Fontconfig error: No writable cache directories
	/var/cache/fontconfig
	/usr/local/google/home/vmiura/.cache/fontconfig
	/usr/local/google/home/vmiura/.fontconfig

Fontconfig error: No writable cache directories
	/var/cache/fontconfig
	/usr/local/google/home/vmiura/.cache/fontconfig
	/usr/local/google/home/vmiura/.fontconfig

Fontconfig error: No writable cache directories
	/var/cache/fontconfig
	/usr/local/google/home/vmiura/.cache/fontconfig
	/usr/local/google/home/vmiura/.fontconfig

Fontconfig error: No writable cache directories
	/var/cache/fontconfig
	/usr/local/google/home/vmiura/.cache/fontconfig
	/usr/local/google/home/vmiura/.fontconfig
Gtk-Message: 18:03:35.943: Failed to load module "canberra-gtk-module"
Gtk-Message: 18:03:35.945: Failed to load module "canberra-gtk-module"
[6131:6146:0424/180335.998171:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[6131:6146:0424/180335.998664:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory
[6131:6146:0424/180335.998907:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[6131:6146:0424/180335.999146:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[6131:6146:0424/180336.040940:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory
[6131:6131:0424/180336.047453:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory
[6131:6131:0424/180336.048157:WARNING:components/os_crypt/sync/key_storage_linux.cc:166] OSCrypt tried Libsecret but couldn't initialise.
[6131:6131:0424/180336.201696:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured.
[6131:6146:0424/180336.220784:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory
[6131:6146:0424/180336.323995:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory
[6131:6131:0424/180336.342959:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[6131:6131:0424/180336.343236:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable.
[6131:6146:0424/180336.343440:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory
[6131:6131:0424/180336.343996:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[6131:6131:0424/180336.369203:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[6131:6131:0424/180336.385382:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[6131:6146:0424/180336.386072:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory

(chrome:6131): dbind-WARNING **: 18:03:36.398: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/229127/at-spi/bus_20: No such file or directory
[6131:6146:0424/180336.498222:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory
[6131:6146:0424/180336.498533:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory
[6162:6162:0424/180336.519726:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process.
[6162:6162:0424/180336.541812:WARNING:ui/gfx/linux/gbm_support_x11.cc:48] dri3 extension not supported.
[6131:6146:0424/180337.053024:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[6131:6146:0424/180337.053362:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[6131:6131:0424/180337.053714:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[6131:6131:0424/180337.068863:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[6131:6146:0424/180337.069381:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory
[6131:6131:0424/180337.146302:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal.
[6131:6131:0424/180337.146549:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: 
[6131:6131:0424/180337.146627:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device
[6131:6131:0424/180337.165267:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[6131:6146:0424/180337.165716:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory
[6131:6143:0424/180337.242430:ERROR:crypto/nss_util.cc:79] Failed to create /usr/local/google/home/vmiura/.local/share/pki/nssdb directory.
[6277:6294:0424/180337.249963:ERROR:gpu/ipc/client/command_buffer_proxy_impl.cc:285] ContextResult::kTransientFailure: Failed to send GpuControl.CreateCommandBuffer.
[6131:6131:0424/180337.259662:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[6131:6146:0424/180337.260383:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory
[6131:6131:0424/180337.309115:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[6131:6131:0424/180337.309300:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used.
[6131:6131:0424/180337.997310:INFO:CONSOLE:6] "Blocked autofocusing on a <textarea> element in a cross-origin subframe.", source: http://b.test:8000/child.html (6)
[6131:6131:0424/180338.029131:INFO:CONSOLE:12] "[parent] message: ready", source: http://a.test:8000/parent.html (12)
[6131:6131:0424/180338.595151:INFO:CONSOLE:12] "[child] composition event fired: compositionstart", source: http://b.test:8000/child.html (12)
[6131:6131:0424/180338.595504:INFO:CONSOLE:23] "[child] entering window.print()", source: http://b.test:8000/child.html (23)

Fontconfig error: No writable cache directories
	/var/cache/fontconfig
	/usr/local/google/home/vmiura/.cache/fontconfig
	/usr/local/google/home/vmiura/.fontconfig

Fontconfig error: No writable cache directories
	/var/cache/fontconfig
	/usr/local/google/home/vmiura/.cache/fontconfig
	/usr/local/google/home/vmiura/.fontconfig

Fontconfig error: No writable cache directories
	/var/cache/fontconfig
	/usr/local/google/home/vmiura/.cache/fontconfig
	/usr/local/google/home/vmiura/.fontconfig

Fontconfig error: No writable cache directories
	/var/cache/fontconfig
	/usr/local/google/home/vmiura/.cache/fontconfig
	/usr/local/google/home/vmiura/.fontconfig
Gtk-Message: 18:03:39.193: Failed to load module "canberra-gtk-module"
Gtk-Message: 18:03:39.196: Failed to load module "canberra-gtk-module"
[6131:6131:0424/180340.779071:INFO:CONSOLE:30] "[parent] timer-based remove", source: http://a.test:8000/parent.html (30)
[6131:6146:0424/180344.297869:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
[6131:6146:0424/180413.315210:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT

=== /poc-artifacts/asan-report.6276 ===
=================================================================
==6276==ERROR: AddressSanitizer: heap-use-after-free on address 0x7caee201ad58 at pc 0x5578d2faee44 bp 0x7ffc48b1e7f0 sp 0x7ffc48b1e7e8
READ of size 8 at 0x7caee201ad58 thread T0 (chrome)
    #0 0x5578d2faee43 in blink::WidgetBase::ImeSetComposition(blink::String const&, blink::Vector<ui::ImeTextSpan, 0u, blink::PartitionAllocator> const&, gfx::Range const&, int, int, blink::mojom::ImeState) base/memory/scoped_refptr.h:293:12
    #1 0x5578d2f7e5b1 in blink::ImeSetCompositionOnMainThread(base::WeakPtr<blink::WidgetBase>, scoped_refptr<base::SingleThreadTaskRunner>, blink::String const&, blink::Vector<ui::ImeTextSpan, 0u, blink::PartitionAllocator> const&, gfx::Range const&, int, int, blink::mojom::ImeState, base::OnceCallback<void ()>) third_party/blink/renderer/platform/widget/input/widget_input_handler_impl.cc:118:11
    #2 0x5578d2f82b8a in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::WeakPtr<blink::WidgetBase>, scoped_refptr<base::SingleThreadTaskRunner>, blink::String const&, blink::Vector<ui::ImeTextSpan, 0u, blink::PartitionAllocator> const&, gfx::Range const&, int, int, blink::mojom::ImeState, base::OnceCallback<void ()>), base::WeakPtr<blink::WidgetBase>&&, scoped_refptr<base::SingleThreadTaskRunner>&&, blink::String&&, blink::Vector<ui::ImeTextSpan, 0u, blink::PartitionAllocator>&&, gfx::Range&&, int&&, int&&, blink::mojom::ImeState&&, base::OnceCallback<void ()>&&>, base::internal::BindState<false, true, false, void (*)(base::WeakPtr<blink::WidgetBase>, scoped_refptr<base::SingleThreadTaskRunner>, blink::String const&, blink::Vector<ui::ImeTextSpan, 0u, blink::PartitionAllocator> const&, gfx::Range const&, int, int, blink::mojom::ImeState, base::OnceCallback<void ()>), base::WeakPtr<blink::WidgetBase>, scoped_refptr<base::SingleThreadTaskRunner>, blink::String, blink::Vector<ui::ImeTextSpan, 0u, blink::PartitionAllocator>, gfx::Range, int, int, blink::mojom::ImeState, base::OnceCallback<void ()>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #3 0x5578d2f80f2b in blink::(anonymous namespace)::RunClosureIfNotSwappedOut(base::WeakPtr<blink::WidgetBase>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #4 0x5578d2f859d8 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::WeakPtr<blink::WidgetBase>, base::OnceCallback<void ()>), base::WeakPtr<blink::WidgetBase>&&, base::OnceCallback<void ()>&&>, base::internal::BindState<false, true, false, void (*)(base::WeakPtr<blink::WidgetBase>, base::OnceCallback<void ()>), base::WeakPtr<blink::WidgetBase>, base::OnceCallback<void ()>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #5 0x5578d2ef5eeb in blink::(anonymous namespace)::QueuedClosure::Dispatch(blink::MainThreadEventQueue*) base/functional/callback.h:155:12
    #6 0x5578d2eea095 in blink::MainThreadEventQueue::DispatchEvents() third_party/blink/renderer/platform/widget/input/main_thread_event_queue.cc:638:11
    #7 0x5578d2ef6be0 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::MainThreadEventQueue::*&&)(), blink::MainThreadEventQueue*&&>, base::internal::BindState<true, true, false, void (blink::MainThreadEventQueue::*)(), scoped_refptr<blink::MainThreadEventQueue>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #8 0x5578c23bb326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #9 0x5578c24329c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #10 0x5578c243183a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #11 0x5578c2279927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #12 0x5578c24340d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #13 0x5578c2335ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #14 0x5578ce6bf1fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #15 0x5578bded36ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #16 0x5578bded4a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #17 0x5578bded7728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #18 0x5578bded1101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #19 0x5578bded16fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #20 0x5578aa406b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #21 0x7f1ee3e2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7caee201ad58 is located 216 bytes inside of 1008-byte region [0x7caee201ac80,0x7caee201b070)
freed by thread T0 (chrome) here:
    #0 0x5578aa406002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e09002) (BuildId: 0440b075dbd4a9a3)
    #1 0x5578cff27996 in blink::WebFrameWidgetImpl::Close(blink::DetachReason) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5578cffcf66f in blink::WebLocalFrameImpl::Close(blink::DetachReason) third_party/blink/renderer/core/frame/web_local_frame_impl.cc:798:20
    #3 0x5578ce509656 in content::RenderFrameImpl::FrameDetached(blink::DetachReason) content/renderer/render_frame_impl.cc:3780:11
    #4 0x5578d001b7b9 in blink::LocalFrameClientImpl::Detached(blink::FrameDetachType) third_party/blink/renderer/core/frame/local_frame_client_impl.cc:381:11
    #5 0x5578cfc35e07 in blink::Frame::Detach(blink::FrameDetachType) third_party/blink/renderer/core/frame/frame.cc:172:12
    #6 0x5578ce4e667f in content::RenderFrameImpl::Delete(content::mojom::FrameDeleteIntention) content/renderer/render_frame_impl.cc:2231:11
    #7 0x5578afeffc31 in content::mojom::FrameStubDispatch::Accept(content::mojom::Frame*, mojo::Message*) gen/content/common/frame.mojom.cc:3065:13
    #8 0x5578c217b069 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #9 0x5578c2198ef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #10 0x5578c2181513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #11 0x5578c60a17dd in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #12 0x5578c60a3c65 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #13 0x5578c23bb326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #14 0x5578c24329c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #15 0x5578c243183a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #16 0x5578c2279927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #17 0x5578c2434158 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:641:12
    #18 0x5578c2335ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #19 0x5578dc9788f3 in printing::PrintRenderFrameHelper::RequestPrintPreview(printing::PrintRenderFrameHelper::PrintPreviewRequestType, bool) components/printing/renderer/print_render_frame_helper.cc:2709:12
    #20 0x5578dc977668 in printing::PrintRenderFrameHelper::ScriptedPrint(bool) components/printing/renderer/print_render_frame_helper.cc:1248:5
    #21 0x5578ce4e3138 in content::RenderFrameImpl::ScriptedPrint() content/renderer/render_frame_impl.cc:2059:14
    #22 0x5578d18aadb4 in blink::ChromeClientImpl::PrintDelegate(blink::LocalFrame*) third_party/blink/renderer/core/page/chrome_client_impl.cc:770:24
    #23 0x5578d18a4550 in blink::ChromeClient::Print(blink::LocalFrame*) third_party/blink/renderer/core/page/chrome_client.cc:282:3
    #24 0x5578d48007ff in blink::(anonymous namespace)::v8_window::PrintOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_window.cc:16386:17
    #25 0x5578b53166e3 in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc
    #26 0x5578b5314902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc
    #27 0x5578b531169b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc
    #28 0x5578b53113ea in Builtins_JSEntry setup-isolate-deserialize.cc
    #29 0x5578b05677ad in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12

previously allocated by thread T0 (chrome) here:
    #0 0x5578aa4053fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e083fd) (BuildId: 0440b075dbd4a9a3)
    #1 0x5578cff25a0b in std::__Cr::unique_ptr<blink::WidgetBase, std::__Cr::default_delete<blink::WidgetBase>> std::__Cr::make_unique<blink::WidgetBase, blink::WebFrameWidgetImpl*, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>, scoped_refptr<base::SingleThreadTaskRunner>&, bool&, bool&, bool, bool&, 0>(blink::WebFrameWidgetImpl*&&, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>&&, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>&&, scoped_refptr<base::SingleThreadTaskRunner>&, bool&, bool&, bool&&, bool&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x5578cff24463 in blink::WebFrameWidgetImpl::WebFrameWidgetImpl(base::PassKey<blink::WebLocalFrame>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::FrameWidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::FrameWidgetInterfaceBase>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>, scoped_refptr<base::SingleThreadTaskRunner>, viz::FrameSinkId const&, bool, bool, bool, bool, bool) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:388:20
    #3 0x5578d0000788 in blink::WebFrameWidgetImpl* cppgc::MakeGarbageCollectedTrait<blink::WebFrameWidgetImpl>::Call<base::PassKey<blink::WebLocalFrame>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::FrameWidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::FrameWidgetInterfaceBase>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>, scoped_refptr<base::SingleThreadTaskRunner>, viz::FrameSinkId const&, bool&, bool&, bool&, bool&, bool&>(cppgc::AllocationHandle&, base::PassKey<blink::WebLocalFrame>&&, blink::CrossVariantMojoAssociatedRemote<blink::mojom::FrameWidgetHostInterfaceBase>&&, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::FrameWidgetInterfaceBase>&&, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>&&, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>&&, scoped_refptr<base::SingleThreadTaskRunner>&&, viz::FrameSinkId const&, bool&, bool&, bool&, bool&, bool&) v8/include/cppgc/allocation.h:239:32
    #4 0x5578cffef7df in blink::WebLocalFrameImpl::CreateFrameWidgetInternal(base::PassKey<blink::WebLocalFrame>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::FrameWidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::FrameWidgetInterfaceBase>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>, viz::FrameSinkId const&, bool, bool, bool) v8/include/cppgc/allocation.h:277:7
    #5 0x5578cffce6df in blink::WebLocalFrame::InitializeFrameWidget(blink::CrossVariantMojoAssociatedRemote<blink::mojom::FrameWidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::FrameWidgetInterfaceBase>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>, viz::FrameSinkId const&, bool, bool, bool) third_party/blink/renderer/core/frame/web_local_frame_impl.cc:696:3
    #6 0x5578ce4da558 in content::(anonymous namespace)::InitializeFrameWidgetForFrame(blink::WebLocalFrame&, mojo::StructPtr<content::mojom::CreateFrameWidgetParams>, bool) content/renderer/render_frame_impl.cc:1250:34
    #7 0x5578ce4d90df in content::RenderFrameImpl::CreateFrame(content::AgentSchedulingGroup&, base::TokenType<blink::LocalFrameTokenTypeMarker> const&, int, mojo::PendingAssociatedReceiver<content::mojom::Frame>, mojo::PendingRemote<blink::mojom::BrowserInterfaceBroker>, mojo::PendingAssociatedRemote<blink::mojom::AssociatedInterfaceProvider>, blink::WebView*, base::optional_ref<blink::MultiToken<base::TokenType<blink::LocalFrameTokenTypeMarker>, base::TokenType<blink::RemoteFrameTokenTypeMarker>> const, (partition_alloc::internal::RawPtrTraits)0>, base::optional_ref<blink::MultiToken<base::TokenType<blink::LocalFrameTokenTypeMarker>, base::TokenType<blink::RemoteFrameTokenTypeMarker>> const, (partition_alloc::internal::RawPtrTraits)0>, base::optional_ref<blink::MultiToken<base::TokenType<blink::LocalFrameTokenTypeMarker>, base::TokenType<blink::RemoteFrameTokenTypeMarker>> const, (partition_alloc::internal::RawPtrTraits)0>, base::optional_ref<blink::MultiToken<base::TokenType<blink::LocalFrameTokenTypeMarker>, base::TokenType<blink::RemoteFrameTokenTypeMarker>> const, (partition_alloc::internal::RawPtrTraits)0>, base::UnguessableToken const&, std::__Cr::optional<base::UnguessableToken> const&, blink::mojom::TreeScopeType, mojo::StructPtr<blink::mojom::FrameReplicationState>, mojo::StructPtr<content::mojom::CreateFrameWidgetParams>, mojo::StructPtr<blink::mojom::FrameOwnerProperties>, bool, base::TokenType<blink::DocumentTokenTypeMarker> const&, mojo::StructPtr<blink::mojom::PolicyContainer>, bool) content/renderer/render_frame_impl.cc:1861:5
    #8 0x5578ce5c9a59 in content::AgentSchedulingGroup::CreateFrame(mojo::StructPtr<content::mojom::CreateFrameParams>) content/renderer/agent_scheduling_group.cc:383:3
    #9 0x5578afedf17e in content::mojom::AgentSchedulingGroupStubDispatch::Accept(content::mojom::AgentSchedulingGroup*, mojo::Message*) gen/content/common/agent_scheduling_group.mojom.cc:699:13
    #10 0x5578c217b069 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #11 0x5578c2198ef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #12 0x5578c2181513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #13 0x5578c60a17dd in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #14 0x5578c60a3c65 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #15 0x5578c23bb326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #16 0x5578c24329c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #17 0x5578c243183a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #18 0x5578c2279927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #19 0x5578c24340d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #20 0x5578c2335ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #21 0x5578ce6bf1fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #22 0x5578bded36ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #23 0x5578bded4a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #24 0x5578bded7728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #25 0x5578bded1101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #26 0x5578bded16fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #27 0x5578aa406b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #28 0x7f1ee3e2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free base/memory/scoped_refptr.h:293:12 in blink::WidgetBase::ImeSetComposition(blink::String const&, blink::Vector<ui::ImeTextSpan, 0u, blink::PartitionAllocator> const&, gfx::Range const&, int, int, blink::mojom::ImeState)
Shadow bytes around the buggy address:
  0x7caee201aa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7caee201ab00: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7caee201ab80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7caee201ac00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x7caee201ac80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7caee201ad00: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
  0x7caee201ad80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7caee201ae00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7caee201ae80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7caee201af00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7caee201af80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==6276==ADDITIONAL INFO

==6276==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5578d2ee8f8c in blink::MainThreadEventQueue::PostTaskToMainThread() third_party/blink/renderer/platform/widget/input/main_thread_event_queue.cc:763:7


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=6133 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-widgetbase-uaf --change-stack-guard-on-fork=enable --no-sandbox --disable-dev-shm-usage --remote-debugging-pipe --ozone-platform=x11 --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1777021730561480 --launch-time-ticks=32086277917 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,5758695687468885464,12553039889861149404,2097152 --field-trial-handle=3,i,18332584853912391724,18299539689017336465,262144 --disable-features=ChromeWhatsNewUI,DialMediaRouteProvider --variations-seed-version --pseudonymization-salt-handle=7,i,10420626325497136125,10373993162330608266,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=stderr`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==6276==END OF ADDITIONAL INFO

==6276==ABORTING