[.] Sanitizer coverage enabled. Counter map size: 12114892, Cmp map size: 262144
Note: Google Test filter = DownloadItemTest.ObserverRemoveDuringTargetResolvedUAF
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from DownloadItemTest
[ RUN      ] DownloadItemTest.ObserverRemoveDuringTargetResolvedUAF
[2019:2019:ERROR:base/observer_list.h:192] Check failed: !check_reentrancy || reentrancy != ObserverListReentrancyPolicy::kDisallowReentrancy || list_.IsOnlyRemainingNode(). 
[2019:2019:ERROR:base/observer_list.h:192] Check failed: !check_reentrancy || reentrancy != ObserverListReentrancyPolicy::kDisallowReentrancy || list_.IsOnlyRemainingNode(). 
[2019:2019:ERROR:base/observer_list.h:192] Check failed: !check_reentrancy || reentrancy != ObserverListReentrancyPolicy::kDisallowReentrancy || list_.IsOnlyRemainingNode(). 
=================================================================
==2019==ERROR: AddressSanitizer: heap-use-after-free on address 0x78815ddf9100 at pc 0x593fd78b393c bp 0x7fffdfbac8f0 sp 0x7fffdfbac8e8
WRITE of size 1 at 0x78815ddf9100 thread T0
    #0 0x593fd78b393b in download::DownloadItemImpl::UpdateObservers() components/download/internal/common/download_item_impl.cc:553:26
    #1 0x593fd78c5ad0 in download::DownloadItemImpl::OnTargetResolved() components/download/internal/common/download_item_impl.cc:1918:3
    #2 0x593fd78c5d41 in download::DownloadItemImpl::OnDownloadRenamedToIntermediateName(download::DownloadInterruptReason, base::FilePath const&) components/download/internal/common/download_item_impl.cc:1880:3
    #3 0x593fd78cdcae in base::internal::Invoker<base::internal::FunctorTraits<void (download::DownloadItemImpl::*&&)(download::DownloadInterruptReason, base::FilePath const&), base::WeakPtr<download::DownloadItemImpl>&&>, base::internal::BindState<true, true, false, void (download::DownloadItemImpl::*)(download::DownloadInterruptReason, base::FilePath const&), base::WeakPtr<download::DownloadItemImpl>>, void (download::DownloadInterruptReason, base::FilePath const&)>::RunOnce(base::internal::BindStateBase*, download::DownloadInterruptReason, base::FilePath const&) base/functional/bind_internal.h:740:12
    #4 0x593fd78a5bc8 in base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (download::DownloadInterruptReason, base::FilePath const&)>&&, download::DownloadInterruptReason&&, base::FilePath&&>, base::internal::BindState<false, true, true, base::OnceCallback<void (download::DownloadInterruptReason, base::FilePath const&)>, download::DownloadInterruptReason, base::FilePath>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/callback.h:155:12
    #5 0x593fe3d235c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #6 0x593fe3d92c7c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #7 0x593fe3d91b1a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #8 0x593fe3f3c398 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #9 0x593fe3f3f958 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #10 0x7ae16539a718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)

0x78815ddf9100 is located 1152 bytes inside of 1240-byte region [0x78815ddf8c80,0x78815ddf9158)
freed by thread T0 here:
    #0 0x593fb782fc4d in operator delete(void*) (/chromium/chromium/src/out/asan/components_unittests+0x171c6c4d) (BuildId: 9b1f00ec611df920)
    #1 0x593fdea6b645 in unsigned long std::__Cr::__tree<std::__Cr::__value_type<download::DownloadItem*, std::__Cr::unique_ptr<download::DownloadItem, std::__Cr::default_delete<download::DownloadItem>>>, std::__Cr::__map_value_compare<download::DownloadItem*, std::__Cr::pair<download::DownloadItem* const, std::__Cr::unique_ptr<download::DownloadItem, std::__Cr::default_delete<download::DownloadItem>>>, std::__Cr::less<download::DownloadItem*>>, std::__Cr::allocator<std::__Cr::pair<download::DownloadItem* const, std::__Cr::unique_ptr<download::DownloadItem, std::__Cr::default_delete<download::DownloadItem>>>>>::__erase_unique<download::DownloadItem*>(download::DownloadItem* const&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x593fdea6fd01 in void std::__Cr::__function::__policy_func<void (download::DownloadItemImpl*)>::__call_func<testing::OnceAction<void (download::DownloadItemImpl*)>::StdFunctionAdaptor<testing::internal::InvokeWithoutArgsAction<download::(anonymous namespace)::DownloadItemTest_ObserverRemoveDuringTargetResolvedUAF_Test::TestBody()::$_0>>>(std::__Cr::__function::__policy_storage const*, download::DownloadItemImpl*) gen/third_party/libc++/src/include/map:1262:79
    #3 0x593fdea4ee03 in testing::internal::FunctionMocker<void (download::DownloadItemImpl*)>::InvokeWith(std::__Cr::tuple<download::DownloadItemImpl*>&&) gen/third_party/libc++/src/include/__functional/function.h:502:12
    #4 0x593fdea2be65 in download::(anonymous namespace)::MockDelegate::DownloadRemoved(download::DownloadItemImpl*) third_party/googletest/src/googlemock/include/gmock/gmock-spec-builders.h:1548:12
    #5 0x593fd78b3500 in download::DownloadItemImpl::UpdateObservers() components/download/internal/common/download_item_impl.cc:552:14
    #6 0x593fd78c5ad0 in download::DownloadItemImpl::OnTargetResolved() components/download/internal/common/download_item_impl.cc:1918:3
    #7 0x593fd78c5d41 in download::DownloadItemImpl::OnDownloadRenamedToIntermediateName(download::DownloadInterruptReason, base::FilePath const&) components/download/internal/common/download_item_impl.cc:1880:3
    #8 0x593fd78cdcae in base::internal::Invoker<base::internal::FunctorTraits<void (download::DownloadItemImpl::*&&)(download::DownloadInterruptReason, base::FilePath const&), base::WeakPtr<download::DownloadItemImpl>&&>, base::internal::BindState<true, true, false, void (download::DownloadItemImpl::*)(download::DownloadInterruptReason, base::FilePath const&), base::WeakPtr<download::DownloadItemImpl>>, void (download::DownloadInterruptReason, base::FilePath const&)>::RunOnce(base::internal::BindStateBase*, download::DownloadInterruptReason, base::FilePath const&) base/functional/bind_internal.h:740:12
    #9 0x593fd78a5bc8 in base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (download::DownloadInterruptReason, base::FilePath const&)>&&, download::DownloadInterruptReason&&, base::FilePath&&>, base::internal::BindState<false, true, true, base::OnceCallback<void (download::DownloadInterruptReason, base::FilePath const&)>, download::DownloadInterruptReason, base::FilePath>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/callback.h:155:12
    #10 0x593fe3d235c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #11 0x593fe3d92c7c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #12 0x593fe3d91b1a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #13 0x593fe3f3c398 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #14 0x593fe3f3f958 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #15 0x7ae16539a718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)

previously allocated by thread T0 here:
    #0 0x593fb782f40d in operator new(unsigned long) (/chromium/chromium/src/out/asan/components_unittests+0x171c640d) (BuildId: 9b1f00ec611df920)
    #1 0x593fdea6dda3 in download::(anonymous namespace)::DownloadItemTest_ObserverRemoveDuringTargetResolvedUAF_Test::TestBody() components/download/public/common/download_item_impl.h:49:3
    #2 0x593fd710979b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x593fd710c817 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x593fd710e893 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x593fd713da14 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x593fd713c58a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x593fec8bd960 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x593ff9839395 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23
    #9 0x593fdf011de0 in base::internal::Invoker<base::internal::FunctorTraits<int (content::UnitTestTestSuite::*&&)(), std::__Cr::unique_ptr<content::UnitTestTestSuite, std::__Cr::default_delete<content::UnitTestTestSuite>>&&>, base::internal::BindState<true, true, false, int (content::UnitTestTestSuite::*)(), std::__Cr::unique_ptr<content::UnitTestTestSuite, std::__Cr::default_delete<content::UnitTestTestSuite>>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #10 0x593fec8d67bb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #11 0x593fec8d60db in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #12 0x7ae15ff88249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Shadow bytes around the buggy address:
  0x78815ddf8e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x78815ddf8f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x78815ddf8f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x78815ddf9000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x78815ddf9080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x78815ddf9100:[fd]fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x78815ddf9180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x78815ddf9200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x78815ddf9280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x78815ddf9300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x78815ddf9380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
E0000 00:00:1779237603.732521    2019 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2019==ADDITIONAL INFO
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779237603.732648    2019 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2019==Note: Please include this section with the ASan report.
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779237603.732682    2019 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace:
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779237603.736828    2019 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary:     #0 0x593fdea5dc1c in void std::__Cr::__function::__policy_func<void (base::OnceCallback<void (download::DownloadInterruptReason, base::FilePath const&)>)>::__call_func<testing::OnceAction<void (base::OnceCallback<void (download::DownloadInterruptReason, base::FilePath const&)>)>::StdFunctionAdaptor<download::(anonymous namespace)::DownloadItemTest::SetRenameExpectation(download::MockDownloadFile*, scoped_refptr<base::SingleThreadTaskRunner>, base::FilePath const&, download::DownloadInterruptReason)::'lambda'(base::OnceCallback<void (download::DownloadInterruptReason, base::FilePath const&)>)>>(std::__Cr::__function::__policy_storage const*, base::OnceCallback<void (download::DownloadInterruptReason, base::FilePath const&)>&&) components/download/internal/common/download_item_impl_unittest.cc:345:15
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779237603.736884    2019 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary:     #1 0x593fd78c52b2 in download::DownloadItemImpl::OnDownloadTargetDetermined(download::DownloadTargetInfo) components/download/internal/common/download_item_impl.cc:1854:7
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779237603.736903    2019 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779237603.736926    2019 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2019==END OF ADDITIONAL INFO
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779237603.736949    2019 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2019==ABORTING
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31