[.] Sanitizer coverage enabled. Counter map size: 2629741, Cmp map size: 262144
Note: Google Test filter = SpdyReadQueueTest.ConsumeCallbackReentrantDequeueUAF
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from SpdyReadQueueTest
[ RUN      ] SpdyReadQueueTest.ConsumeCallbackReentrantDequeueUAF
=================================================================
==4734==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c088d93b4e0 at pc 0x557d3e1db0d8 bp 0x7ffc3c661c00 sp 0x7ffc3c661bf8
READ of size 8 at 0x7c088d93b4e0 thread T0
    #0 0x557d3e1db0d7 in net::SpdyBuffer::Consume(unsigned long) gen/third_party/libc++/src/include/__vector/vector.h:355:57
    #1 0x557d3e1f9070 in net::SpdyReadQueue::Dequeue(base::span<unsigned char, 18446744073709551615ul, unsigned char*>) net/spdy/spdy_read_queue.cc:48:15
    #2 0x557d36b5dda3 in net::test::SpdyReadQueueTest_ConsumeCallbackReentrantDequeueUAF_Test::TestBody() net/spdy/spdy_read_queue_unittest.cc:246:25
    #3 0x557d3d67c26b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #4 0x557d3d67f427 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #5 0x557d3d681533 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #6 0x557d3d6b155a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #7 0x557d3d6affbe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x557d401ffffc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #9 0x557d36e1cf61 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), NetTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<NetTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #10 0x557d4021c68b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #11 0x557d4021bfab in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #12 0x557d36e1cc59 in main net/test/run_all_unittests.cc:53:10
    #13 0x7fc88e347249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7c088d93b4e0 is located 16 bytes inside of 40-byte region [0x7c088d93b4d0,0x7c088d93b4f8)
freed by thread T0 here:
    #0 0x557d3284ba72 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/net_unittests+0x50dfa72) (BuildId: 67d27ebbb8a251b0)
    #1 0x557d3e1f9e71 in base::internal::VectorBuffer<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>>::DestructRange(base::span<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>, 18446744073709551615ul, std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>*>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x557d3e1f9743 in base::circular_deque<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>>::DestructRange(unsigned long, unsigned long) base/containers/circular_deque.h
    #3 0x557d3e1f9007 in net::SpdyReadQueue::Dequeue(base::span<unsigned char, 18446744073709551615ul, unsigned char*>) base/containers/circular_deque.h:1002:5
    #4 0x557d36b5e0e4 in net::test::(anonymous namespace)::ReentrantDequeue(net::SpdyReadQueue*, bool*, unsigned long, unsigned long, net::SpdyBuffer::ConsumeSource) net/spdy/spdy_read_queue_unittest.cc:193:10
    #5 0x557d36b634a4 in void base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(net::SpdyReadQueue*, bool*, unsigned long, unsigned long, net::SpdyBuffer::ConsumeSource), net::SpdyReadQueue* const&, bool* const&, unsigned long const&>, base::internal::BindState<false, true, false, void (*)(net::SpdyReadQueue*, bool*, unsigned long, unsigned long, net::SpdyBuffer::ConsumeSource), base::internal::UnretainedWrapper<net::SpdyReadQueue, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<bool, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, unsigned long>, void (unsigned long, net::SpdyBuffer::ConsumeSource)>::RunImpl<void (* const&)(net::SpdyReadQueue*, bool*, unsigned long, unsigned long, net::SpdyBuffer::ConsumeSource), std::__Cr::tuple<base::internal::UnretainedWrapper<net::SpdyReadQueue, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<bool, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, unsigned long> const&, 0ul, 1ul, 2ul>(void (* const&)(net::SpdyReadQueue*, bool*, unsigned long, unsigned long, net::SpdyBuffer::ConsumeSource), std::__Cr::tuple<base::internal::UnretainedWrapper<net::SpdyReadQueue, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<bool, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, unsigned long> const&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul, 2ul>, unsigned long&&, net::SpdyBuffer::ConsumeSource&&) base/functional/bind_internal.h:673:12
    #6 0x557d36b6320c in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(net::SpdyReadQueue*, bool*, unsigned long, unsigned long, net::SpdyBuffer::ConsumeSource), net::SpdyReadQueue* const&, bool* const&, unsigned long const&>, base::internal::BindState<false, true, false, void (*)(net::SpdyReadQueue*, bool*, unsigned long, unsigned long, net::SpdyBuffer::ConsumeSource), base::internal::UnretainedWrapper<net::SpdyReadQueue, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<bool, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, unsigned long>, void (unsigned long, net::SpdyBuffer::ConsumeSource)>::Run(base::internal::BindStateBase*, unsigned long, net::SpdyBuffer::ConsumeSource) base/functional/bind_internal.h:989:12
    #7 0x557d3e1db771 in base::RepeatingCallback<void (unsigned long, net::SpdyBuffer::ConsumeSource)>::Run(unsigned long, net::SpdyBuffer::ConsumeSource) const & base/functional/callback.h:346:12
    #8 0x557d3e1db09c in net::SpdyBuffer::Consume(unsigned long) net/spdy/spdy_buffer.cc:109:9
    #9 0x557d3e1f9070 in net::SpdyReadQueue::Dequeue(base::span<unsigned char, 18446744073709551615ul, unsigned char*>) net/spdy/spdy_read_queue.cc:48:15
    #10 0x557d36b5dda3 in net::test::SpdyReadQueueTest_ConsumeCallbackReentrantDequeueUAF_Test::TestBody() net/spdy/spdy_read_queue_unittest.cc:246:25
    #11 0x557d3d67c26b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #12 0x557d3d67f427 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #13 0x557d3d681533 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #14 0x557d3d6b155a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #15 0x557d3d6affbe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #16 0x557d401ffffc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #17 0x557d36e1cf61 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), NetTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<NetTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #18 0x557d4021c68b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #19 0x557d4021bfab in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #20 0x557d36e1cc59 in main net/test/run_all_unittests.cc:53:10
    #21 0x7fc88e347249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 here:
    #0 0x557d3284ae6d in operator new(unsigned long) (/chromium/chromium/src/out/asan/net_unittests+0x50dee6d) (BuildId: 67d27ebbb8a251b0)
    #1 0x557d36b5db0b in net::test::SpdyReadQueueTest_ConsumeCallbackReentrantDequeueUAF_Test::TestBody() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x557d3d67c26b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x557d3d67f427 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x557d3d681533 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x557d3d6b155a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x557d3d6affbe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x557d401ffffc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x557d36e1cf61 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), NetTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<NetTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x557d4021c68b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x557d4021bfab in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x557d36e1cc59 in main net/test/run_all_unittests.cc:53:10
    #12 0x7fc88e347249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Shadow bytes around the buggy address:
  0x7c088d93b200: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
  0x7c088d93b280: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x7c088d93b300: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x7c088d93b380: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
  0x7c088d93b400: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fd
=>0x7c088d93b480: fa fa fd fd fd fd fd fd fa fa fd fd[fd]fd fd fa
  0x7c088d93b500: fa fa fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x7c088d93b580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c088d93b600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c088d93b680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c088d93b700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
E0000 00:00:1775212401.867909    4734 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4734==ADDITIONAL INFO
E0000 00:00:1775212401.868276    4734 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4734==Note: Please include this section with the ASan report.
E0000 00:00:1775212401.868405    4734 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace:
E0000 00:00:1775212401.868524    4734 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
E0000 00:00:1775212401.868635    4734 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4734==END OF ADDITIONAL INFO
E0000 00:00:1775212401.868738    4734 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4734==ABORTING