================================================================= ==68997==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b4c7c635e20 at pc 0x562900be852d bp 0x7b18088083f0 sp 0x7b18088083e8 READ of size 8 at 0x7b4c7c635e20 thread T8 (DedicatedWorker) #0 0x562900be852c in cast_receiver::ContentRendererClientMixinsImpl::GetUrlRewriteRulesProvider(base::TokenType const&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:266:112 #1 0x562900bebc1c in cast_receiver::WrappingURLLoaderThrottleProvider::CreateThrottles(base::optional_ref const, (partition_alloc::internal::RawPtrTraits)0>, network::ResourceRequest const&) components/cast_receiver/renderer/wrapping_url_loader_throttle_provider.cc:58:16 #2 0x5628ffcbe3a0 in blink::DedicatedOrSharedWorkerGlobalScopeContextImpl::CreateThrottles(network::ResourceRequest const&) third_party/blink/renderer/platform/loader/fetch/url_loader/dedicated_or_shared_worker_global_scope_context_impl.cc:394:32 #3 0x56290ae1b7d4 in blink::LoaderFactoryForWorker::CreateURLLoader(network::ResourceRequest const&, blink::ResourceLoaderOptions const&, scoped_refptr, scoped_refptr, blink::BackForwardCacheLoaderHelper*, std::__Cr::optional const&, bool) third_party/blink/renderer/core/loader/loader_factory_for_worker.cc:50:21 #4 0x5628ffc2e124 in blink::ResourceFetcher::CreateURLLoader(network::ResourceRequest const&, blink::ResourceLoaderOptions const&, blink::mojom::RequestContextType, blink::RenderBlockingBehavior, std::__Cr::optional const&, bool) third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc:1763:27 #5 0x5628ffc67129 in blink::ResourceLoader::Start() third_party/blink/renderer/platform/loader/fetch/resource_loader.cc:287:25 #6 0x5628ffc2cbc4 in blink::ResourceFetcher::StartLoad(blink::Resource*, blink::ResourceRequestBody, blink::ResourceFetcher::ImageLoadBlockingPolicy, blink::RenderBlockingBehavior) third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc:2772:11 #7 0x5628ffc27fea in blink::ResourceFetcher::RequestResource(blink::FetchParameters&, blink::ResourceFactory const&, blink::ResourceClient*) third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc:1608:10 #8 0x5628ffbfa486 in blink::RawResource::Fetch(blink::FetchParameters&, blink::ResourceFetcher*, blink::RawResourceClient*) third_party/blink/renderer/platform/loader/fetch/raw_resource.cc:63:33 #9 0x56290a5ba9dc in blink::ThreadableLoader::Start(blink::ResourceRequest) third_party/blink/renderer/core/loader/threadable_loader.cc:180:5 #10 0x56290994056d in blink::FetchManager::Loader::CreateLoader(blink::ResourceRequest, blink::ResourceLoaderOptions const&) third_party/blink/renderer/core/fetch/fetch_manager.cc:1271:23 #11 0x56290993eeb6 in blink::FetchLoaderBase::PerformHTTPFetch(blink::ExceptionState&) third_party/blink/renderer/core/fetch/fetch_manager.cc:1236:3 #12 0x56290993cd07 in blink::FetchLoaderBase::PerformSchemeFetch(blink::ExceptionState&) third_party/blink/renderer/core/fetch/fetch_manager.cc:1044:5 #13 0x56290993c1d8 in blink::FetchLoaderBase::Start(blink::ExceptionState&) third_party/blink/renderer/core/fetch/fetch_manager.cc #14 0x562909940cb0 in blink::FetchManager::Fetch(blink::ScriptState*, blink::FetchRequestData*, blink::AbortSignal*, blink::ExceptionState&) third_party/blink/renderer/core/fetch/fetch_manager.cc:1635:11 #15 0x562909921186 in blink::GlobalFetch::ScopedFetcher::Fetch(blink::ScriptState*, blink::V8UnionRequestOrUSVString const*, blink::RequestInit const*, blink::ExceptionState&) third_party/blink/renderer/core/fetch/global_fetch.cc:99:34 #16 0x562909921eb9 in blink::GlobalFetch::fetch(blink::ScriptState*, blink::WorkerGlobalScope&, blink::V8UnionRequestOrUSVString const*, blink::RequestInit const*, blink::ExceptionState&) third_party/blink/renderer/core/fetch/global_fetch.cc:192:39 #17 0x56290cd8345a in blink::(anonymous namespace)::v8_worker_global_scope::FetchOperationCallback(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_worker_global_scope.cc:838:23 #18 0x5628febd26e3 in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc #19 0x5628febd0902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc #20 0x5628febcd69b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc #21 0x5628febcd3ea in Builtins_JSEntry setup-isolate-deserialize.cc #22 0x5628f9e2cebd in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12 #23 0x5628f9e2b532 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>) v8/src/execution/execution.cc:564:10 #24 0x5628f99dd499 in v8::Function::Call(v8::Isolate*, v8::Local, v8::Local, int, v8::Local*) v8/src/api/api.cc:5603:27 #25 0x5629086f6a78 in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:851:48 #26 0x56290c0e4693 in blink::bindings::CallbackInvokeHelper::CallInternal(int, v8::Local*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:124:12 #27 0x56290c0e445f in blink::bindings::CallbackInvokeHelper::Call(int, v8::Local*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:148:10 #28 0x56290c0f15a1 in blink::V8Function::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:73:13 #29 0x56290c0f18e7 in blink::V8Function::InvokeAndReportException(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:133:15 #30 0x56290c87f978 in blink::ScheduledAction::Execute(blink::ExecutionContext*) third_party/blink/renderer/core/scheduler/scheduled_action.cc:145:18 #31 0x56290c87a39c in blink::DOMTimer::Fired() third_party/blink/renderer/core/scheduler/dom_timer.cc:448:11 #32 0x56290b443047 in blink::TimerBase::RunInternal() third_party/blink/renderer/platform/timer.cc:166:3 #33 0x56290868709e in void base::internal::Invoker, base::internal::BindState>, void ()>::RunImpl>, 0ul>(void (blink::TimerBase::*&&)(), std::__Cr::tuple>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:1069:14 #34 0x562900ec4996 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #35 0x562900f3cb19 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #36 0x562900f3b98a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #37 0x562900dc0417 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #38 0x562900f3e227 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #39 0x562900e58ac0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #40 0x5628ffb8873a in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:178:14 #41 0x562901034f2e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #42 0x5628f3123c46 in asan_thread_start(void*) asan_interceptors.cpp 0x7b4c7c635e20 is located 16 bytes inside of 24-byte region [0x7b4c7c635e10,0x7b4c7c635e28) freed by thread T0 (cast_shell) here: #0 0x5628f3160002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/cast_asan/cast_shell+0xd19d002) (BuildId: 3eadcb3b6a759a7a) #1 0x562900be952c in std::__Cr::__wrap_iter, std::__Cr::unique_ptr>>*> std::__Cr::vector, std::__Cr::unique_ptr>>, std::__Cr::allocator, std::__Cr::unique_ptr>>>>::emplace, std::__Cr::unique_ptr>>>(std::__Cr::__wrap_iter, std::__Cr::unique_ptr>> const*>, std::__Cr::pair, std::__Cr::unique_ptr>>&&) gen/third_party/libc++/src/include/__vector/vector.h:1251:3 #2 0x562900be921f in std::__Cr::pair, std::__Cr::unique_ptr>>*>, bool> base::internal::flat_tree, base::internal::GetFirst, std::__Cr::less, std::__Cr::vector, std::__Cr::unique_ptr>>, std::__Cr::allocator, std::__Cr::unique_ptr>>>>>::emplace_key_args, std::__Cr::pair, std::__Cr::unique_ptr>>>(base::TokenType const&, std::__Cr::pair, std::__Cr::unique_ptr>>&&) base/containers/flat_tree.h:1054:16 #3 0x562900be7abb in std::__Cr::pair, std::__Cr::unique_ptr>>*>, bool> base::internal::flat_tree, base::internal::GetFirst, std::__Cr::less, std::__Cr::vector, std::__Cr::unique_ptr>>, std::__Cr::allocator, std::__Cr::unique_ptr>>>>>::emplace, std::__Cr::unique_ptr>>(base::TokenType&&, std::__Cr::unique_ptr>&&) base/containers/flat_tree.h:878:10 #4 0x562900be7922 in cast_receiver::ContentRendererClientMixinsImpl::RenderFrameCreated(content::RenderFrame&) components/cast_receiver/renderer/content_renderer_client_mixins_impl.cc:43:32 #5 0x562900bb9aa5 in chromecast::shell::CastContentRendererClient::RenderFrameCreated(content::RenderFrame*) chromecast/renderer/cast_content_renderer_client.cc:134:26 #6 0x56290847ad6e in content::RenderFrameImpl::Initialize(blink::WebFrame*) content/renderer/render_frame_impl.cc:2018:37 #7 0x562908492cd0 in content::RenderFrameImpl::CreateChildFrame(blink::mojom::TreeScopeType, blink::WebString const&, blink::WebString const&, blink::FramePolicy const&, blink::WebFrameOwnerProperties const&, blink::FrameOwnerElementType, blink::WebPolicyContainerBindParams, long, base::FunctionRef const&, blink::CrossVariantMojoRemote, std::__Cr::unique_ptr>)>) content/renderer/render_frame_impl.cc:3716:23 #8 0x5629084936b6 in non-virtual thunk to content::RenderFrameImpl::CreateChildFrame(blink::mojom::TreeScopeType, blink::WebString const&, blink::WebString const&, blink::FramePolicy const&, blink::WebFrameOwnerProperties const&, blink::FrameOwnerElementType, blink::WebPolicyContainerBindParams, long, base::FunctionRef const&, blink::CrossVariantMojoRemote, std::__Cr::unique_ptr>)>) content/renderer/render_frame_impl.cc #9 0x562909676500 in blink::WebLocalFrameImpl::CreateChildFrame(blink::AtomicString const&, blink::HTMLFrameOwnerElement*) third_party/blink/renderer/core/frame/web_local_frame_impl.cc:2512:38 #10 0x56290991b086 in blink::HTMLFrameOwnerElement::LoadOrRedirectSubframe(blink::KURL const&, blink::AtomicString const&, bool) third_party/blink/renderer/core/html/html_frame_owner_element.cc:801:43 #11 0x562909adc059 in blink::HTMLFrameElementBase::OpenURL(bool) third_party/blink/renderer/core/html/html_frame_element_base.cc:87:3 #12 0x56290b7b8110 in blink::ContainerNode::DidInsertNodeVector(blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember, 11u> const&, blink::Node*, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember, 11u> const&) third_party/blink/renderer/core/dom/container_node.cc:436:19 #13 0x56290b7bc062 in blink::ContainerNode::AppendChild(blink::Node*, blink::ExceptionState&) third_party/blink/renderer/core/dom/container_node.cc:1226:3 #14 0x56290c364bc8 in blink::(anonymous namespace)::v8_node::AppendChildOperationCallbackForMainWorld(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/core/v8/v8_node.cc:523:39 #15 0x5628febd26e3 in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc #16 0x5628febd0902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc #17 0x5628febcd69b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc #18 0x5628febcd3ea in Builtins_JSEntry setup-isolate-deserialize.cc #19 0x5628f9e2cebd in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12 #20 0x5628f9e2b532 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>) v8/src/execution/execution.cc:564:10 #21 0x5628f99dd499 in v8::Function::Call(v8::Isolate*, v8::Local, v8::Local, int, v8::Local*) v8/src/api/api.cc:5603:27 #22 0x5629086f6a78 in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:851:48 #23 0x56290c0e4693 in blink::bindings::CallbackInvokeHelper::CallInternal(int, v8::Local*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:124:12 #24 0x56290c0e445f in blink::bindings::CallbackInvokeHelper::Call(int, v8::Local*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:148:10 #25 0x56290c0f15a1 in blink::V8Function::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:73:13 #26 0x56290c0f18e7 in blink::V8Function::InvokeAndReportException(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:133:15 #27 0x56290c87f978 in blink::ScheduledAction::Execute(blink::ExecutionContext*) third_party/blink/renderer/core/scheduler/scheduled_action.cc:145:18 #28 0x56290c87a39c in blink::DOMTimer::Fired() third_party/blink/renderer/core/scheduler/dom_timer.cc:448:11 #29 0x56290b443047 in blink::TimerBase::RunInternal() third_party/blink/renderer/platform/timer.cc:166:3 previously allocated by thread T0 (cast_shell) here: #0 0x5628f315f3fd in operator new(unsigned long) (/chromium/chromium/src/out/cast_asan/cast_shell+0xd19c3fd) (BuildId: 3eadcb3b6a759a7a) #1 0x562900be9fcb in std::__Cr::allocator, std::__Cr::unique_ptr>>>::allocate_at_least(unsigned long) gen/third_party/libc++/src/include/__memory/allocator.h:99:13 #2 0x562900be97b4 in std::__Cr::__split_buffer, std::__Cr::unique_ptr>>, std::__Cr::allocator, std::__Cr::unique_ptr>>>, std::__Cr::__split_buffer_pointer_layout>::__split_buffer(unsigned long, unsigned long, std::__Cr::allocator, std::__Cr::unique_ptr>>>&) gen/third_party/libc++/src/include/__memory/allocator_traits.h:280:22 #3 0x562900be9508 in std::__Cr::__wrap_iter, std::__Cr::unique_ptr>>*> std::__Cr::vector, std::__Cr::unique_ptr>>, std::__Cr::allocator, std::__Cr::unique_ptr>>>>::emplace, std::__Cr::unique_ptr>>>(std::__Cr::__wrap_iter, std::__Cr::unique_ptr>> const*>, std::__Cr::pair, std::__Cr::unique_ptr>>&&) gen/third_party/libc++/src/include/__vector/vector.h:1248:48 #4 0x562900be921f in std::__Cr::pair, std::__Cr::unique_ptr>>*>, bool> base::internal::flat_tree, base::internal::GetFirst, std::__Cr::less, std::__Cr::vector, std::__Cr::unique_ptr>>, std::__Cr::allocator, std::__Cr::unique_ptr>>>>>::emplace_key_args, std::__Cr::pair, std::__Cr::unique_ptr>>>(base::TokenType const&, std::__Cr::pair, std::__Cr::unique_ptr>>&&) base/containers/flat_tree.h:1054:16 #5 0x562900be7abb in std::__Cr::pair, std::__Cr::unique_ptr>>*>, bool> base::internal::flat_tree, base::internal::GetFirst, std::__Cr::less, std::__Cr::vector, std::__Cr::unique_ptr>>, std::__Cr::allocator, std::__Cr::unique_ptr>>>>>::emplace, std::__Cr::unique_ptr>>(base::TokenType&&, std::__Cr::unique_ptr>&&) base/containers/flat_tree.h:878:10 #6 0x562900be7922 in cast_receiver::ContentRendererClientMixinsImpl::RenderFrameCreated(content::RenderFrame&) components/cast_receiver/renderer/content_renderer_client_mixins_impl.cc:43:32 #7 0x562900bb9aa5 in chromecast::shell::CastContentRendererClient::RenderFrameCreated(content::RenderFrame*) chromecast/renderer/cast_content_renderer_client.cc:134:26 #8 0x56290847ad6e in content::RenderFrameImpl::Initialize(blink::WebFrame*) content/renderer/render_frame_impl.cc:2018:37 #9 0x5629084747d2 in content::RenderFrameImpl::CreateMainFrame(content::AgentSchedulingGroup&, blink::WebView*, blink::WebFrame*, bool, bool, mojo::StructPtr, base::UnguessableToken const&, mojo::StructPtr, blink::WebURL const&) content/renderer/render_frame_impl.cc:1660:17 #10 0x56290852f71d in content::AgentSchedulingGroup::CreateWebView(mojo::StructPtr, bool, blink::WebURL const&) content/renderer/agent_scheduling_group.cc:276:7 #11 0x56290852e99d in content::AgentSchedulingGroup::CreateView(mojo::StructPtr) content/renderer/agent_scheduling_group.cc:219:3 #12 0x5628f6980fe5 in content::mojom::AgentSchedulingGroupStubDispatch::Accept(content::mojom::AgentSchedulingGroup*, mojo::Message*) gen/content/common/agent_scheduling_group.mojom.cc:672:13 #13 0x5629027996f8 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54 #14 0x5629027b1bed in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #15 0x56290279d84c in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #16 0x56290298cdc5 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24 #17 0x56290298e976 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #18 0x562900ec4996 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #19 0x562900f3cb19 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #20 0x562900f3b98a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #21 0x562900dc0417 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #22 0x562900f3e227 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #23 0x562900e58ac0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #24 0x5629085ef0ff in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16 #25 0x562900bf1a21 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14 #26 0x562900bf28c5 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12 #27 0x562900bf491a in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10 #28 0x562900bf03d4 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #29 0x562900bf07e4 in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 Thread T8 (DedicatedWorker) created by T0 (cast_shell) here: #0 0x5628f3109a71 in pthread_create (/chromium/chromium/src/out/cast_asan/cast_shell+0xd146a71) (BuildId: 3eadcb3b6a759a7a) #1 0x562901034582 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x562900fd0c3c in base::SimpleThread::StartAsync() base/threading/simple_thread.cc:55:13 #3 0x5628ffb869a4 in blink::NonMainThread::CreateThread(blink::ThreadCreationParams const&) third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:40:11 #4 0x56290ae0365d in blink::WorkerBackingThread::WorkerBackingThread(blink::ThreadCreationParams const&) third_party/blink/renderer/core/workers/worker_backing_thread.cc:121:23 #5 0x56290adfa79e in std::__Cr::unique_ptr> std::__Cr::make_unique(blink::ThreadCreationParams&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30 #6 0x56290adfa6b0 in blink::DedicatedWorkerThread::DedicatedWorkerThread(blink::ExecutionContext*, blink::DedicatedWorkerObjectProxy&, mojo::PendingRemote, mojo::PendingRemote) third_party/blink/renderer/core/workers/dedicated_worker_thread.cc:62:28 #7 0x56290ade86aa in std::__Cr::unique_ptr> std::__Cr::make_unique, mojo::PendingRemote, 0>(blink::ExecutionContext*&&, blink::DedicatedWorkerObjectProxy&, mojo::PendingRemote&&, mojo::PendingRemote&&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30 #8 0x56290ade8592 in blink::DedicatedWorkerMessagingProxy::CreateWorkerThread() third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc:367:10 #9 0x56290adfe1cd in blink::ThreadedMessagingProxyBase::InitializeWorkerThread(std::__Cr::unique_ptr>, std::__Cr::optional const&, std::__Cr::optional const> const&, std::__Cr::unique_ptr>) third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc:91:20 #10 0x56290ade5bed in blink::DedicatedWorkerMessagingProxy::StartWorkerGlobalScope(std::__Cr::unique_ptr>, std::__Cr::unique_ptr>, blink::WorkerOptions const*, blink::KURL const&, blink::FetchClientSettingsObjectSnapshot const&, v8_inspector::V8StackTraceId const&, base::TokenType const&, mojo::PendingRemote, mojo::PendingRemote) third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc:100:22 #11 0x56290adf4160 in blink::DedicatedWorker::ContinueStartInternal(blink::KURL const&, std::__Cr::unique_ptr>, network::mojom::ReferrerPolicy, blink::Vector, 0u, blink::PartitionAllocator>, blink::DocumentPolicy::DocumentPolicyBundle, mojo::PendingRemote, mojo::PendingReceiver, mojo::PendingReceiver) third_party/blink/renderer/core/workers/dedicated_worker.cc:508:19 #12 0x56290adf3004 in blink::DedicatedWorker::ContinueStart(blink::KURL const&, std::__Cr::unique_ptr>, network::mojom::ReferrerPolicy, blink::Vector, 0u, blink::PartitionAllocator>, blink::DocumentPolicy::DocumentPolicyBundle, mojo::PendingRemote, mojo::PendingReceiver, mojo::PendingReceiver) third_party/blink/renderer/core/workers/dedicated_worker.cc:482:3 #13 0x56290adf288a in blink::DedicatedWorker::OnScriptLoadStarted(std::__Cr::unique_ptr>, blink::CrossVariantMojoRemote, blink::CrossVariantMojoReceiver, blink::CrossVariantMojoReceiver) third_party/blink/renderer/core/workers/dedicated_worker.cc:362:3 #14 0x562908668f1f in content::DedicatedWorkerHostFactoryClient::OnScriptLoadStarted(mojo::StructPtr, mojo::StructPtr, std::__Cr::unique_ptr>, mojo::PendingReceiver, mojo::StructPtr, mojo::PendingRemote, mojo::PendingReceiver, mojo::PendingReceiver) content/renderer/worker/dedicated_worker_host_factory_client.cc:166:12 #15 0x5628f609fc76 in blink::mojom::DedicatedWorkerHostFactoryClientStubDispatch::Accept(blink::mojom::DedicatedWorkerHostFactoryClient*, mojo::Message*) gen/third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom.cc:523:13 #16 0x5629027996f8 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54 #17 0x5629027b1bed in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #18 0x56290279d84c in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #19 0x5629027b94ba in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #20 0x5629027b5775 in mojo::internal::MultiplexRouter::ProcessTasks(mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1026:15 #21 0x5629027bbb68 in mojo::internal::MultiplexRouter::LockAndCallProcessTasks() mojo/public/cpp/bindings/lib/multiplex_router.cc:1234:3 #22 0x5629027c26b6 in void base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunImpl>, 0ul>(void (mojo::internal::MultiplexRouter::*&&)(), std::__Cr::tuple>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:1069:14 #23 0x562900ec4996 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #24 0x562900f3cb19 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #25 0x562900f3b98a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #26 0x562900dc0417 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #27 0x562900f3e227 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #28 0x562900e58ac0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #29 0x5629085ef0ff in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16 #30 0x562900bf1a21 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14 #31 0x562900bf28c5 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12 #32 0x562900bf491a in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10 #33 0x562900bf03d4 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #34 0x562900bf07e4 in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 #35 0x5628f3160962 in main chromecast/app/cast_main.cc:13:10 #36 0x7f1c7da45249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__memory/unique_ptr.h:266:112 in cast_receiver::ContentRendererClientMixinsImpl::GetUrlRewriteRulesProvider(base::TokenType const&) Shadow bytes around the buggy address: 0x7b4c7c635b80: 00 00 fa fa fd fd fd fd fa fa fd fd fd fd fa fa 0x7b4c7c635c00: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd 0x7b4c7c635c80: fa fa fd fd fd fd fa fa fd fd fd fd fa fa 00 00 0x7b4c7c635d00: 00 07 fa fa fd fd fd fd fa fa 00 00 00 06 fa fa 0x7b4c7c635d80: fd fd fd fd fa fa 00 00 00 00 fa fa fd fd fd fd =>0x7b4c7c635e00: fa fa fd fd[fd]fa fa fa 00 00 00 fa fa fa fd fd 0x7b4c7c635e80: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa 0x7b4c7c635f00: fd fd fd fa fa fa fd fd fd fa fa fa 00 00 00 00 0x7b4c7c635f80: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd 0x7b4c7c636000: fd fd fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 0x7b4c7c636080: 00 00 00 00 fa fa 00 00 00 fa fa fa 00 00 00 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==68997==ABORTING Received close signal: Terminated Received close signal: Terminated