[5051:5059:0512/090252.661674:WARNING:net/spdy/spdy_session.cc:2556] Draining session due to exceeding max queued capped frames
=================================================================
==5051==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b491046e6e0 at pc 0x593521e3e2c1 bp 0x79c9030221f0 sp 0x79c9030221e8
READ of size 8 at 0x7b491046e6e0 thread T7 (Chrome_ChildIOT)
[5013:5013:0512/090252.675280:INFO:CONSOLE:9] "[blocker] TypeError: Failed to fetch", source: http://localhost:9080/poc.html (9)
    #0 0x593521e3e2c0 in net::SpdyReadQueue::Dequeue(base::span<unsigned char, 18446744073709551615ul, unsigned char*>) base/containers/circular_deque.h:1003:11
    #1 0x593521e28008 in net::SpdyHttpStream::DoBufferedReadCallback() net/spdy/spdy_http_stream.cc:551:30
    #2 0x593521e2c201 in base::internal::Invoker<base::internal::FunctorTraits<void (net::SpdyHttpStream::*&&)(), net::SpdyHttpStream*>, base::internal::BindState<true, true, false, void (net::SpdyHttpStream::*)(), base::internal::UnretainedWrapper<net::SpdyHttpStream, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #3 0x5935209c7afb in base::OneShotTimer::RunUserTask() base/functional/callback.h:155:12
    #4 0x5935209ca5d0 in base::internal::Invoker<base::internal::FunctorTraits<void (base::internal::DelayTimerBase::* const&)(), base::internal::DelayTimerBase*>, base::internal::BindState<true, true, false, void (base::internal::DelayTimerBase::*)(), base::internal::UnretainedWrapper<base::internal::DelayTimerBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #5 0x5935208aa4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #6 0x5935209194ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #7 0x59352091838a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #8 0x593520a9d0fd in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55
    #9 0x59352091abd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #10 0x593520825b70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #11 0x5935209a752c in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13
    #12 0x59352cc89e3f in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19
    #13 0x5935209a7a6f in base::Thread::ThreadMain() base/threading/thread.cc:426:3
    #14 0x593520a0e08e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #15 0x5935086ddf16 in asan_thread_start(void*) asan_interceptors.cpp

0x7b491046e6e0 is located 608 bytes inside of 824-byte region [0x7b491046e480,0x7b491046e7b8)
freed by thread T7 (Chrome_ChildIOT) here:
    #0 0x59350871a1a2 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2f1a2) (BuildId: 0bbf011a4183d902)
    #1 0x5935271a7ebd in net::HttpNetworkTransaction::~HttpNetworkTransaction() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5935271a9f73 in net::HttpNetworkTransaction::~HttpNetworkTransaction() net/http/http_network_transaction.cc:340:51
    #3 0x5935273b37e8 in network::ThrottlingNetworkTransaction::~ThrottlingNetworkTransaction() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #4 0x5935273b3a13 in network::ThrottlingNetworkTransaction::~ThrottlingNetworkTransaction() services/network/throttling/throttling_network_transaction.cc:30:63
    #5 0x5935271d0eb9 in net::SharedDictionaryNetworkTransaction::~SharedDictionaryNetworkTransaction() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #6 0x5935271d11b3 in net::SharedDictionaryNetworkTransaction::~SharedDictionaryNetworkTransaction() net/shared_dictionary/shared_dictionary_network_transaction.cc:133:73
    #7 0x593521a53119 in net::HttpCache::Writers::EraseTransaction(std::__Cr::__map_iterator<std::__Cr::__tree_iterator<std::__Cr::__value_type<net::HttpCache::Transaction*, net::HttpCache::Writers::TransactionInfo>, std::__Cr::__tree_node<std::__Cr::__value_type<net::HttpCache::Transaction*, net::HttpCache::Writers::TransactionInfo>, void*>*, long>>, int) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #8 0x593521a55eee in net::HttpCache::Writers::OnNetworkReadFailure(int) net/http/http_cache_writers.cc:197:3
    #9 0x593521a51148 in net::HttpCache::Writers::DoLoop(int) net/http/http_cache_writers.cc:446:5
    #10 0x593521a578d4 in base::internal::Invoker<base::internal::FunctorTraits<void (net::HttpCache::Writers::*&&)(int), base::WeakPtr<net::HttpCache::Writers>&&>, base::internal::BindState<true, true, false, void (net::HttpCache::Writers::*)(int), base::WeakPtr<net::HttpCache::Writers>>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #11 0x5935271a76f3 in net::HttpNetworkTransaction::OnIOComplete(int) base/functional/callback.h:155:12
    #12 0x5935271c2d36 in base::internal::Invoker<base::internal::FunctorTraits<void (net::HttpNetworkTransaction::* const&)(int), net::HttpNetworkTransaction*>, base::internal::BindState<true, true, false, void (net::HttpNetworkTransaction::*)(int), base::internal::UnretainedWrapper<net::HttpNetworkTransaction, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (int)>::Run(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #13 0x593521e25dde in net::SpdyHttpStream::DoResponseCallback(int) base/functional/callback.h:155:12
    #14 0x593521e27701 in net::SpdyHttpStream::OnClose(int) net/spdy/spdy_http_stream.cc:407:5
    #15 0x593521eac11a in net::SpdyStream::OnClose(int) net/spdy/spdy_stream.cc:594:15
    #16 0x593521e59e68 in net::SpdySession::DeleteStream(std::__Cr::unique_ptr<net::SpdyStream, std::__Cr::default_delete<net::SpdyStream>>, int) net/spdy/spdy_session.cc:2639:11
    #17 0x593521e50a41 in net::SpdySession::CloseActiveStreamIterator(std::__Cr::__map_iterator<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>>, int) net/spdy/spdy_session.cc:1855:3
    #18 0x593521e531fa in net::SpdySession::StartGoingAway(unsigned int, net::Error) net/spdy/spdy_session.cc:1396:5
    #19 0x593521e4c178 in net::SpdySession::DoDrainSession(net::Error, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, bool) net/spdy/spdy_session.cc:2738:5
    #20 0x593521e5a685 in net::SpdySession::EnqueueSessionWrite(net::RequestPriority, spdy::SpdyFrameType, std::__Cr::unique_ptr<spdy::SpdySerializedFrame, std::__Cr::default_delete<spdy::SpdySerializedFrame>>) net/spdy/spdy_session.cc:2560:5
    #21 0x593521e52806 in net::SpdySession::SendWindowUpdateFrame(unsigned int, unsigned int, net::RequestPriority) net/spdy/spdy_session.cc:2473:3
    #22 0x593521e66a9c in net::SpdySession::IncreaseRecvWindowSize(int) net/spdy/spdy_session.cc:3344:5
    #23 0x593521e72d3e in base::internal::Invoker<base::internal::FunctorTraits<void (net::SpdySession::* const&)(unsigned long, net::SpdyBuffer::ConsumeSource), base::WeakPtr<net::SpdySession> const&>, base::internal::BindState<true, true, false, void (net::SpdySession::*)(unsigned long, net::SpdyBuffer::ConsumeSource), base::WeakPtr<net::SpdySession>>, void (unsigned long, net::SpdyBuffer::ConsumeSource)>::Run(base::internal::BindStateBase*, unsigned long, net::SpdyBuffer::ConsumeSource) base/functional/bind_internal.h:740:12
    #24 0x593521e3c131 in base::RepeatingCallback<void (unsigned long, net::SpdyBuffer::ConsumeSource)>::Run(unsigned long, net::SpdyBuffer::ConsumeSource) const & base/functional/callback.h:346:12
    #25 0x593521e3b44f in net::SpdyBuffer::~SpdyBuffer() net/spdy/spdy_buffer.cc:109:9
    #26 0x593521e3ef54 in base::internal::VectorBuffer<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>>::DestructRange(base::span<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>, 18446744073709551615ul, std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>*>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #27 0x593521e3e833 in base::circular_deque<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>>::DestructRange(unsigned long, unsigned long) base/containers/circular_deque.h
    #28 0x593521e3e0f7 in net::SpdyReadQueue::Dequeue(base::span<unsigned char, 18446744073709551615ul, unsigned char*>) base/containers/circular_deque.h:1002:5
    #29 0x593521e28008 in net::SpdyHttpStream::DoBufferedReadCallback() net/spdy/spdy_http_stream.cc:551:30

previously allocated by thread T7 (Chrome_ChildIOT) here:
    #0 0x59350871959d in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2e59d) (BuildId: 0bbf011a4183d902)
    #1 0x593521afe089 in net::HttpStreamFactory::Job::SetSpdyHttpStreamOrBidirectionalStreamImpl(base::WeakPtr<net::SpdySession>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x593521af955d in net::HttpStreamFactory::Job::DoCreateStream() net/http/http_stream_factory_job.cc:1289:10
    #3 0x593521af5c03 in net::HttpStreamFactory::Job::DoLoop(int) net/http/http_stream_factory_job.cc:656:14
    #4 0x593521af3f77 in net::HttpStreamFactory::Job::RunLoop(int) net/http/http_stream_factory_job.cc:547:12
    #5 0x593521aff686 in base::internal::Invoker<base::internal::FunctorTraits<void (net::HttpStreamFactory::Job::* const&)(int), net::HttpStreamFactory::Job*>, base::internal::BindState<true, true, false, void (net::HttpStreamFactory::Job::*)(int), base::internal::UnretainedWrapper<net::HttpStreamFactory::Job, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (int)>::Run(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #6 0x593521d3d683 in net::ClientSocketHandle::OnIOComplete(int) base/functional/callback.h:155:12
    #7 0x593521d3fbc6 in base::internal::Invoker<base::internal::FunctorTraits<void (net::ClientSocketHandle::*&&)(int), net::ClientSocketHandle*>, base::internal::BindState<true, true, false, void (net::ClientSocketHandle::*)(int), base::internal::UnretainedWrapper<net::ClientSocketHandle, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12
    #8 0x593521def60b in net::TransportClientSocketPool::InvokeUserCallback(base::raw_ptr<net::ClientSocketHandle, (partition_alloc::internal::RawPtrTraits)1>) base/functional/callback.h:155:12
    #9 0x593521df5c67 in void base::internal::Invoker<base::internal::FunctorTraits<void (net::TransportClientSocketPool::*&&)(base::raw_ptr<net::ClientSocketHandle, (partition_alloc::internal::RawPtrTraits)1>), base::WeakPtr<net::TransportClientSocketPool>&&, base::raw_ptr<net::ClientSocketHandle, (partition_alloc::internal::RawPtrTraits)1>>, base::internal::BindState<true, true, false, void (net::TransportClientSocketPool::*)(base::raw_ptr<net::ClientSocketHandle, (partition_alloc::internal::RawPtrTraits)1>), base::WeakPtr<net::TransportClientSocketPool>, base::internal::UnretainedWrapper<net::ClientSocketHandle, base::unretained_traits::MayDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<void (net::TransportClientSocketPool::*)(base::raw_ptr<net::ClientSocketHandle, (partition_alloc::internal::RawPtrTraits)1>), std::__Cr::tuple<base::WeakPtr<net::TransportClientSocketPool>, base::internal::UnretainedWrapper<net::ClientSocketHandle, base::unretained_traits::MayDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul, 1ul>(void (net::TransportClientSocketPool::*&&)(base::raw_ptr<net::ClientSocketHandle, (partition_alloc::internal::RawPtrTraits)1>), std::__Cr::tuple<base::WeakPtr<net::TransportClientSocketPool>, base::internal::UnretainedWrapper<net::ClientSocketHandle, base::unretained_traits::MayDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>) base/functional/bind_internal.h:740:12
    #10 0x5935208aa4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #11 0x5935209194ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #12 0x59352091838a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #13 0x593520a9d0fd in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55
    #14 0x59352091abd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #15 0x593520825b70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #16 0x5935209a752c in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13
    #17 0x59352cc89e3f in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19
    #18 0x5935209a7a6f in base::Thread::ThreadMain() base/threading/thread.cc:426:3
    #19 0x593520a0e08e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #20 0x5935086ddf16 in asan_thread_start(void*) asan_interceptors.cpp

Thread T7 (Chrome_ChildIOT) created by T0 (chrome) here:
    #0 0x5935086c3d91 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10dd8d91) (BuildId: 0bbf011a4183d902)
    #1 0x593520a0d6e2 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x5935209a65bc in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:232:26
    #3 0x59352cc88b0b in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>, bool) content/child/child_process.cc:152:21
    #4 0x593519617488 in content::UtilityMain(content::MainFunctionParams) content/utility/utility_main.cc:459:16
    #5 0x59351d0a7e3b in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:763:14
    #6 0x59351d0aae55 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #7 0x59351d0a4788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #8 0x59351d0a4d8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #9 0x59350871b266 in ChromeMain chrome/app/chrome_main.cc:194:12
    #10 0x7dc91242b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free base/containers/circular_deque.h:1003:11 in net::SpdyReadQueue::Dequeue(base::span<unsigned char, 18446744073709551615ul, unsigned char*>)
Shadow bytes around the buggy address:
  0x7b491046e400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x7b491046e480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b491046e500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b491046e580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b491046e600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7b491046e680: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
  0x7b491046e700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b491046e780: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x7b491046e800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x7b491046e880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b491046e900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==5051==ADDITIONAL INFO

==5051==Note: Please include this section with the ASan report.
Task trace:
    #0 0x593521e26971 in net::SpdyHttpStream::MaybeScheduleBufferedReadCallback() net/spdy/spdy_http_stream.cc:526:30


Command line: `/proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --host-resolver-rules=MAP a.test 127.0.0.1 --ignore-certificate-errors-spki-list=bsxr8+16e5RUTVgfm9V2x0PSEwtgeKLNDC1AR8p/Kjw= --no-sandbox --use-gl=swiftshader --crashpad-handler-pid=5018 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile.662vqu --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --metrics-shmem-handle=4,i,11906910829640124496,17095582000241589073,524288 --field-trial-handle=3,i,5603356843263211094,17495718630118313761,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,10925907780299921884,5328011632028134254,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=stderr --v=0`


MiraclePtr Status: PROTECTED
This crash occurred inside a callback where a raw_ptr<T> pointing to the same region was bound to one of the arguments.
MiraclePtr is expected to make this crash non-exploitable once fully enabled.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==5051==END OF ADDITIONAL INFO

==5051==ABORTING
[5013:5031:0512/090253.977682:ERROR:google_apis/gcm/engine/connection_factory_impl.cc:484] ConnectionHandler failed with net error: -2
[5013:5013:0512/090254.085325:ERROR:content/browser/network_service_instance_impl.cc:722] Network service crashed or was terminated, restarting service.
[5013:5013:0512/090254.115099:INFO:CONSOLE:9] "[victim] TypeError: Failed to fetch", source: http://localhost:9080/poc.html (9)