser*, content::WebContents*, bool) chrome/browser/ui/browser_tabstrip.cc:136:31
    #14 0x5a954fbc348a in content::WebContentsImpl::Close() content/browser/web_contents/web_contents_impl.cc:9818:16
    #15 0x5a954f2b787d in content::RenderFrameHostImpl::ClosePageIgnoringUnloadEvents(content::RenderFrameHostImpl::ClosePageSource, base::RepeatingCallback<void ()>) content/browser/renderer_host/render_frame_host_impl.cc:7774:14
    #16 0x5a954f2b821b in content::RenderFrameHostImpl::ClosePage(content::RenderFrameHostImpl::ClosePageSource, base::RepeatingCallback<void ()>) content/browser/renderer_host/render_frame_host_impl.cc:7732:5
    #17 0x5a954fb262c6 in content::WebContentsImpl::ClosePage() content/browser/web_contents/web_contents_impl.cc:2036:26
    #18 0x5a95576a6d80 in web_app::TabbedWebAppNavigationThrottle::WillStartRequest() chrome/browser/ui/web_applications/tabbed_web_app_navigation_throttle.cc:140:21
    #19 0x5a954f20e9e5 in content::NavigationThrottleRunner::ProcessInternal() content/browser/renderer_host/navigation_throttle_runner.cc
    #20 0x5a954f20dbc7 in content::NavigationThrottleRunner::ProcessNavigationEvent(content::NavigationThrottleEvent) content/browser/renderer_host/navigation_throttle_runner.cc:131:3
    #21 0x5a954f209305 in content::NavigationThrottleRegistryImpl::ProcessNavigationEvent(content::NavigationThrottleEvent) content/browser/renderer_host/navigation_throttle_registry_impl.cc:219:32
    #22 0x5a954f162532 in content::NavigationRequest::WillStartRequest() content/browser/renderer_host/navigation_request.cc:8748:23
    #23 0x5a954f155e52 in content::NavigationRequest::BeginNavigationImpl() content/browser/renderer_host/navigation_request.cc:3195:3
    #24 0x5a954f15119b in content::NavigationRequest::BeginNavigation() content/browser/renderer_host/navigation_request.cc:2645:3
    #25 0x5a954f21c013 in content::Navigator::Navigate(std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, content::ReloadType) content/browser/renderer_host/navigator.cc:1065:44
    #26 0x5a954f0da2b1 in content::NavigationControllerImpl::NavigateWithoutEntry(content::NavigationController::LoadURLParams const&, base::TimeTicks) content/browser/renderer_host/navigation_controller_impl.cc:4354:21
    #27 0x5a954f0d85b7 in content::NavigationControllerImpl::LoadURLWithParams(content::NavigationController::LoadURLParams const&) content/browser/renderer_host/navigation_controller_impl.cc:1767:10
    #28 0x5a954e1078a3 in content::protocol::PageHandler::Navigate(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::unique_ptr<content::protocol::Page::Backend::NavigateCallback, std::__Cr::default_delete<content::protocol::Page::Backend::NavigateCallback>>) content/browser/devtools/protocol/page_handler.cc:1073:49
    #29 0x5a954d7812a9 in content::protocol::Page::DomainDispatcherImpl::navigate(crdtp::Dispatchable const&) gen/content/browser/devtools/protocol/page.cc:1618:16

previously allocated by thread T0 (chrome) here:
    #0 0x5a95420a9251 in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x1138d251) (BuildId: d4867d9b4d6838b7)
    #1 0x5a95576a6629 in std::__Cr::unique_ptr<web_app::TabbedWebAppNavigationThrottle, std::__Cr::default_delete<web_app::TabbedWebAppNavigationThrottle>> std::__Cr::make_unique<web_app::TabbedWebAppNavigationThrottle, content::NavigationThrottleRegistry&, 0>(content::NavigationThrottleRegistry&) content/public/browser/navigation_throttle.h:30:3
    #2 0x5a95576a6343 in web_app::TabbedWebAppNavigationThrottle::MaybeCreateAndAdd(content::NavigationThrottleRegistry&) chrome/browser/ui/web_applications/tabbed_web_app_navigation_throttle.cc:88:9
    #3 0x5a9554066584 in CreateAndAddChromeThrottlesForNavigation(content::NavigationThrottleRegistry&) chrome/browser/chrome_content_browser_client_navigation_throttles.cc:509:3
    #4 0x5a954fbc7036 in content::WebContentsImpl::CreateThrottlesForNavigation(content::NavigationThrottleRegistry&) content/browser/web_contents/web_contents_impl.cc:10125:34
    #5 0x5a954f2089db in content::NavigationThrottleRegistryImpl::RegisterNavigationThrottles() content/browser/renderer_host/navigation_throttle_registry_impl.cc:88:39
    #6 0x5a954f162151 in content::NavigationRequest::WillStartRequest() content/browser/renderer_host/navigation_request.cc:8729:25
    #7 0x5a954f155e52 in content::NavigationRequest::BeginNavigationImpl() content/browser/renderer_host/navigation_request.cc:3195:3
    #8 0x5a954f15119b in content::NavigationRequest::BeginNavigation() content/browser/renderer_host/navigation_request.cc:2645:3
    #9 0x5a954f21c013 in content::Navigator::Navigate(std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, content::ReloadType) content/browser/renderer_host/navigator.cc:1065:44
    #10 0x5a954f0da2b1 in content::NavigationControllerImpl::NavigateWithoutEntry(content::NavigationController::LoadURLParams const&, base::TimeTicks) content/browser/renderer_host/navigation_controller_impl.cc:4354:21
    #11 0x5a954f0d85b7 in content::NavigationControllerImpl::LoadURLWithParams(content::NavigationController::LoadURLParams const&) content/browser/renderer_host/navigation_controller_impl.cc:1767:10
    #12 0x5a954e1078a3 in content::protocol::PageHandler::Navigate(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>, std::__Cr::unique_ptr<content::protocol::Page::Backend::NavigateCallback, std::__Cr::default_delete<content::protocol::Page::Backend::NavigateCallback>>) content/browser/devtools/protocol/page_handler.cc:1073:49
    #13 0x5a954d7812a9 in content::protocol::Page::DomainDispatcherImpl::navigate(crdtp::Dispatchable const&) gen/content/browser/devtools/protocol/page.cc:1618:16
    #14 0x5a95650f7f90 in crdtp::UberDispatcher::DispatchResult::Run() third_party/libc++/src/include/__functional/function.h:502:12
    #15 0x5a954df6caec in content::DevToolsSession::HandleCommandInternal(crdtp::Dispatchable, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) content/browser/devtools/devtools_session.cc:409:16
    #16 0x5a954df654c8 in content::DevToolsSession::HandleCommand(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) content/browser/devtools/devtools_session.cc:395:3
    #17 0x5a954df7520d in base::internal::Invoker<base::internal::FunctorTraits<void (content::DevToolsSession::* const&)(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>), base::WeakPtr<content::DevToolsSession> const&>, base::internal::BindState<true, true, false, void (content::DevToolsSession::*)(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>), base::WeakPtr<content::DevToolsSession>>, void (base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>)>::Run(base::internal::BindStateBase*, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>&&) base/functional/bind_internal.h:740:12
    #18 0x5a954592fff4 in base::RepeatingCallback<void (base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>)>::Run(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) const & base/functional/callback.h:346:12
    #19 0x5a957485c377 in ChromeDevToolsSession::HandleCommand(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>, base::RepeatingCallback<void (base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>)>) chrome/browser/devtools/chrome_devtools_session.cc:174:14
    #20 0x5a9574852a6c in ChromeDevToolsManagerDelegate::HandleCommand(content::DevToolsAgentHostClientChannel*, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>, base::RepeatingCallback<void (base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>)>) chrome/browser/devtools/chrome_devtools_manager_delegate.cc:299:15
    #21 0x5a954df6c66a in content::DevToolsSession::DispatchProtocolMessageInternal(crdtp::Dispatchable, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) content/browser/devtools/devtools_session.cc:388:15
    #22 0x5a954df6bb87 in content::DevToolsSession::DispatchProtocolMessage(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) content/browser/devtools/devtools_session.cc:366:12
    #23 0x5a954df555d5 in void base::internal::Invoker<base::internal::FunctorTraits<void (content::DevToolsPipeHandler::*&&)(std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>), base::WeakPtr<content::DevToolsPipeHandler>&&, std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>&&>, base::internal::BindState<true, true, false, void (content::DevToolsPipeHandler::*)(std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>), base::WeakPtr<content::DevToolsPipeHandler>, std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>>, void ()>::RunImpl<void (content::DevToolsPipeHandler::*)(std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>), std::__Cr::tuple<base::WeakPtr<content::DevToolsPipeHandler>, std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>>, 0ul, 1ul>(void (content::DevToolsPipeHandler::*&&)(std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>), std::__Cr::tuple<base::WeakPtr<content::DevToolsPipeHandler>, std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>) base/functional/bind_internal.h:740:12
    #24 0x5a955a831593 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #25 0x5a955a8a0c4c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #26 0x5a955a89faea in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #27 0x5a955aa552d8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #28 0x5a955aa58898 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #29 0x77e35a272718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)

SUMMARY: AddressSanitizer: heap-use-after-free base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:648:14 in web_app::TabbedWebAppNavigationThrottle::FocusHomeTab(web_app::AppBrowserController const&, TabStripModel&)
Shadow bytes around the buggy address:
  0x741357987a00: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x741357987a80: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
  0x741357987b00: fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd fd fa
  0x741357987b80: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x741357987c00: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
=>0x741357987c80: fd fd fd fd f7 fa fd fd fd fd f7 fa fd[fd]fd fd
  0x741357987d00: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x741357987d80: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
  0x741357987e00: fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd fd fa
  0x741357987e80: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x741357987f00: fd fa f7 fa fd fd fd fd f7 fa 00 00 00 fa f7 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==17571==ADDITIONAL INFO

==17571==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5a954df54d5e in content::PipeReaderBase::HandleMessage(std::__Cr::vector<unsigned char, std::__Cr::allocator<unsigned char>>) content/browser/devtools/devtools_pipe_handler.cc:204:9
    #1 0x5a954df51d0e in content::PipeReaderBase::StartMainLoop() content/browser/devtools/devtools_pipe_handler.cc:151:9


Command line: `/chromium/chromium/src/out/asan/chrome --headless=new --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --disable-popup-blocking --user-data-dir=/tmp/chrome-tabbed-uaf-profile --remote-debugging-pipe --enable-blink-features=WebAppTabStrip,WebAppTabStripCustomizations --enable-features=SkipEarlyCommitPendingForCrashedFrame --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl --flag-switches-begin --flag-switches-end http://127.0.0.1:8091/index.html`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==17571==END OF ADDITIONAL INFO

==17571==ABORTING