[.] Sanitizer coverage enabled. Counter map size: 8266059, Cmp map size: 262144 Note: Google Test filter = RenderFrameHostImplTest.ExitFullscreenDestructionDuringCommit [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from RenderFrameHostImplTest [ RUN ] RenderFrameHostImplTest.ExitFullscreenDestructionDuringCommit [2868:2868:WARNING:content/browser/renderer_host/render_frame_host_impl.cc:3968] Creating unbound remote associated interface provider [2868:2868:WARNING:content/browser/renderer_host/render_frame_host_impl.cc:3968] Creating unbound remote associated interface provider ================================================================= ==2868==ERROR: AddressSanitizer: heap-use-after-free on address 0x7a25c9dfd618 at pc 0x5652e21bae16 bp 0x7ffeaf02fbd0 sp 0x7ffeaf02fbc8 READ of size 8 at 0x7a25c9dfd618 thread T0 #0 0x5652e21bae15 in content::RenderFrameHostImpl::DidCommitNavigationInternal(std::__Cr::unique_ptr>, mojo::StructPtr, mojo::StructPtr, base::TimeTicks const&) ../../../../../third_party/libc++/src/include/deque:779:85 #1 0x5652e21b405d in content::RenderFrameHostImpl::DidCommitNavigation(content::NavigationRequest*, mojo::StructPtr, mojo::StructPtr) content/browser/renderer_host/render_frame_host_impl.cc:17240:8 #2 0x5652e2289bcf in void base::internal::InvokeHelper, mojo::StructPtr), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, void, 0ul, 1ul>::MakeItSo, mojo::StructPtr), std::__Cr::tuple, base::internal::UnretainedWrapper>, mojo::StructPtr, mojo::StructPtr>(void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr, mojo::StructPtr), std::__Cr::tuple, base::internal::UnretainedWrapper>&&, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:740:12 #3 0x5652e2289910 in base::internal::Invoker, mojo::StructPtr), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, base::internal::BindState, mojo::StructPtr), base::internal::UnretainedWrapper, base::internal::UnretainedWrapper>, void (mojo::StructPtr, mojo::StructPtr)>::RunOnce(base::internal::BindStateBase*, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:1069:14 #4 0x5652e6468258 in content::TestRenderFrameHost::SimulateCommitProcessed(content::NavigationRequest*, mojo::StructPtr, mojo::PendingReceiver, bool) base/functional/callback.h:155:12 #5 0x5652e6435bcd in content::NavigationSimulatorImpl::Commit() content/test/navigation_simulator_impl.cc:763:23 #6 0x5652d181ed8e in content::RenderFrameHostImplTest_ExitFullscreenDestructionDuringCommit_Test::TestBody() content/browser/renderer_host/render_frame_host_impl_unittest.cc:306:8 #7 0x5652d6a1d42b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x5652d6a20597 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #9 0x5652d6a22693 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #10 0x5652d6a5225a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #11 0x5652d6a50d2e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #12 0x5652e693c15c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #13 0x5652e63ea685 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #14 0x5652e5fcacc1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #15 0x5652e6992ecb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #16 0x5652e69927eb in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #17 0x5652e5fca834 in main content/test/run_all_unittests.cc:17:10 #18 0x7bf5cbc2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7a25c9dfd618 is located 5400 bytes inside of 5952-byte region [0x7a25c9dfc100,0x7a25c9dfd840) freed by thread T0 here: #0 0x5652cc37f891 in operator delete(void*) (/chromium/chromium/src/out/asan/content_unittests+0xfb2f891) (BuildId: 76c525ebd9e7e1fb) #1 0x5652e22ecf9b in content::RenderFrameHostManager::DiscardSpeculativeRenderFrameHostForShutdown() third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x5652e1e011b3 in content::FrameTree::Shutdown() content/browser/renderer_host/frame_tree.cc:1072:19 #3 0x5652e2a02a55 in content::WebContentsImpl::~WebContentsImpl() content/browser/web_contents/web_contents_impl.cc:1449:23 #4 0x5652e647ee80 in content::TestWebContents::~TestWebContents() content/test/test_web_contents.cc:87:35 #5 0x5652e647f0e3 in content::TestWebContents::~TestWebContents() content/test/test_web_contents.cc:87:35 #6 0x5652d1849401 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #7 0x5652d18496b3 in content::RenderFrameHostImplTest_ExitFullscreenDestructionDuringCommit_Test::TestBody()::DestructionDelegate::ExitFullscreenModeForTab(content::WebContents*) base/functional/callback.h:155:12 #8 0x5652e2a40511 in content::WebContentsImpl::ExitFullscreenMode(bool) content/browser/web_contents/web_contents_impl.cc:4854:16 #9 0x5652e2a6fcf9 in content::WebContentsImpl::ExitFullscreen(bool) content/browser/web_contents/web_contents_impl.cc:7439:3 #10 0x5652e2a7a55e in content::WebContentsImpl::DidNavigateAnyFramePreCommit(content::NavigationHandle*, bool) content/browser/web_contents/web_contents_impl.cc:8038:5 #11 0x5652e2124681 in content::Navigator::DidNavigate(content::RenderFrameHostImpl*, content::mojom::DidCommitProvisionalLoadParams const&, std::__Cr::unique_ptr>, bool, bool) content/browser/renderer_host/navigator.cc:530:14 #12 0x5652e21b8e48 in content::RenderFrameHostImpl::DidCommitNavigationInternal(std::__Cr::unique_ptr>, mojo::StructPtr, mojo::StructPtr, base::TimeTicks const&) content/browser/renderer_host/render_frame_host_impl.cc:16327:58 #13 0x5652e21b405d in content::RenderFrameHostImpl::DidCommitNavigation(content::NavigationRequest*, mojo::StructPtr, mojo::StructPtr) content/browser/renderer_host/render_frame_host_impl.cc:17240:8 #14 0x5652e2289bcf in void base::internal::InvokeHelper, mojo::StructPtr), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, void, 0ul, 1ul>::MakeItSo, mojo::StructPtr), std::__Cr::tuple, base::internal::UnretainedWrapper>, mojo::StructPtr, mojo::StructPtr>(void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr, mojo::StructPtr), std::__Cr::tuple, base::internal::UnretainedWrapper>&&, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:740:12 #15 0x5652e2289910 in base::internal::Invoker, mojo::StructPtr), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, base::internal::BindState, mojo::StructPtr), base::internal::UnretainedWrapper, base::internal::UnretainedWrapper>, void (mojo::StructPtr, mojo::StructPtr)>::RunOnce(base::internal::BindStateBase*, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:1069:14 #16 0x5652e6468258 in content::TestRenderFrameHost::SimulateCommitProcessed(content::NavigationRequest*, mojo::StructPtr, mojo::PendingReceiver, bool) base/functional/callback.h:155:12 #17 0x5652e6435bcd in content::NavigationSimulatorImpl::Commit() content/test/navigation_simulator_impl.cc:763:23 #18 0x5652d181ed8e in content::RenderFrameHostImplTest_ExitFullscreenDestructionDuringCommit_Test::TestBody() content/browser/renderer_host/render_frame_host_impl_unittest.cc:306:8 #19 0x5652d6a1d42b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #20 0x5652d6a20597 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #21 0x5652d6a22693 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #22 0x5652d6a5225a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #23 0x5652d6a50d2e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #24 0x5652e693c15c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #25 0x5652e63ea685 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #26 0x5652e5fcacc1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #27 0x5652e6992ecb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #28 0x5652e69927eb in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #29 0x5652e5fca834 in main content/test/run_all_unittests.cc:17:10 previously allocated by thread T0 here: #0 0x5652cc37f051 in operator new(unsigned long) (/chromium/chromium/src/out/asan/content_unittests+0xfb2f051) (BuildId: 76c525ebd9e7e1fb) #1 0x5652e646f126 in content::TestRenderFrameHostFactory::CreateRenderFrameHost(content::SiteInstance*, scoped_refptr, content::RenderFrameHostDelegate*, content::FrameTree*, content::FrameTreeNode*, int, mojo::PendingAssociatedRemote, base::TokenType const&, base::TokenType const&, base::UnguessableToken, bool, content::RenderFrameHostImpl::LifecycleStateImpl, scoped_refptr) content/public/browser/render_frame_host.h:157:3 #2 0x5652e2166ec8 in content::RenderFrameHostFactory::Create(content::SiteInstance*, scoped_refptr, content::RenderFrameHostDelegate*, content::FrameTree*, content::FrameTreeNode*, int, mojo::PendingAssociatedRemote, base::TokenType const&, base::TokenType const&, base::UnguessableToken, bool, content::RenderFrameHostImpl::LifecycleStateImpl, scoped_refptr) content/browser/renderer_host/render_frame_host_factory.cc:34:22 #3 0x5652e22d0292 in content::RenderFrameHostManager::CreateRenderFrameHost(content::RenderFrameHostManager::CreateFrameCase, content::SiteInstanceImpl*, int, mojo::PendingAssociatedRemote, base::TokenType const&, base::TokenType const&, base::UnguessableToken, bool, scoped_refptr, content::ProcessAllocationContext const&) content/browser/renderer_host/render_frame_host_manager.cc:4406:10 #4 0x5652e22febf9 in content::RenderFrameHostManager::CreateSpeculativeRenderFrame(content::SiteInstanceImpl*, bool, scoped_refptr const&, std::__Cr::optional const&) content/browser/renderer_host/render_frame_host_manager.cc:4576:7 #5 0x5652e22eaacf in content::RenderFrameHostManager::CreateSpeculativeRenderFrameHost(content::SiteInstanceImpl*, content::SiteInstanceImpl*, bool, content::ProcessAllocationContext const&, std::__Cr::optional const&) content/browser/renderer_host/render_frame_host_manager.cc:4528:36 #6 0x5652e22e3a12 in content::RenderFrameHostManager::GetFrameHostForNavigation(content::NavigationRequest*, content::BrowsingContextGroupSwap*, content::ProcessAllocationContext const&, std::__Cr::basic_string, std::__Cr::allocator>*) content/browser/renderer_host/render_frame_host_manager.cc:2175:22 #7 0x5652e22e1520 in content::RenderFrameHostManager::DidCreateNavigationRequest(content::NavigationRequest*) content/browser/renderer_host/render_frame_host_manager.cc:1728:21 #8 0x5652e1e147db in content::FrameTreeNode::TakeNavigationRequest(std::__Cr::unique_ptr>) content/browser/renderer_host/frame_tree_node.cc:628:21 #9 0x5652e2129f64 in content::Navigator::Navigate(std::__Cr::unique_ptr>, content::ReloadType) content/browser/renderer_host/navigator.cc:1060:20 #10 0x5652e1ff9fc1 in content::NavigationControllerImpl::NavigateWithoutEntry(content::NavigationController::LoadURLParams const&, base::TimeTicks) content/browser/renderer_host/navigation_controller_impl.cc:4353:21 #11 0x5652e1ff82c7 in content::NavigationControllerImpl::LoadURLWithParams(content::NavigationController::LoadURLParams const&) content/browser/renderer_host/navigation_controller_impl.cc:1766:10 #12 0x5652e643f72a in content::NavigationSimulatorImpl::BrowserInitiatedStartAndWaitBeforeUnload() content/test/navigation_simulator_impl.cc:1192:38 #13 0x5652e642e49f in content::NavigationSimulatorImpl::SimulateBrowserInitiatedStart() content/test/navigation_simulator_impl.cc:1315:5 #14 0x5652e642dcae in content::NavigationSimulatorImpl::Start() content/test/navigation_simulator_impl.cc:473:10 #15 0x5652e6432bb7 in content::NavigationSimulatorImpl::ReadyToCommit() content/test/navigation_simulator_impl.cc:590:7 #16 0x5652d181ed42 in content::RenderFrameHostImplTest_ExitFullscreenDestructionDuringCommit_Test::TestBody() content/browser/renderer_host/render_frame_host_impl_unittest.cc:283:8 #17 0x5652d6a1d42b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #18 0x5652d6a20597 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #19 0x5652d6a22693 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #20 0x5652d6a5225a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #21 0x5652d6a50d2e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #22 0x5652e693c15c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #23 0x5652e63ea685 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #24 0x5652e5fcacc1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #25 0x5652e6992ecb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #26 0x5652e69927eb in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #27 0x5652e5fca834 in main content/test/run_all_unittests.cc:17:10 #28 0x7bf5cbc2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)