==976==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d0c811ee6d0 at pc 0x55d8a3f38849 bp 0x7ba804ae1740 sp 0x7ba804ae1738
READ of size 8 at 0x7d0c811ee6d0 thread T13 (DedicatedWorker)
    #0 0x55d8a3f38848 in extensions::Extension::GetManifestData(std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>) const gen/third_party/libc++/src/include/__tree:950:54
    #1 0x55d8a3fd205c in extensions::(anonymous namespace)::IsResourceWebAccessibleImpl(extensions::Extension const&, GURL const&, std::__Cr::optional<url::Origin> const&, GURL const&) extensions/common/manifest_handlers/web_accessible_resources_info.cc:42:62
    #2 0x55d8a3fd2b47 in extensions::WebAccessibleResourcesInfo::IsResourceWebAccessibleRedirect(extensions::Extension const*, GURL const&, std::__Cr::optional<url::Origin> const&, GURL const&) extensions/common/manifest_handlers/web_accessible_resources_info.cc:283:10
    #3 0x55d8b40645b2 in ChromeContentRendererClient::IsSafeRedirectTarget(GURL const&, GURL const&, std::__Cr::optional<url::Origin> const&) chrome/renderer/chrome_content_renderer_client.cc:1598:9
    #4 0x55d8927b047d in blink::MojoURLLoaderClient::OnReceiveRedirect(net::RedirectInfo const&, mojo::StructPtr<network::mojom::URLResponseHead>) third_party/blink/renderer/platform/loader/fetch/url_loader/mojo_url_loader_client.cc:405:29
    #5 0x55d887127dde in blink::ThrottlingURLLoader::OnReceiveRedirect(net::RedirectInfo const&, mojo::StructPtr<network::mojom::URLResponseHead>) third_party/blink/common/loader/throttling_url_loader.cc:807:23
    #6 0x55d8857ac2e8 in network::mojom::URLLoaderClientStubDispatch::Accept(network::mojom::URLLoaderClient*, mojo::Message*) gen/services/network/public/mojom/url_loader.mojom.cc:1189:13
    #7 0x55d899b62069 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #8 0x55d899b7fef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #9 0x55d899b68513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #10 0x55d899b8fe48 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42
    #11 0x55d899b8e328 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7
    #12 0x55d899b7fef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #13 0x55d899b58c8a in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) mojo/public/cpp/bindings/lib/connector.cc:567:49
    #14 0x55d899b5a310 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14
    #15 0x55d899b59d69 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3
    #16 0x55d899b5bbc4 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12
    #17 0x55d8871187ae in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12
    #18 0x55d88711854a in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12
    #19 0x55d89a9f2c50 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12
    #20 0x55d89a9f2590 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14
    #21 0x55d89a9f3757 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #22 0x55d899da2326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #23 0x55d899e199c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #24 0x55d899e1883a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #25 0x55d899c60927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #26 0x55d899e1b0d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #27 0x55d899d1cca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #28 0x55d8925e4253 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:178:14
    #29 0x55d899f0bbee in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #30 0x55d881db0c46 in asan_thread_start(void*) asan_interceptors.cpp

0x7d0c811ee6d0 is located 592 bytes inside of 640-byte region [0x7d0c811ee480,0x7d0c811ee700)
freed by thread T0 (chrome) here:
    #0 0x55d881ded002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e09002) (BuildId: 1c6203e6df3606a0)
    #1 0x55d8a3f4e6ec in void std::__Cr::__destroy_at<std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const, scoped_refptr<extensions::Extension const>>>(std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const, scoped_refptr<extensions::Extension const>>*) base/memory/ref_counted.h:438:5
    #2 0x55d8a3f4ef2f in unsigned long std::__Cr::__tree<std::__Cr::__value_type<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, scoped_refptr<extensions::Extension const>>, std::__Cr::__map_value_compare<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const, scoped_refptr<extensions::Extension const>>, std::__Cr::less<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>>, std::__Cr::allocator<std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const, scoped_refptr<extensions::Extension const>>>>::__erase_unique<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) gen/third_party/libc++/src/include/__memory/allocator_traits.h:313:5
    #3 0x55d8a3f4ce3e in extensions::ExtensionSet::Remove(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) gen/third_party/libc++/src/include/map:1262:79
    #4 0x55d898a3ee60 in extensions::RendererExtensionRegistry::Remove(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) extensions/renderer/renderer_extension_registry.cc:87:22
    #5 0x55d8989c356c in extensions::Dispatcher::UnloadExtension(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) extensions/renderer/dispatcher.cc:1078:43
    #6 0x55d890f6024c in extensions::mojom::RendererStubDispatch::Accept(extensions::mojom::Renderer*, mojo::Message*) gen/extensions/common/mojom/renderer.mojom.cc:2867:13
    #7 0x55d899b62069 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #8 0x55d899b7fef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #9 0x55d899b68513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #10 0x55d89da887dd in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #11 0x55d89da8ac65 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #12 0x55d899da2326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #13 0x55d899e199c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #14 0x55d899e1883a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #15 0x55d899c60927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #16 0x55d899e1b0d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #17 0x55d899d1cca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #18 0x55d8a60a61fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #19 0x55d8958ba6ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #20 0x55d8958bba1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #21 0x55d8958be728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #22 0x55d8958b8101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #23 0x55d8958b86fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #24 0x55d881dedb39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #25 0x7fac82e2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 (chrome) here:
    #0 0x55d881dec3fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e083fd) (BuildId: 1c6203e6df3606a0)
    #1 0x55d8a3f355b1 in extensions::Extension::Create(base::FilePath const&, extensions::mojom::ManifestLocation, base::DictValue const&, int, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>*) extensions/common/extension.cc:276:40
    #2 0x55d8989c1e01 in extensions::Dispatcher::LoadExtensions(std::__Cr::vector<mojo::StructPtr<extensions::mojom::ExtensionLoadedParams>, std::__Cr::allocator<mojo::StructPtr<extensions::mojom::ExtensionLoadedParams>>>) extensions/renderer/dispatcher.cc:248:7
    #3 0x55d890f6106f in extensions::mojom::RendererStubDispatch::Accept(extensions::mojom::Renderer*, mojo::Message*) gen/extensions/common/mojom/renderer.mojom.cc:2840:13
    #4 0x55d899b62069 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #5 0x55d899b7fef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #6 0x55d899b68513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #7 0x55d89da887dd in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #8 0x55d89da8ac65 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x55d899da2326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #10 0x55d899e199c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #11 0x55d899e1883a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #12 0x55d899c60927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #13 0x55d899e1b0d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #14 0x55d899d1cca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #15 0x55d8a60a61fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #16 0x55d8958ba6ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #17 0x55d8958bba1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #18 0x55d8958be728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #19 0x55d8958b8101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #20 0x55d8958b86fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #21 0x55d881dedb39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #22 0x7fac82e2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Thread T13 (DedicatedWorker) created by T0 (chrome) here:
    #0 0x55d881d96a71 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10db2a71) (BuildId: 1c6203e6df3606a0)
    #1 0x55d899f0b242 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x55d899ea104c in base::SimpleThread::StartAsync() base/threading/simple_thread.cc:55:13
    #3 0x55d8925e1cba in blink::NonMainThread::CreateThread(blink::ThreadCreationParams const&) third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:40:11
    #4 0x55d8a9e810a8 in blink::WorkerBackingThread::WorkerBackingThread(blink::ThreadCreationParams const&) third_party/blink/renderer/core/workers/worker_backing_thread.cc:121:23
    #5 0x55d8a9e7284e in blink::DedicatedWorkerThread::DedicatedWorkerThread(blink::ExecutionContext*, blink::DedicatedWorkerObjectProxy&, mojo::PendingRemote<blink::mojom::blink::DedicatedWorkerHost>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #6 0x55d8a9e599c0 in blink::DedicatedWorkerMessagingProxy::CreateWorkerThread() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #7 0x55d8a9e78d21 in blink::ThreadedMessagingProxyBase::InitializeWorkerThread(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::optional<blink::WorkerBackingThreadStartupData> const&, std::__Cr::optional<base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const> const&, std::__Cr::unique_ptr<blink::WorkerDevToolsParams, std::__Cr::default_delete<blink::WorkerDevToolsParams>>) third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc:91:20
    #8 0x55d8a9e53f46 in blink::DedicatedWorkerMessagingProxy::StartWorkerGlobalScope(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, blink::WorkerOptions const*, blink::KURL const&, blink::FetchClientSettingsObjectSnapshot const&, v8_inspector::V8StackTraceId const&, base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const&, mojo::PendingRemote<blink::mojom::blink::DedicatedWorkerHost>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>) third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc:100:22
    #9 0x55d8a9e69237 in blink::DedicatedWorker::ContinueStartInternal(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, blink::DocumentPolicy::DocumentPolicyBundle, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>) third_party/blink/renderer/core/workers/dedicated_worker.cc:508:19
    #10 0x55d8a9e67b8d in blink::DedicatedWorker::ContinueStart(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, blink::DocumentPolicy::DocumentPolicyBundle, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>) third_party/blink/renderer/core/workers/dedicated_worker.cc:482:3
    #11 0x55d8a9e67353 in blink::DedicatedWorker::OnScriptLoadStarted(std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, blink::CrossVariantMojoRemote<blink::mojom::BackForwardCacheControllerHostInterfaceBase>, blink::CrossVariantMojoReceiver<blink::mojom::ReportingObserverInterfaceBase>, blink::CrossVariantMojoReceiver<blink::mojom::ReportingObserverInterfaceBase>) third_party/blink/renderer/core/workers/dedicated_worker.cc:362:3
    #12 0x55d8a613d4a1 in content::DedicatedWorkerHostFactoryClient::OnScriptLoadStarted(mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::StructPtr<blink::mojom::WorkerMainScriptLoadParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle, std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle>>, mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::PendingRemote<blink::mojom::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::ReportingObserver>, mojo::PendingReceiver<blink::mojom::ReportingObserver>) content/renderer/worker/dedicated_worker_host_factory_client.cc:166:12
    #13 0x55d8869bbb0f in blink::mojom::DedicatedWorkerHostFactoryClientStubDispatch::Accept(blink::mojom::DedicatedWorkerHostFactoryClient*, mojo::Message*) gen/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom.cc:523:13
    #14 0x55d899b62069 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #15 0x55d899b7fef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #16 0x55d899b68513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #17 0x55d899b8fe48 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42
    #18 0x55d899b8e328 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7
    #19 0x55d899b7fef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #20 0x55d899b58c8a in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) mojo/public/cpp/bindings/lib/connector.cc:567:49
    #21 0x55d899b5a310 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14
    #22 0x55d899b59d69 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3
    #23 0x55d899b5bbc4 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12
    #24 0x55d8871187ae in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12
    #25 0x55d88711854a in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12
    #26 0x55d89a9f2c50 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12
    #27 0x55d89a9f2590 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14
    #28 0x55d89a9f3757 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #29 0x55d899da2326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #30 0x55d899e199c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #31 0x55d899e1883a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #32 0x55d899c60927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #33 0x55d899e1b0d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #34 0x55d899d1cca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #35 0x55d8a60a61fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #36 0x55d8958ba6ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #37 0x55d8958bba1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #38 0x55d8958be728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #39 0x55d8958b8101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #40 0x55d8958b86fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #41 0x55d881dedb39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #42 0x7fac82e2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__tree:950:54 in extensions::Extension::GetManifestData(std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>) const
Shadow bytes around the buggy address:
  0x7d0c811ee400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x7d0c811ee480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d0c811ee500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d0c811ee580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d0c811ee600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d0c811ee680: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
  0x7d0c811ee700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x7d0c811ee780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d0c811ee800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d0c811ee880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d0c811ee900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==976==ADDITIONAL INFO

==976==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55d89a9f30c3 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=901 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1775447330840309 --launch-time-ticks=182669323049 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,5135768926746472762,9347920300231286601,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,7910694865720960828,8635555642157220462,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==976==END OF ADDITIONAL INFO

==976==ABORTING