[1404:1404:0524/162854.240515:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1587] drmGetDevices2() has not found any devices [1404:1404:0524/162854.241705:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [1373:1373:0524/162854.282698:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured. [1373:1373:0524/162854.340399:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. (chrome:1373): dbind-WARNING **: 16:28:54.434: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory [1373:1373:0524/162855.063939:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [1373:1373:0524/162855.064011:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [1373:1373:0524/162855.144650:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. [1458:1458:0524/162857.946407:ERROR:content/renderer/render_frame_impl.cc:4165] POC: renderer forging histogram shmem records [1458:1458:0524/162857.958740:ERROR:content/renderer/render_frame_impl.cc:4180] POC: record 1 (dummy_histogram) created, type=0 [1458:1458:0524/162857.958801:ERROR:content/renderer/render_frame_impl.cc:4228] POC: record 2 (evil2) created, ref=93016 [1458:1458:0524/162857.958837:ERROR:content/renderer/render_frame_impl.cc:4236] POC: terminating renderer to trigger browser-side merge ================================================================= ==1373==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x56c54c3e2ae0 in thread T13 (ThreadPoolForeg) #0 0x56c5125f71a2 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e301a2) (BuildId: f8f3118307058798) #1 0x56c52a69a7de in base::StatisticsRecorder::RegisterOrDeleteDuplicate(base::HistogramBase*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x56c52a677e6c in base::PersistentHistogramAllocator::GetOrCreateStatisticsRecorderHistogram(base::HistogramBase const*, std::__Cr::basic_string_view>) base/metrics/persistent_histogram_allocator.cc:759:10 #3 0x56c52a67791b in base::PersistentHistogramAllocator::MergeHistogramDeltaToStatisticsRecorder(base::HistogramBase*, std::__Cr::basic_string_view>) base/metrics/persistent_histogram_allocator.cc:505:7 #4 0x56c5422c443a in metrics::SubprocessMetricsProvider::MergeHistogramDeltasFromAllocator(int, metrics::SubprocessMetricsProvider::RefCountedAllocator*) components/metrics/content/subprocess_metrics_provider.cc:312:24 #5 0x56c5422c6554 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #6 0x56c52a810aeb in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(base::internal::PostTaskAndReplyRelay) base/functional/callback.h:155:12 #7 0x56c52a81103e in base::internal::Invoker, base::internal::BindState, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #8 0x56c52a7874c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #9 0x56c52a81e1c2 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5 #10 0x56c52a81e54c in base::internal::TaskTracker::RunBlockShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:683:3 #11 0x56c52a81c9d4 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:708:7 #12 0x56c52a81bc82 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5 #13 0x56c52a860973 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36 #14 0x56c52a85fab4 in base::internal::WorkerThread::RunPooledWorker() base/task/thread_pool/worker_thread.cc:359:3 #15 0x56c52a85f51b in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:339:7 #16 0x56c52a8eb08e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #17 0x56c5125baf16 in asan_thread_start(void*) asan_interceptors.cpp 0x56c54c3e2ae0 is located 0 bytes inside of global variable 'base::DummyHistogram::GetInstance()::dummy_histogram' defined in '../../base/metrics/dummy_histogram.cc' (0x56c54c3e2ae0) of size 24 SUMMARY: AddressSanitizer: bad-free (/chromium/chromium/src/out/asan/chrome+0x10e301a2) (BuildId: f8f3118307058798) in operator delete(void*, unsigned long) Thread T13 (ThreadPoolForeg) created by T5 (ThreadPoolForeg) here: #0 0x56c5125a0d91 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10dd9d91) (BuildId: f8f3118307058798) #1 0x56c52a8ea6e2 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x56c52a85e264 in base::internal::WorkerThread::Start(scoped_refptr, base::WorkerThreadObserver*) base/task/thread_pool/worker_thread.cc:185:3 #3 0x56c52a8208b5 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush() base/task/thread_pool/thread_group.cc:65:13 #4 0x56c52a820570 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor() base/task/thread_pool/thread_group.cc:56:3 #5 0x56c52a853881 in base::internal::ThreadGroupImpl::WorkerDelegate::GetWork(base::internal::WorkerThread*) base/task/thread_pool/thread_group_impl.cc:71:3 #6 0x56c52a860793 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:460:52 #7 0x56c52a85fab4 in base::internal::WorkerThread::RunPooledWorker() base/task/thread_pool/worker_thread.cc:359:3 #8 0x56c52a85f51b in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:339:7 #9 0x56c52a8eb08e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #10 0x56c5125baf16 in asan_thread_start(void*) asan_interceptors.cpp Thread T5 (ThreadPoolForeg) created by T0 (chrome) here: #0 0x56c5125a0d91 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10dd9d91) (BuildId: f8f3118307058798) #1 0x56c52a8ea6e2 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x56c52a85e264 in base::internal::WorkerThread::Start(scoped_refptr, base::WorkerThreadObserver*) base/task/thread_pool/worker_thread.cc:185:3 #3 0x56c52a8208b5 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush() base/task/thread_pool/thread_group.cc:65:13 #4 0x56c52a820570 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor() base/task/thread_pool/thread_group.cc:56:3 #5 0x56c52a851374 in base::internal::ThreadGroupImpl::Start(unsigned long, unsigned long, base::TimeDelta, scoped_refptr, base::WorkerThreadObserver*, base::internal::ThreadGroup::WorkerEnvironment, bool, std::__Cr::optional) base/task/thread_pool/thread_group_impl.cc:71:3 #6 0x56c52a82de75 in base::internal::ThreadPoolImpl::Start(base::ThreadPoolInstance::InitParams const&, base::WorkerThreadObserver*) base/task/thread_pool/thread_pool_impl.cc:241:35 #7 0x56c51fd8d764 in content::StartBrowserThreadPool() content/browser/startup_helper.cc:98:36 #8 0x56c526f88df3 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1259:7 #9 0x56c526f87ea0 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12 #10 0x56c526f81788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #11 0x56c526f81d8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #12 0x56c5125f8266 in ChromeMain chrome/app/chrome_main.cc:194:12 #13 0x7561b6a2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) ==1373==ADDITIONAL INFO ==1373==Note: Please include this section with the ASan report. Task trace: #0 0x56c5422c319f in metrics::SubprocessMetricsProvider::DeregisterSubprocessAllocator(int) components/metrics/content/subprocess_metrics_provider.cc:137:7 #1 0x56c52e638e0b in IPC::ChannelProxy::Context::OnChannelError() ipc/ipc_channel_proxy.cc:106:7 #2 0x56c52b5dbb43 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13 Command line: `/chromium/chromium/src/out/asan/chrome --no-first-run --no-default-browser-check --ignore-gpu-blocklist --disable-gpu --no-sandbox --user-data-dir=/tmp/chrome-poc-profile --enable-logging=stderr --v=0 --ozone-platform=x11 --flag-switches-begin --flag-switches-end http://127.0.0.1:18080/trigger-histogram-poc` ==1373==END OF ADDITIONAL INFO ==1373==ABORTING