[3876:3895:0527/005928.112631:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [3876:3895:0527/005928.113052:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [3876:3895:0527/005928.118394:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [3876:3895:0527/005928.119048:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [3876:3895:0527/005928.119260:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [3876:3895:0527/005928.133063:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [3914:3914:0527/005928.152809:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1648] drmGetDevices2() has not found any devices [3914:3914:0527/005928.154195:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [3876:3876:0527/005928.190148:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured. [3876:3895:0527/005928.198098:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [3876:3876:0527/005928.246031:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [3876:3876:0527/005928.246151:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [3876:3876:0527/005928.246199:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [3876:3895:0527/005928.246282:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [3876:3895:0527/005928.246385:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [3876:3876:0527/005928.246601:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [3876:3876:0527/005928.254561:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: (poc.html:3876): dbind-WARNING **: 00:59:28.265: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory [3876:3895:0527/005928.473479:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [3876:3876:0527/005928.473514:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [3876:3895:0527/005928.473626:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [3876:3876:0527/005928.474328:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [3876:3895:0527/005928.474449:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [3876:3876:0527/005928.506642:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [3876:3876:0527/005928.508209:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [3876:3876:0527/005928.508325:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [3876:3876:0527/005928.508702:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [3876:3895:0527/005928.510496:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [3876:3876:0527/005928.536836:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [3876:3895:0527/005928.537079:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [3876:3876:0527/005928.572796:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [3876:3876:0527/005928.572827:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. [3876:3876:0527/005928.720660:INFO:CONSOLE:9] "[poc] wrapper iframe onload", source: http://127.0.0.1:8080/poc.html (9) [3876:3876:0527/005928.918650:INFO:CONSOLE:9] "[poc] attempt #1 internalid=E4B99AFA1A8EC32BB1F54F55B0463047 frames=1", source: http://127.0.0.1:8080/poc.html (9) [3876:3876:0527/005928.918730:INFO:CONSOLE:9] "[poc] caching pm; waiting for guest DidLoad...", source: http://127.0.0.1:8080/poc.html (9) [3876:3895:0527/005933.628879:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT ================================================================= ==3971==ERROR: AddressSanitizer: heap-use-after-free on address 0x705364b4f548 at pc 0x55f5774387c6 bp 0x7ffe00fa7910 sp 0x7ffe00fa7908 READ of size 8 at 0x705364b4f548 thread T0 (chrome) [3876:3876:0527/005934.948164:INFO:CONSOLE:9] "[poc] calling cached pm({}) ...", source: http://127.0.0.1:8080/poc.html (9) [3876:3876:0527/005934.948264:INFO:CONSOLE:9] "[poc] getter fired: removing wrapper iframe (frees |this|)", source: http://127.0.0.1:8080/poc.html (9) #0 0x55f5774387c5 in extensions::PostMessageSupport::PostJavaScriptMessage(v8::Isolate*, v8::Local) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1012:48 #1 0x55f57743b93a in void base::internal::Invoker), base::WeakPtr const&, v8::Isolate* const&>, base::internal::BindState), base::WeakPtr, base::internal::UnretainedWrapper>, void (v8::Local)>::RunImpl), std::__Cr::tuple, base::internal::UnretainedWrapper> const&, 0ul, 1ul>(void (extensions::PostMessageSupport::* const&)(v8::Isolate*, v8::Local), std::__Cr::tuple, base::internal::UnretainedWrapper> const&, std::__Cr::integer_sequence, v8::Local&&) base/functional/bind_internal.h:740:12 #2 0x55f57743b37d in base::RepeatingCallback)>::Run(v8::Local) const & base/functional/callback.h:346:12 #3 0x55f57743aa59 in gin::internal::Dispatcher)>::DispatchToCallbackImpl(gin::Arguments*) gin/function_template.h:250:14 #4 0x55f57743a6f1 in gin::internal::Dispatcher)>::DispatchToCallback(v8::FunctionCallbackInfo const&) gin/function_template.h:292:5 #5 0x55f56a2006d3 in Builtins_CallApiCallbackGeneric crtstuff.c #6 0x55f56a1fe956 in Builtins_InterpreterEntryTrampoline crtstuff.c #7 0x55f56a1fb6db in Builtins_JSEntryTrampoline crtstuff.c #8 0x55f56a1fb42a in Builtins_JSEntry crtstuff.c #9 0x55f5654eb7e1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22 #10 0x55f5654ea121 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>) v8/src/execution/execution.cc:565:10 #11 0x55f56513619d in v8::Function::Call(v8::Isolate*, v8::Local, v8::Local, int, v8::Local*) v8/src/api/api.cc:5612:27 #12 0x55f5841c3a4f in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:851:48 #13 0x55f5899eca16 in blink::bindings::CallbackInvokeHelper::Call(int, v8::Local*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:123:12 #14 0x55f589a0440d in blink::V8Function::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:73:13 #15 0x55f589a04b49 in blink::V8Function::InvokeAndReportException(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:133:15 #16 0x55f58a7a7739 in blink::ScheduledAction::Execute(blink::ExecutionContext*) third_party/blink/renderer/core/scheduler/scheduled_action.cc:145:18 #17 0x55f58a79fb46 in blink::DOMTimer::Fired() third_party/blink/renderer/core/scheduler/dom_timer.cc:459:11 #18 0x55f58894e34d in blink::TimerBase::RunInternal() third_party/blink/renderer/platform/timer.cc:166:3 #19 0x55f584128ed0 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #20 0x55f5778173e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #21 0x55f577886a9c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #22 0x55f57788593a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #23 0x55f5776d5a72 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #24 0x55f577888184 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #25 0x55f577791980 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #26 0x55f58404fde4 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16 #27 0x55f574188dc3 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14 #28 0x55f57418a0cb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12 #29 0x55f57418cfd1 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10 #30 0x55f5741867db in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #31 0x55f574186dcc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #32 0x55f55f21a02b in ChromeMain chrome/app/chrome_main.cc:221:12 #33 0x73f36682b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x705364b4f548 is located 40 bytes inside of 64-byte region [0x705364b4f520,0x705364b4f560) freed by thread T0 (chrome) here: #0 0x55f55f218e56 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x11352e56) (BuildId: 1a338d794d353982) #1 0x55f577431724 in extensions::MimeHandlerViewContainerManager::~MimeHandlerViewContainerManager() third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x55f577431803 in extensions::MimeHandlerViewContainerManager::~MimeHandlerViewContainerManager() extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container_manager.cc:139:67 #3 0x55f577435b3a in std::__Cr::vector, std::__Cr::unique_ptr>>, std::__Cr::allocator, std::__Cr::unique_ptr>>>>::erase(std::__Cr::__wrap_iter, std::__Cr::unique_ptr>> const*>, std::__Cr::__wrap_iter, std::__Cr::unique_ptr>> const*>) third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #4 0x55f583e5ca8b in content::RenderFrameImpl::~RenderFrameImpl() content/renderer/render_frame_impl.cc:2037:14 #5 0x55f583e5f3e3 in content::RenderFrameImpl::~RenderFrameImpl() content/renderer/render_frame_impl.cc:2033:37 #6 0x55f583e8b334 in content::RenderFrameImpl::FrameDetached(blink::DetachReason) content/renderer/render_frame_impl.cc:3836:3 #7 0x55f585a5a5b9 in blink::LocalFrameClientImpl::Detached(blink::FrameDetachType) third_party/blink/renderer/core/frame/local_frame_client_impl.cc:381:11 #8 0x55f58562e3af in blink::Frame::Detach(blink::FrameDetachType) third_party/blink/renderer/core/frame/frame.cc:172:12 #9 0x55f585e00531 in blink::HTMLFrameOwnerElement::DisconnectContentFrame() third_party/blink/renderer/core/html/html_frame_owner_element.cc:377:19 #10 0x55f5857528a6 in blink::ChildFrameDisconnector::DisconnectCollectedFrameOwners() third_party/blink/renderer/core/dom/child_frame_disconnector.cc:65:14 #11 0x55f588e12f46 in blink::ContainerNode::WillRemoveChild(blink::Node&) third_party/blink/renderer/core/dom/container_node.cc:871:10 #12 0x55f588e11321 in blink::ContainerNode::RemoveChild(blink::Node*, blink::ExceptionState&) third_party/blink/renderer/core/dom/container_node.cc:996:3 #13 0x55f589c87337 in blink::(anonymous namespace)::v8_element::RemoveOperationCallback(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/core/v8/v8_element.cc:4520:17 #14 0x55f56a2006d3 in Builtins_CallApiCallbackGeneric crtstuff.c #15 0x55f56a1fe956 in Builtins_InterpreterEntryTrampoline crtstuff.c #16 0x55f56a1fb6db in Builtins_JSEntryTrampoline crtstuff.c #17 0x55f56a1fb42a in Builtins_JSEntry crtstuff.c #18 0x55f5654eb7e1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22 #19 0x55f5654ea121 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>) v8/src/execution/execution.cc:565:10 #20 0x55f566285614 in v8::internal::Object::GetPropertyWithAccessor(v8::internal::LookupIterator*) v8/src/objects/objects.cc:1730:22 #21 0x55f566283227 in v8::internal::Object::GetProperty(v8::internal::LookupIterator*, bool) v8/src/objects/objects.cc:1348:16 #22 0x55f566707609 in v8::internal::Runtime::GetObjectProperty(v8::internal::Isolate*, v8::internal::DirectHandle>, v8::internal::DirectHandle, v8::internal::DirectHandle>, bool*) v8/src/runtime/runtime-object.cc:42:38 #23 0x55f565127201 in v8::Object::Get(v8::Local, v8::Local) v8/src/api/api.cc:4800:7 #24 0x55f5772c6ac5 in bool gin::Dictionary::Get>(std::__Cr::basic_string, std::__Cr::allocator> const&, v8::Local*) gin/dictionary.h:38:19 #25 0x55f577438316 in extensions::PostMessageSupport::PostJavaScriptMessage(v8::Isolate*, v8::Local) extensions/renderer/guest_view/mime_handler_view/post_message_support.cc:151:22 #26 0x55f57743b93a in void base::internal::Invoker), base::WeakPtr const&, v8::Isolate* const&>, base::internal::BindState), base::WeakPtr, base::internal::UnretainedWrapper>, void (v8::Local)>::RunImpl), std::__Cr::tuple, base::internal::UnretainedWrapper> const&, 0ul, 1ul>(void (extensions::PostMessageSupport::* const&)(v8::Isolate*, v8::Local), std::__Cr::tuple, base::internal::UnretainedWrapper> const&, std::__Cr::integer_sequence, v8::Local&&) base/functional/bind_internal.h:740:12 #27 0x55f57743b37d in base::RepeatingCallback)>::Run(v8::Local) const & base/functional/callback.h:346:12 #28 0x55f57743aa59 in gin::internal::Dispatcher)>::DispatchToCallbackImpl(gin::Arguments*) gin/function_template.h:250:14 #29 0x55f57743a6f1 in gin::internal::Dispatcher)>::DispatchToCallback(v8::FunctionCallbackInfo const&) gin/function_template.h:292:5 previously allocated by thread T0 (chrome) here: #0 0x55f55f218251 in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x11352251) (BuildId: 1a338d794d353982) #1 0x55f577431e81 in extensions::MimeHandlerViewContainerManager::CreateBeforeUnloadControl(base::OnceCallback)>) third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x55f56e60b8f3 in extensions::mojom::MimeHandlerViewContainerManagerStubDispatch::AcceptWithResponder(extensions::mojom::MimeHandlerViewContainerManager*, mojo::Message*, std::__Cr::unique_ptr>) gen/extensions/common/mojom/guest_view.mojom.cc:1195:13 #3 0x55f578600a5b in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #4 0x55f57861e713 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24 #5 0x55f578606da3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #6 0x55f57b7359b3 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24 #7 0x55f57b737e35 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #8 0x55f5778173e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #9 0x55f577886a9c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #10 0x55f57788593a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #11 0x55f5776d5a72 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #12 0x55f577888184 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #13 0x55f577791980 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #14 0x55f58404fde4 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16 #15 0x55f574188dc3 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14 #16 0x55f57418a0cb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12 #17 0x55f57418cfd1 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10 #18 0x55f5741867db in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #19 0x55f574186dcc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #20 0x55f55f21a02b in ChromeMain chrome/app/chrome_main.cc:221:12 #21 0x73f36682b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1012:48 in extensions::PostMessageSupport::PostJavaScriptMessage(v8::Isolate*, v8::Local) Shadow bytes around the buggy address: 0x705364b4f280: fd fd fd fd fd fd fd fd fa fa f7 fa fd fd fd fd 0x705364b4f300: fd fd fd fa fa fa f7 fa fd fd fd fd fd fd fd fa 0x705364b4f380: fa fa f7 fa 00 00 00 00 00 00 00 00 fa fa f7 fa 0x705364b4f400: 00 00 00 00 00 00 00 fa fa fa f7 fa fd fd fd fd 0x705364b4f480: fd fd fd fa fa fa f7 fa fd fd fd fd fd fd fd fa =>0x705364b4f500: fa fa f7 fa fd fd fd fd fd[fd]fd fd fa fa f7 fa 0x705364b4f580: fd fd fd fd fd fd fd fd fa fa f7 fa fd fd fd fd 0x705364b4f600: fd fd fd fa fa fa f7 fa fd fd fd fd fd fd fd fd 0x705364b4f680: fa fa f7 fa fd fd fd fd fd fd fd fa fa fa f7 fa 0x705364b4f700: fd fd fd fd fd fd fd fa fa fa f7 fa fd fd fd fd 0x705364b4f780: fd fd fd fd fa fa f7 fa fd fd fd fd fd fd fd fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3971==ADDITIONAL INFO ==3971==Note: Please include this section with the ASan report. Task trace: #0 0x55f58a79e7cc in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool, blink::probe::AsyncTaskContext::ScanForAds) third_party/blink/renderer/core/scheduler/dom_timer.cc:348:27 #1 0x55f58a79e7cc in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool, blink::probe::AsyncTaskContext::ScanForAds) third_party/blink/renderer/core/scheduler/dom_timer.cc:348:27 #2 0x55f588eba189 in blink::Document::DecrementLoadEventDelayCount() third_party/blink/renderer/core/dom/document.cc:8762:61 #3 0x55f5858044a3 in blink::LocalFrameView::PerformPostLayoutTasks(bool) third_party/blink/renderer/core/frame/local_frame_view.cc:1840:57 Command line: `/proc/self/exe --type=renderer --gpu-client-id=6 --crashpad-handler-pid=3882 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --disable-dev-shm-usage --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1779725768335899 --gpu-channel-request-start-time-ticks=117800092815 --launch-time-ticks=117800101239 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,7816436820627300516,6136964989626025400,2097152 --field-trial-handle=3,i,11006834568002946042,3754455047425921456,262144 --disable-features=PdfOopif --variations-seed-version --pseudonymization-salt-handle=7,i,3664418385594079891,6854459548795860891,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=stderr --v=0` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==3971==END OF ADDITIONAL INFO ==3971==ABORTING [3917:3940:0527/005939.945583:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_. [3917:3940:0527/005939.945682:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.