Note: Google Test filter = X11WindowOzoneTest.DispatchUiEventGrabberFreedDuringGeometryFetch
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from X11WindowOzoneTest
[ RUN      ] X11WindowOzoneTest.DispatchUiEventGrabberFreedDuringGeometryFetch
=================================================================
==1788==ERROR: AddressSanitizer: heap-use-after-free on address 0x6e29149e44c8 at pc 0x5d2d1b2cde3f bp 0x7ffe6e19c350 sp 0x7ffe6e19c348
READ of size 8 at 0x6e29149e44c8 thread T0
    #0 0x5d2d1b2cde3e in base::internal::WeakReferenceOwner::GetRef() const base/memory/scoped_refptr.h:260:62
    #1 0x5d2d1a6c3d96 in ui::X11Window::DispatchUiEvent(ui::Event*, x11::Event const&) base/memory/weak_ptr.h:382:45
    #2 0x5d2d1a6c44fe in ui::X11Window::DispatchUiEvent(ui::Event*, x11::Event const&) ui/ozone/platform/x11/x11_window.cc:1482:36
    #3 0x5d2d1a6c3a9e in ui::X11Window::DispatchEvent(ui::Event* const&) ui/ozone/platform/x11/x11_window.cc:1431:3
    #4 0x5d2d1a6c4a32 in non-virtual thunk to ui::X11Window::DispatchEvent(ui::Event* const&) ui/ozone/platform/x11/x11_window.cc
    #5 0x5d2d1e9ea5c7 in ui::PlatformEventSource::DispatchEvent(ui::Event*) ui/events/platform/platform_event_source.cc:93:29
    #6 0x5d2d1ec0ba64 in ui::X11EventSource::OnEvent(x11::Event const&) ui/events/platform/x11/x11_event_source.cc:300:5
    #7 0x5d2d1ea079aa in void base::ObserverList<x11::EventObserver, false, (base::ObserverListReentrancyPolicy)0, base::internal::UncheckedObserverAdapter<(partition_alloc::internal::RawPtrTraits)1, false>>::NotifyAllowReentrancy<void (x11::EventObserver::*)(x11::Event const&), x11::Event>(T, x11::Event const&) third_party/libc++/src/include/__type_traits/invoke.h:90:27
    #8 0x5d2d1ea05f5b in x11::Connection::DispatchEvent(x11::Event const&) ui/gfx/x/connection.cc:588:20
    #9 0x5d2d190947e0 in ui::X11WindowOzoneTest_DispatchUiEventGrabberFreedDuringGeometryFetch_Test::TestBody() ui/ozone/platform/x11/x11_window_ozone_unittest.cc:107:29
    #10 0x5d2d198ff83b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #11 0x5d2d19901a07 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #12 0x5d2d19903b03 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #13 0x5d2d1993303a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #14 0x5d2d19931b0e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #15 0x5d2d1b21fbcc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #16 0x5d2d18fe9511 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), mojo::core::test::MojoTestSuiteBase*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<mojo::core::test::MojoTestSuiteBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #17 0x5d2d1b2279b4 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #18 0x5d2d1b2272db in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #19 0x5d2d18fe8dcb in main mojo/core/test/run_all_unittests.cc:30:10
    #20 0x70c91627d249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x6e29149e44c8 is located 584 bytes inside of 600-byte region [0x6e29149e4280,0x6e29149e44d8)
freed by thread T0 here:
    #0 0x5d2d18fe8316 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/ozone_x11_unittests+0x2936316) (BuildId: dc83e37ebeb74757)
    #1 0x5d2d190ab630 in testing::internal::FunctionMocker<void (ui::PlatformWindowDelegate::BoundsChange const&)>::InvokeWith(std::__Cr::tuple<ui::PlatformWindowDelegate::BoundsChange const&>&&) third_party/libc++/src/include/__functional/function.h:502:12
    #2 0x5d2d190a14a2 in ui::MockPlatformWindowDelegate::OnBoundsChanged(ui::PlatformWindowDelegate::BoundsChange const&) third_party/googletest/src/googlemock/include/gmock/gmock-spec-builders.h:1548:12
    #3 0x5d2d1a6c8c88 in ui::X11Window::OnBoundsChanged(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) ui/ozone/platform/x11/x11_window.cc:2632:30
    #4 0x5d2d1a6d10c5 in base::internal::Invoker<base::internal::FunctorTraits<void (ui::X11Window::* const&)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), ui::X11Window*>, base::internal::BindState<true, true, false, void (ui::X11Window::*)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), base::internal::UnretainedWrapper<ui::X11Window, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(base::internal::BindStateBase*, std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) base/functional/bind_internal.h:740:12
    #5 0x5d2d1ea2a5b2 in base::RepeatingCallback<void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) const & base/functional/callback.h:346:12
    #6 0x5d2d1ea2a2f8 in x11::GeometryCache::NotifyGeometryChanged() ui/gfx/x/geometry_cache.cc:131:28
    #7 0x5d2d1ea2ba40 in base::internal::Invoker<base::internal::FunctorTraits<void (x11::GeometryCache::* const&)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), base::WeakPtr<x11::GeometryCache> const&>, base::internal::BindState<true, true, false, void (x11::GeometryCache::*)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), base::WeakPtr<x11::GeometryCache>>, void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(base::internal::BindStateBase*, std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) base/functional/bind_internal.h:740:12
    #8 0x5d2d1ea2a5b2 in base::RepeatingCallback<void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) const & base/functional/callback.h:346:12
    #9 0x5d2d1ea2a2f8 in x11::GeometryCache::NotifyGeometryChanged() ui/gfx/x/geometry_cache.cc:131:28
    #10 0x5d2d1ea2ba40 in base::internal::Invoker<base::internal::FunctorTraits<void (x11::GeometryCache::* const&)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), base::WeakPtr<x11::GeometryCache> const&>, base::internal::BindState<true, true, false, void (x11::GeometryCache::*)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), base::WeakPtr<x11::GeometryCache>>, void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(base::internal::BindStateBase*, std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) base/functional/bind_internal.h:740:12
    #11 0x5d2d1ea2a5b2 in base::RepeatingCallback<void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) const & base/functional/callback.h:346:12
    #12 0x5d2d1ea2a2f8 in x11::GeometryCache::NotifyGeometryChanged() ui/gfx/x/geometry_cache.cc:131:28
    #13 0x5d2d1ea28c03 in x11::GeometryCache::OnGetGeometryResponse(x11::Response<x11::GetGeometryReply>) ui/gfx/x/geometry_cache.cc:101:3
    #14 0x5d2d1ea2b69c in base::internal::Invoker<base::internal::FunctorTraits<void (x11::GeometryCache::*&&)(x11::Response<x11::GetGeometryReply>), base::WeakPtr<x11::GeometryCache>&&>, base::internal::BindState<true, true, false, void (x11::GeometryCache::*)(x11::Response<x11::GetGeometryReply>), base::WeakPtr<x11::GeometryCache>>, void (x11::Response<x11::GetGeometryReply>)>::RunOnce(base::internal::BindStateBase*, x11::Response<x11::GetGeometryReply>&&) base/functional/bind_internal.h:740:12
    #15 0x5d2d1ea2c8c5 in base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>::Run(x11::Response<x11::GetGeometryReply>) && base/functional/callback.h:155:12
    #16 0x5d2d1ea2d059 in x11::Future<x11::GetGeometryReply>::OnResponse(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>)::'lambda'(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>, scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>)::operator()(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>, scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>) const ui/gfx/x/future.h:142:27
    #17 0x5d2d1ea2cd62 in base::internal::Invoker<base::internal::FunctorTraits<x11::Future<x11::GetGeometryReply>::OnResponse(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>)::'lambda'(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>, scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>)&&, base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>&&>, base::internal::BindState<false, false, false, x11::Future<x11::GetGeometryReply>::OnResponse(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>)::'lambda'(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>, scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>), base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>>, void (scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>)>::RunOnce(base::internal::BindStateBase*, scoped_refptr<x11::UnsizedRefCountedMemory>&&, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>&&) base/functional/bind_internal.h:658:12
    #18 0x5d2d1ea0ae62 in base::OnceCallback<void (scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>)>::Run(scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>) && base/functional/callback.h:155:12
    #19 0x5d2d1ea262cd in x11::FutureImpl::ProcessResponse() ui/gfx/x/future.cc:62:8
    #20 0x5d2d1ea2783e in x11::FutureBase::DispatchNow() ui/gfx/x/future.cc:27:3
    #21 0x5d2d1ea292cb in x11::GeometryCache::GetBoundsPx() ui/gfx/x/geometry_cache.cc:46:22
    #22 0x5d2d1ea2934f in x11::GeometryCache::GetBoundsPx() ui/gfx/x/geometry_cache.cc:56:33
    #23 0x5d2d1ea2934f in x11::GeometryCache::GetBoundsPx() ui/gfx/x/geometry_cache.cc:56:33
    #24 0x5d2d1a6c43c4 in ui::X11Window::DispatchUiEvent(ui::Event*, x11::Event const&) ui/ozone/platform/x11/x11_window.cc:1471:35
    #25 0x5d2d1a6c3a9e in ui::X11Window::DispatchEvent(ui::Event* const&) ui/ozone/platform/x11/x11_window.cc:1431:3
    #26 0x5d2d1a6c4a32 in non-virtual thunk to ui::X11Window::DispatchEvent(ui::Event* const&) ui/ozone/platform/x11/x11_window.cc
    #27 0x5d2d1e9ea5c7 in ui::PlatformEventSource::DispatchEvent(ui::Event*) ui/events/platform/platform_event_source.cc:93:29
    #28 0x5d2d1ec0ba64 in ui::X11EventSource::OnEvent(x11::Event const&) ui/events/platform/x11/x11_event_source.cc:300:5
    #29 0x5d2d1ea079aa in void base::ObserverList<x11::EventObserver, false, (base::ObserverListReentrancyPolicy)0, base::internal::UncheckedObserverAdapter<(partition_alloc::internal::RawPtrTraits)1, false>>::NotifyAllowReentrancy<void (x11::EventObserver::*)(x11::Event const&), x11::Event>(T, x11::Event const&) third_party/libc++/src/include/__type_traits/invoke.h:90:27

previously allocated by thread T0 here:
    #0 0x5d2d18fe7711 in operator new(unsigned long) (/chromium/chromium/src/out/asan/ozone_x11_unittests+0x2935711) (BuildId: dc83e37ebeb74757)
    #1 0x5d2d19090d74 in ui::X11WindowOzoneTest::CreatePlatformWindow(ui::MockPlatformWindowDelegate*, gfx::Rect const&, unsigned int*, ui::X11ExtensionDelegate*) third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x5d2d19093bd4 in ui::X11WindowOzoneTest_DispatchUiEventGrabberFreedDuringGeometryFetch_Test::TestBody() ui/ozone/platform/x11/x11_window_ozone_unittest.cc:224:7
    #3 0x5d2d198ff83b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #4 0x5d2d19901a07 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #5 0x5d2d19903b03 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #6 0x5d2d1993303a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #7 0x5d2d19931b0e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x5d2d1b21fbcc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #9 0x5d2d18fe9511 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), mojo::core::test::MojoTestSuiteBase*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<mojo::core::test::MojoTestSuiteBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #10 0x5d2d1b2279b4 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #11 0x5d2d1b2272db in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #12 0x5d2d18fe8dcb in main mojo/core/test/run_all_unittests.cc:30:10
    #13 0x70c91627d249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free base/memory/scoped_refptr.h:260:62 in base::internal::WeakReferenceOwner::GetRef() const
Shadow bytes around the buggy address:
  0x6e29149e4200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6e29149e4280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6e29149e4300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6e29149e4380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6e29149e4400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x6e29149e4480: fd fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa
  0x6e29149e4500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6e29149e4580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6e29149e4600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6e29149e4680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6e29149e4700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==1788==ADDITIONAL INFO

==1788==Note: Please include this section with the ASan report.
Task trace:


==1788==END OF ADDITIONAL INFO

==1788==ABORTING