Note: Google Test filter = DropHelperTest.OnDragExitedDeletesNewTarget [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from DropHelperTest [ RUN ] DropHelperTest.OnDragExitedDeletesNewTarget (views_unittests:2205): dbind-WARNING **: 06:32:04.327: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory ================================================================= ==2205==ERROR: AddressSanitizer: heap-use-after-free on address 0x706fadfeea00 at pc 0x5983f02aeb7a bp 0x7ffc7b377ef0 sp 0x7ffc7b377ee8 READ of size 8 at 0x706fadfeea00 thread T0 #0 0x5983f02aeb79 in views::View::ConvertPointToTarget(views::View const*, views::View const*, gfx::Point*) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1018:47 #1 0x5983f02eecf0 in views::DropHelper::NotifyDragEntered(ui::OSExchangeData const&, gfx::Point const&, int) ui/views/widget/drop_helper.cc:214:3 #2 0x5983f02ee314 in views::DropHelper::OnDragOver(ui::OSExchangeData const&, gfx::Point const&, int) ui/views/widget/drop_helper.cc:69:5 #3 0x5983e0b9f8cc in views::(anonymous namespace)::DropHelperTest_OnDragExitedDeletesNewTarget_Test::TestBody() ui/views/widget/drop_helper_unittest.cc:219:16 #4 0x5983e14dafcb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #5 0x5983e14ddc27 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #6 0x5983e14dfd23 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #7 0x5983e150f16a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #8 0x5983e150dc3e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #9 0x5983f083e71c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #10 0x5983e129eb61 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #11 0x5983f08460db in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #12 0x5983f08459fb in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #13 0x5983e129e28d in views::ViewsTestSuite::RunTests() ui/views/views_test_suite.cc:39:10 #14 0x5983e09a1904 in main ui/views/run_all_unittests_main.cc:10:44 #15 0x72efaf645249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x706fadfeea00 is located 384 bytes inside of 784-byte region [0x706fadfee880,0x706fadfeeb90) freed by thread T0 here: #0 0x5983dfa83a91 in operator delete(void*) (/chromium/chromium/src/out/asan/views_unittests+0x8ab7a91) (BuildId: 311202fcaf759822) #1 0x5983e0ba06e3 in views::(anonymous namespace)::DragExitDeletesSibling::OnDragExited() third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x5983f02ee27b in views::DropHelper::OnDragOver(ui::OSExchangeData const&, gfx::Point const&, int) ui/views/widget/drop_helper.cc:238:19 #3 0x5983e0b9f8cc in views::(anonymous namespace)::DropHelperTest_OnDragExitedDeletesNewTarget_Test::TestBody() ui/views/widget/drop_helper_unittest.cc:219:16 #4 0x5983e14dafcb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #5 0x5983e14ddc27 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #6 0x5983e14dfd23 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #7 0x5983e150f16a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #8 0x5983e150dc3e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #9 0x5983f083e71c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #10 0x5983e129eb61 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #11 0x5983f08460db in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #12 0x5983f08459fb in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #13 0x5983e129e28d in views::ViewsTestSuite::RunTests() ui/views/views_test_suite.cc:39:10 #14 0x5983e09a1904 in main ui/views/run_all_unittests_main.cc:10:44 #15 0x72efaf645249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x5983dfa83251 in operator new(unsigned long) (/chromium/chromium/src/out/asan/views_unittests+0x8ab7251) (BuildId: 311202fcaf759822) #1 0x5983e0b9f58b in views::(anonymous namespace)::DropHelperTest_OnDragExitedDeletesNewTarget_Test::TestBody() ui/views/view.h:304:3 #2 0x5983e14dafcb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x5983e14ddc27 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x5983e14dfd23 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x5983e150f16a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x5983e150dc3e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x5983f083e71c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x5983e129eb61 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #9 0x5983f08460db in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #10 0x5983f08459fb in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #11 0x5983e129e28d in views::ViewsTestSuite::RunTests() ui/views/views_test_suite.cc:39:10 #12 0x5983e09a1904 in main ui/views/run_all_unittests_main.cc:10:44 #13 0x72efaf645249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1018:47 in views::View::ConvertPointToTarget(views::View const*, views::View const*, gfx::Point*) Shadow bytes around the buggy address: 0x706fadfee780: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x706fadfee800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x706fadfee880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x706fadfee900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x706fadfee980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x706fadfeea00:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x706fadfeea80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x706fadfeeb00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x706fadfeeb80: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x706fadfeec00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x706fadfeec80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2205==ADDITIONAL INFO ==2205==Note: Please include this section with the ASan report. Task trace: ==2205==END OF ADDITIONAL INFO ==2205==ABORTING