[13223:13238:0411/144907.274099:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig Gtk-Message: 14:49:07.488: Failed to load module "canberra-gtk-module" Gtk-Message: 14:49:07.491: Failed to load module "canberra-gtk-module" [13223:13238:0411/144907.553381:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [13223:13238:0411/144907.553633:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [13223:13238:0411/144907.553825:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [13223:13238:0411/144907.603082:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [13223:13223:0411/144907.613874:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [13223:13223:0411/144907.614470:WARNING:components/os_crypt/sync/key_storage_linux.cc:166] OSCrypt tried Libsecret but couldn't initialise. [13254:13254:0411/144907.667260:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [13223:13223:0411/144907.779427:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured. [13223:13238:0411/144907.808577:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [13223:13238:0411/144907.927486:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [13223:13223:0411/144907.950642:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [13223:13223:0411/144907.950980:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [13223:13238:0411/144907.951198:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [13223:13223:0411/144907.952214:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [13223:13223:0411/144907.985617:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [13223:13223:0411/144908.005283:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [13223:13238:0411/144908.006483:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory (chrome:13223): dbind-WARNING **: 14:49:08.027: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/229127/at-spi/bus_20: No such file or directory [13223:13238:0411/144908.113110:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [13223:13238:0411/144908.113397:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [13223:13223:0411/144908.620084:ERROR:chrome/browser/data_sharing/data_sharing_navigation_throttle.cc:94] [POC] DataSharingNavigationThrottle url=https://www.google.com/chrome/tabshare/?g=POCGROUP&t=POCTOKEN [13223:13223:0411/144908.620221:ERROR:chrome/browser/data_sharing/data_sharing_navigation_throttle.cc:141] [POC] tab-share URL intercepted -- 1st SDK call (creates hidden WebContents @ chrome-untrusted://data-sharing) [13223:13223:0411/144908.660565:ERROR:chrome/browser/data_sharing/data_sharing_navigation_throttle.cc:94] [POC] DataSharingNavigationThrottle url=chrome-untrusted://data-sharing/data_sharing_api.html [13223:13238:0411/144908.861723:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [13223:13223:0411/144908.861872:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [13223:13238:0411/144908.861987:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [13223:13223:0411/144908.877145:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [13223:13238:0411/144908.877517:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [13223:13223:0411/144908.959008:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [13223:13223:0411/144908.959151:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [13223:13223:0411/144908.959193:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [13223:13223:0411/144908.984720:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [13223:13238:0411/144908.985280:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [13223:13235:0411/144909.040687:ERROR:crypto/nss_util.cc:79] Failed to create /usr/local/google/home/vmiura/.local/share/pki/nssdb directory. [13223:13223:0411/144909.054240:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [13223:13238:0411/144909.054620:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [13301:13301:0411/144909.066177:ERROR:content/renderer/render_frame_impl.cc:5567] [POC renderer] bypassing should_fork: chrome-untrusted://data-sharing/data_sharing_api.html -> chrome-untrusted://read-anything-side-panel.top-chrome/images/empty_state.svg (sending BeginNavigation IPC directly) [13223:13223:0411/144909.136717:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [13223:13223:0411/144909.136855:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. [13223:13223:0411/144909.200960:ERROR:chrome/browser/data_sharing/data_sharing_navigation_throttle.cc:94] [POC] DataSharingNavigationThrottle url=chrome-untrusted://read-anything-side-panel.top-chrome/images/empty_state.svg [13223:13238:0411/144909.641878:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR [13223:13238:0411/144909.643242:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR [13223:13238:0411/144909.644695:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR [13223:13223:0411/144913.670222:ERROR:chrome/browser/data_sharing/data_sharing_navigation_throttle.cc:156] [POC] 2nd SDK call -- triggers static_cast on the swapped WebUIController ================================================================= ==13223==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c3594c88c08 at pc 0x55dc0322adb0 bp 0x7ffeab671e30 sp 0x7ffeab671e28 READ of size 8 at 0x7c3594c88c08 thread T0 (chrome) #0 0x55dc0322adaf in data_sharing::DataSharingSDKDelegateDesktop::MaybeLoadWebContents(base::OnceCallback) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:559:29 #1 0x55dc0322a0a6 in data_sharing::DataSharingSDKDelegateDesktop::ReadGroups(data_sharing_pb::ReadGroupsParams const&, base::OnceCallback const&)>) chrome/browser/data_sharing/desktop/data_sharing_sdk_delegate_desktop.cc:41:3 #2 0x55dc202e76db in data_sharing::DataSharingServiceImpl::ReadGroupDeprecated(base::StrongAlias, std::__Cr::allocator>> const&, base::OnceCallback const&)>) components/data_sharing/internal/data_sharing_service_impl.cc:244:18 #3 0x55dc03225d06 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) chrome/browser/data_sharing/data_sharing_navigation_throttle.cc:159:22 #4 0x55dc062952b6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #5 0x55dc0630c959 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #6 0x55dc0630b7ca in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #7 0x55dc064ba378 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #8 0x55dc064bd938 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 #9 0x7f8597ef3718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d) 0x7c3594c88c08 is located 0 bytes after 104-byte region [0x7c3594c88ba0,0x7c3594c88c08) allocated by thread T0 (chrome) here: #0 0x55dbee2de3fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e083fd) (BuildId: bd4756922ff2f4e9) #1 0x55dc1ecc9ed9 in DefaultTopChromeWebUIConfig::CreateWebUIController(content::WebUI*, GURL const&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x55dbf37e6392 in content::(anonymous namespace)::WebUIConfigMapWebUIControllerFactory::CreateWebUIControllerForURL(content::WebUI*, GURL const&) content/public/browser/webui_config_map.cc:47:29 #3 0x55dbfbe3ae56 in content::WebUIControllerFactoryRegistry::CreateWebUIControllerForURL(content::WebUI*, GURL const&) content/browser/webui/web_ui_controller_factory_registry.cc:43:32 #4 0x55dbfb20d146 in content::NavigationRequest::CreateWebUIIfNeeded(content::RenderFrameHostImpl*) content/browser/renderer_host/navigation_request.cc:11744:13 #5 0x55dbfb3fcedf in content::RenderFrameHostManager::CreateWebUIForNavigationIfNeeded(content::NavigationRequest*, content::SiteInstanceImpl*, bool) content/browser/renderer_host/render_frame_host_manager.cc #6 0x55dbfb3f7ca3 in content::RenderFrameHostManager::GetFrameHostForNavigation(content::NavigationRequest*, content::BrowsingContextGroupSwap*, content::ProcessAllocationContext const&, std::__Cr::basic_string, std::__Cr::allocator>*) content/browser/renderer_host/render_frame_host_manager.cc:1964:3 #7 0x55dbfb3f5fea in content::RenderFrameHostManager::DidCreateNavigationRequest(content::NavigationRequest*) content/browser/renderer_host/render_frame_host_manager.cc:1642:21 #8 0x55dbfaf5a46b in content::FrameTreeNode::TakeNavigationRequest(std::__Cr::unique_ptr>) content/browser/renderer_host/frame_tree_node.cc:628:21 #9 0x55dbfb25925d in content::Navigator::OnBeginNavigation(content::FrameTreeNode*, mojo::StructPtr, mojo::StructPtr, scoped_refptr, mojo::PendingAssociatedRemote, scoped_refptr, int, mojo::PendingReceiver, mojo::PendingReceiver) content/browser/renderer_host/navigator.cc:1365:20 #10 0x55dbfb316be2 in content::RenderFrameHostImpl::BeginNavigation(mojo::StructPtr, mojo::StructPtr, mojo::PendingRemote, mojo::PendingAssociatedRemote, mojo::PendingRemote, mojo::PendingReceiver, mojo::PendingReceiver) content/browser/renderer_host/render_frame_host_impl.cc:11631:33 #11 0x55dbf3de3dcf in content::mojom::FrameHostStubDispatch::Accept(content::mojom::FrameHost*, mojo::Message*) gen/content/common/frame.mojom.cc:5847:13 #12 0x55dc06054ff9 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54 #13 0x55dc06072d83 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24 #14 0x55dc0605b4a3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #15 0x55dc09f7b75d in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24 #16 0x55dc09f7dbe5 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #17 0x55dc062952b6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #18 0x55dc0630c959 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #19 0x55dc0630b7ca in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #20 0x55dc064bacb4 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48 #21 0x55dc0630e067 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #22 0x55dc0620fc30 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #23 0x55dbf9d1088c in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1105:18 #24 0x55dbf9d18f3c in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15 #25 0x55dbf9d075bc in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28 #26 0x55dc01dad2df in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:696:10 #27 0x55dc01db12c8 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1320:10 #28 0x55dc01db075a in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1150:12 #29 0x55dc01daa101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 SUMMARY: AddressSanitizer: heap-buffer-overflow base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:559:29 in data_sharing::DataSharingSDKDelegateDesktop::MaybeLoadWebContents(base::OnceCallback) Shadow bytes around the buggy address: 0x7c3594c88980: f7 fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c3594c88a00: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd 0x7c3594c88a80: fd fd fd fd fd fd fa fa fa fa fa fa f7 fa fd fd 0x7c3594c88b00: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa 0x7c3594c88b80: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 00 =>0x7c3594c88c00: 00[fa]fa fa fa fa fa fa f7 fa fd fd fd fd fd fd 0x7c3594c88c80: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa 0x7c3594c88d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa 0x7c3594c88d80: fa fa fa fa f7 fa fd fd fd fd fd fd fd fd fd fd 0x7c3594c88e00: fd fd fd fd fa fa fa fa fa fa f7 fa fd fd fd fd 0x7c3594c88e80: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==13223==ADDITIONAL INFO ==13223==Note: Please include this section with the ASan report. Task trace: #0 0x55dc0322509b in data_sharing::DataSharingNavigationThrottle::CheckIfShouldIntercept() chrome/browser/data_sharing/data_sharing_navigation_throttle.cc:153:11 Command line: `out/asan/chrome --no-sandbox --no-first-run --no-default-browser-check --disable-gpu --user-data-dir=/tmp/chrome-poc-profile --enable-features=DataSharing --enable-logging=stderr --flag-switches-begin --flag-switches-end --ozone-platform=x11 https://www.google.com/chrome/tabshare/?g=POCGROUP&t=POCTOKEN` ==13223==END OF ADDITIONAL INFO ==13223==ABORTING [13257:13287:0411/144916.324180:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_. [13257:13287:0411/144916.324428:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.