[1791:1806:0614/010733.894007:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [1791:1806:0614/010733.961977:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [1791:1806:0614/010733.962177:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [1791:1806:0614/010733.962271:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [1791:1806:0614/010733.962351:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [1791:1806:0614/010733.978860:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [1823:1823:0614/010734.004593:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1655] drmGetDevices2() has not found any devices [1823:1823:0614/010734.005841:WARNING:sandbox/policy/linux/sandbox_linux.cc:405] InitializeSandbox() called with multiple threads in process gpu-process. [1791:1791:0614/010734.113223:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured. [1791:1806:0614/010734.122556:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [1791:1791:0614/010734.275083:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1791:1791:0614/010734.275222:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [1791:1791:0614/010734.275293:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1791:1806:0614/010734.275403:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [1791:1806:0614/010734.275518:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [1791:1791:0614/010734.275798:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1791:1791:0614/010734.285663:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: (chrome:1791): dbind-WARNING **: 01:07:34.299: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory [1791:1806:0614/010734.393949:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [1791:1806:0614/010734.407430:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [1791:1806:0614/010735.269068:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [1791:1806:0614/010735.269171:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [1791:1791:0614/010735.269214:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1791:1791:0614/010735.270236:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1791:1806:0614/010735.270408:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [1791:1791:0614/010735.371548:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [1791:1791:0614/010735.408112:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [1791:1791:0614/010735.408137:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [1791:1791:0614/010735.410537:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1791:1806:0614/010735.410772:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [1791:1791:0614/010735.430798:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1791:1806:0614/010735.431078:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [1791:1791:0614/010735.475008:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1791:1791:0614/010735.475058:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. [1791:1791:0614/010738.503133:INFO:CONSOLE:10] "[PARENT] iframe created", source: http://a.test:8080/parent.html (10) [1791:1791:0614/010738.604598:INFO:CONSOLE:7] "[CHILD] loaded", source: http://b.test:8080/child.html (7) [1791:1791:0614/010738.785802:INFO:CONSOLE:10] "[PARENT] child armed; scheduling iframe removal", source: http://a.test:8080/parent.html (10) [1791:1791:0614/010739.148514:INFO:CONSOLE:56] "[CHILD] armed", source: http://b.test:8080/child.html (56) [1791:1791:0614/010739.161065:INFO:CONSOLE:26] "[CHILD] ResizeObserver fired inside UpdateVisualState", source: http://b.test:8080/child.html (26) [1900:1900:0614/010740.076156:ERROR:third_party/blink/renderer/platform/widget/widget_base.cc:180] POC: ~WidgetBase this=0x7c313ac91380 [1791:1791:0614/010740.286998:INFO:CONSOLE:10] "[PARENT] removing iframe", source: http://a.test:8080/parent.html (10) [1900:1900:0614/010740.291519:ERROR:third_party/blink/renderer/platform/widget/widget_base.cc:180] POC: ~WidgetBase this=0x7c313ac18e80 [1900:1900:0614/010740.292865:ERROR:third_party/blink/renderer/core/frame/local_frame_view.cc:2456] POC: local root detached during lifecycle; bailing [1900:1900:0614/010740.292940:ERROR:third_party/blink/renderer/core/frame/local_frame_view.cc:2361] POC: UpdateLifecyclePhases: detached after internal [1900:1900:0614/010740.292983:ERROR:third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:1781] POC: WebFrameWidgetImpl::UpdateLifecycle: detached [1791:1791:0614/010740.293328:INFO:CONSOLE:10] "[PARENT] iframe removed", source: http://a.test:8080/parent.html (10) ================================================================= ==1900==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c313ac18ea8 at pc 0x575fdb5da182 bp 0x7ffc0279c170 sp 0x7ffc0279c168 READ of size 8 at 0x7c313ac18ea8 thread T0 (chrome) [1949:1949:0614/010740.331632:ERROR:third_party/blink/renderer/platform/widget/widget_base.cc:180] POC: ~WidgetBase this=0x7c313ac28880 #0 0x575fdb5da181 in blink::WidgetBase::UpdateVisualState() base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1022:48 #1 0x575fd0014aac in cc::LayerTreeHost::RequestMainFrameUpdate(bool) cc/trees/layer_tree_host.cc:405:12 #2 0x575fd032f9ca in cc::ProxyMain::BeginMainFrame(std::__Cr::unique_ptr>) cc/trees/proxy_main.cc:373:21 #3 0x575fd035c8e5 in base::internal::Invoker>), base::WeakPtr&&, std::__Cr::unique_ptr>&&>, base::internal::BindState>), base::WeakPtr, std::__Cr::unique_ptr>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #4 0x575fca2611e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #5 0x575fca2d0cf2 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #6 0x575fca2cfa9a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:345:40 #7 0x575fca120602 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #8 0x575fca2d2454 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:657:12 #9 0x575fca1dc7b0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #10 0x575fd6afe5ec in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16 #11 0x575fc6868b4f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:666:14 #12 0x575fc6869dab in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:773:12 #13 0x575fc686cc61 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1165:10 #14 0x575fc686656b in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #15 0x575fc6866b5c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #16 0x575fb169630b in ChromeMain chrome/app/chrome_main.cc:221:12 #17 0x7ea13ca2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7c313ac18ea8 is located 40 bytes inside of 1120-byte region [0x7c313ac18e80,0x7c313ac192e0) freed by thread T0 (chrome) here: #0 0x575fb1694f56 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x112dcf56) (BuildId: 2a26922885b6e341) #1 0x575fd8451947 in blink::WebFrameWidgetImpl::Close(blink::DetachReason) third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x575fd84fad7f in blink::WebLocalFrameImpl::Close(blink::DetachReason) third_party/blink/renderer/core/frame/web_local_frame_impl.cc:800:20 #3 0x575fd6938e2c in content::RenderFrameImpl::FrameDetached(blink::DetachReason) content/renderer/render_frame_impl.cc:3873:11 #4 0x575fd8547159 in blink::LocalFrameClientImpl::Detached(blink::FrameDetachType) third_party/blink/renderer/core/frame/local_frame_client_impl.cc:381:11 #5 0x575fd8118b37 in blink::Frame::Detach(blink::FrameDetachType) third_party/blink/renderer/core/frame/frame.cc:172:12 #6 0x575fd6913835 in content::RenderFrameImpl::Delete(content::mojom::FrameDeleteIntention) content/renderer/render_frame_impl.cc:2309:11 #7 0x575fb737e831 in content::mojom::FrameStubDispatch::Accept(content::mojom::Frame*, mojo::Message*) gen/content/common/frame.mojom.cc:3074:13 #8 0x575fcb029250 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54 #9 0x575fcb0470a1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #10 0x575fcb02f6d3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #11 0x575fce1a061f in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1200:24 #12 0x575fce1a2a45 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #13 0x575fca2611e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #14 0x575fca2d0cf2 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #15 0x575fca2cfa9a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:345:40 #16 0x575fca120602 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #17 0x575fca2d24d9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:654:12 #18 0x575fca1dc7b0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #19 0x575fe4e951d3 in printing::PrintRenderFrameHelper::RequestPrintPreview(printing::PrintRenderFrameHelper::PrintPreviewRequestType, bool) components/printing/renderer/print_render_frame_helper.cc:2696:12 #20 0x575fe4e93f3c in printing::PrintRenderFrameHelper::ScriptedPrint(bool) components/printing/renderer/print_render_frame_helper.cc:1248:5 #21 0x575fd690fc47 in content::RenderFrameImpl::ScriptedPrint() content/renderer/render_frame_impl.cc:2137:14 #22 0x575fd9e4a774 in blink::ChromeClientImpl::PrintDelegate(blink::LocalFrame*) third_party/blink/renderer/core/page/chrome_client_impl.cc:777:24 #23 0x575fd9e43ea0 in blink::ChromeClient::Print(blink::LocalFrame*) third_party/blink/renderer/core/page/chrome_client.cc:282:3 #24 0x575fdcec97d5 in blink::(anonymous namespace)::v8_window::PrintOperationCallback(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_window.cc:16435:17 #25 0x575fbc7d4653 in Builtins_CallApiCallbackGeneric crtstuff.c #26 0x575fbc7d2940 in Builtins_InterpreterEntryTrampoline crtstuff.c #27 0x575fbc7cf6db in Builtins_JSEntryTrampoline crtstuff.c #28 0x575fbc7cf42a in Builtins_JSEntry crtstuff.c #29 0x575fb79484e1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22 previously allocated by thread T0 (chrome) here: #0 0x575fb1694351 in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x112dc351) (BuildId: 2a26922885b6e341) #1 0x575fd844fa9b in std::__Cr::unique_ptr> std::__Cr::make_unique, blink::CrossVariantMojoAssociatedReceiver, scoped_refptr&, bool&, bool&, bool, bool&, 0>(blink::WebFrameWidgetImpl*&&, blink::CrossVariantMojoAssociatedRemote&&, blink::CrossVariantMojoAssociatedReceiver&&, scoped_refptr&, bool&, bool&, bool&&, bool&) third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x575fd844e16d in blink::WebFrameWidgetImpl::WebFrameWidgetImpl(base::PassKey, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, scoped_refptr, viz::FrameSinkId const&, bool, bool, bool, bool, bool) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:439:20 #3 0x575fd852c020 in blink::WebFrameWidgetImpl* cppgc::MakeGarbageCollectedTrait::Call, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, scoped_refptr, viz::FrameSinkId const&, bool&, bool&, bool&, bool&, bool&>(cppgc::AllocationHandle&, base::PassKey&&, blink::CrossVariantMojoAssociatedRemote&&, blink::CrossVariantMojoAssociatedReceiver&&, blink::CrossVariantMojoAssociatedRemote&&, blink::CrossVariantMojoAssociatedReceiver&&, scoped_refptr&&, viz::FrameSinkId const&, bool&, bool&, bool&, bool&, bool&) v8/include/cppgc/allocation.h:290:32 #4 0x575fd851ab6f in blink::WebLocalFrameImpl::CreateFrameWidgetInternal(base::PassKey, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, viz::FrameSinkId const&, bool, bool, bool) v8/include/cppgc/allocation.h:328:7 #5 0x575fd84f9def in blink::WebLocalFrame::InitializeFrameWidget(blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, viz::FrameSinkId const&, bool, bool, bool) third_party/blink/renderer/core/frame/web_local_frame_impl.cc:698:3 #6 0x575fd6906953 in content::(anonymous namespace)::InitializeFrameWidgetForFrame(blink::WebLocalFrame&, mojo::StructPtr, bool) content/renderer/render_frame_impl.cc:1308:34 #7 0x575fd6905479 in content::RenderFrameImpl::CreateFrame(content::AgentSchedulingGroup&, base::TokenType const&, int, mojo::PendingAssociatedReceiver, mojo::PendingRemote, mojo::PendingAssociatedRemote, blink::WebView*, base::optional_ref, base::TokenType> const, (partition_alloc::internal::RawPtrTraits)0>, base::optional_ref, base::TokenType> const, (partition_alloc::internal::RawPtrTraits)0>, base::optional_ref, base::TokenType> const, (partition_alloc::internal::RawPtrTraits)0>, base::optional_ref, base::TokenType> const, (partition_alloc::internal::RawPtrTraits)0>, base::UnguessableToken const&, std::__Cr::optional const&, blink::mojom::TreeScopeType, mojo::StructPtr, mojo::StructPtr, mojo::StructPtr, bool, base::TokenType const&, mojo::StructPtr, bool) content/renderer/render_frame_impl.cc:1939:5 #8 0x575fd6a03461 in content::AgentSchedulingGroup::CreateFrame(mojo::StructPtr) content/renderer/agent_scheduling_group.cc:383:3 #9 0x575fb735db05 in content::mojom::AgentSchedulingGroupStubDispatch::Accept(content::mojom::AgentSchedulingGroup*, mojo::Message*) gen/content/common/agent_scheduling_group.mojom.cc:697:13 #10 0x575fcb029250 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54 #11 0x575fcb0470a1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #12 0x575fcb02f6d3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #13 0x575fce1a061f in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1200:24 #14 0x575fce1a2a45 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #15 0x575fca2611e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #16 0x575fca2d0cf2 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #17 0x575fca2cfa9a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:345:40 #18 0x575fca120602 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #19 0x575fca2d2454 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:657:12 #20 0x575fca1dc7b0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #21 0x575fd6afe5ec in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16 #22 0x575fc6868b4f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:666:14 #23 0x575fc6869dab in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:773:12 #24 0x575fc686cc61 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1165:10 #25 0x575fc686656b in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #26 0x575fc6866b5c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #27 0x575fb169630b in ChromeMain chrome/app/chrome_main.cc:221:12 #28 0x7ea13ca2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1022:48 in blink::WidgetBase::UpdateVisualState() Shadow bytes around the buggy address: 0x7c313ac18c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c313ac18c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c313ac18d00: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c313ac18d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c313ac18e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa =>0x7c313ac18e80: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd 0x7c313ac18f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c313ac18f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c313ac19000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c313ac19080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c313ac19100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1900==ADDITIONAL INFO ==1900==Note: Please include this section with the ASan report. Task trace: #0 0x575fd0352aec in cc::ProxyImpl::ScheduledActionSendBeginMainFrame(viz::BeginFrameArgs const&) cc/trees/proxy_impl.cc:802:7 Command line: `/proc/self/exe --type=renderer --gpu-client-id=7 --crashpad-handler-pid=1793 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --disable-in-process-stack-traces --no-sandbox --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1779725768335900 --gpu-channel-request-start-time-ticks=1673486756742 --launch-time-ticks=1673486760073 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,8688253329979396427,15487891221961876405,2097152 --field-trial-handle=3,i,9147610127075777921,12768784628239679401,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,3363824414886824757,15146526931449754261,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=stderr --v=0` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==1900==END OF ADDITIONAL INFO ==1900==ABORTING [1791:1806:0614/010749.000479:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR