[.] Sanitizer coverage enabled. Counter map size: 12114851, Cmp map size: 262144 IMPORTANT DEBUGGING NOTE: batches of tests are run inside their own process. For debugging a test inside a debugger, use the --gtest_filter= flag along with --single-process-tests. Using sharding settings from environment. This is shard 0/1 Using 1 parallel jobs. [.] Sanitizer coverage enabled. Counter map size: 12114851, Cmp map size: 262144 Note: Google Test filter = VirtualCardEnrollmentManagerUAFTest.OnDidGetUpdateVirtualCardEnrollmentResponse_UseAfterFree [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from VirtualCardEnrollmentManagerUAFTest [ RUN ] VirtualCardEnrollmentManagerUAFTest.OnDidGetUpdateVirtualCardEnrollmentResponse_UseAfterFree ================================================================= ==881==ERROR: AddressSanitizer: heap-use-after-free on address 0x759a0325d3b0 at pc 0x599da8937ead bp 0x7ffdc8f73c10 sp 0x7ffdc8f73c08 READ of size 4 at 0x759a0325d3b0 thread T0 #0 0x599da8937eac in autofill::VirtualCardEnrollmentManager::OnDidGetUpdateVirtualCardEnrollmentResponse(autofill::VirtualCardEnrollmentRequestType, autofill::payments::PaymentsAutofillClient::PaymentsRpcResult) components/autofill/core/browser/payments/virtual_card_enrollment_manager.cc:347:45 #1 0x599da8939fc1 in base::internal::Invoker&&, autofill::VirtualCardEnrollmentRequestType&&>, base::internal::BindState, autofill::VirtualCardEnrollmentRequestType>, void (autofill::payments::PaymentsAutofillClient::PaymentsRpcResult)>::RunOnce(base::internal::BindStateBase*, autofill::payments::PaymentsAutofillClient::PaymentsRpcResult) base/functional/bind_internal.h:740:12 #2 0x599d758b08c7 in autofill::VirtualCardEnrollmentManagerUAFTest_OnDidGetUpdateVirtualCardEnrollmentResponse_UseAfterFree_Test::TestBody() base/functional/callback.h:155:12 #3 0x599d91a9b79b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #4 0x599d91a9e817 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #5 0x599d91aa0893 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #6 0x599d91acfa14 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #7 0x599d91ace58a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x599da724d1e0 in base::TestSuite::Run() base/test/test_suite.cc:440:16 #9 0x599db41c8c15 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #10 0x599d999a1680 in base::internal::Invoker>&&>, base::internal::BindState>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #11 0x599da726603b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #12 0x599da726595b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #13 0x780a05225249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x759a0325d3b0 is located 816 bytes inside of 992-byte region [0x759a0325d080,0x759a0325d460) freed by thread T0 here: #0 0x599d721c0012 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/components_unittests+0x171c7012) (BuildId: 2795ce57862b1edd) #1 0x599d758c3c25 in base::internal::Invoker>*&&, std::__Cr::unique_ptr>*&&>, base::internal::BindState>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (autofill::payments::PaymentsAutofillClient::PaymentsRpcResult)>::RunOnce(base::internal::BindStateBase*, autofill::payments::PaymentsAutofillClient::PaymentsRpcResult) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x599da8937dbc in autofill::VirtualCardEnrollmentManager::OnDidGetUpdateVirtualCardEnrollmentResponse(autofill::VirtualCardEnrollmentRequestType, autofill::payments::PaymentsAutofillClient::PaymentsRpcResult) base/functional/callback.h:155:12 #3 0x599da8939fc1 in base::internal::Invoker&&, autofill::VirtualCardEnrollmentRequestType&&>, base::internal::BindState, autofill::VirtualCardEnrollmentRequestType>, void (autofill::payments::PaymentsAutofillClient::PaymentsRpcResult)>::RunOnce(base::internal::BindStateBase*, autofill::payments::PaymentsAutofillClient::PaymentsRpcResult) base/functional/bind_internal.h:740:12 #4 0x599d758b08c7 in autofill::VirtualCardEnrollmentManagerUAFTest_OnDidGetUpdateVirtualCardEnrollmentResponse_UseAfterFree_Test::TestBody() base/functional/callback.h:155:12 #5 0x599d91a9b79b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #6 0x599d91a9e817 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #7 0x599d91aa0893 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #8 0x599d91acfa14 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #9 0x599d91ace58a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #10 0x599da724d1e0 in base::TestSuite::Run() base/test/test_suite.cc:440:16 #11 0x599db41c8c15 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #12 0x599d999a1680 in base::internal::Invoker>&&>, base::internal::BindState>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #13 0x599da726603b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #14 0x599da726595b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #15 0x780a05225249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x599d721bf40d in operator new(unsigned long) (/chromium/chromium/src/out/asan/components_unittests+0x171c640d) (BuildId: 2795ce57862b1edd) #1 0x599d758b0336 in autofill::VirtualCardEnrollmentManagerUAFTest_OnDidGetUpdateVirtualCardEnrollmentResponse_UseAfterFree_Test::TestBody() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x599d91a9b79b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x599d91a9e817 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x599d91aa0893 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x599d91acfa14 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x599d91ace58a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x599da724d1e0 in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x599db41c8c15 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #9 0x599d999a1680 in base::internal::Invoker>&&>, base::internal::BindState>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #10 0x599da726603b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #11 0x599da726595b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #12 0x780a05225249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) Shadow bytes around the buggy address: 0x759a0325d100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x759a0325d180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x759a0325d200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x759a0325d280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x759a0325d300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x759a0325d380: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd 0x759a0325d400: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa 0x759a0325d480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x759a0325d500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x759a0325d580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x759a0325d600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb WARNING: All log messages before absl::InitializeLog() is called are written to STDERR E0000 00:00:1779318521.635452 881 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==881==ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779318521.635556 881 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==881==Note: Please include this section with the ASan report. === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779318521.635586 881 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779318521.635608 881 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779318521.635628 881 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==881==END OF ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779318521.635652 881 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==881==ABORTING === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 [1/1] VirtualCardEnrollmentManagerUAFTest.OnDidGetUpdateVirtualCardEnrollmentResponse_UseAfterFree (CRASHED) 1 test crashed: VirtualCardEnrollmentManagerUAFTest.OnDidGetUpdateVirtualCardEnrollmentResponse_UseAfterFree (../../components/autofill/core/browser/payments/virtual_card_enrollment_manager_unittest.cc:1096) Tests took 6 seconds.