[6672:6702:0413/105735.150272:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig [6672:6702:0413/105735.464234:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [6672:6702:0413/105735.464514:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [6672:6702:0413/105735.464710:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [6672:6702:0413/105735.534920:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [6672:6672:0413/105735.543547:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [6672:6672:0413/105735.543957:WARNING:components/os_crypt/sync/key_storage_linux.cc:166] OSCrypt tried Libsecret but couldn't initialise. [6722:6722:0413/105735.596991:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [6672:6672:0413/105735.758476:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured. [6672:6702:0413/105735.789357:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [6672:6702:0413/105735.911286:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory DevTools listening on ws://127.0.0.1:19222/devtools/browser/a72a08ff-3b78-43fe-b987-651350e618a5 [6672:6672:0413/105735.943825:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6672:6672:0413/105735.950418:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [6672:6702:0413/105735.950873:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [6672:6672:0413/105735.952863:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6672:6672:0413/105736.016103:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6672:6672:0413/105736.047497:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6672:6702:0413/105736.051613:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [6672:6702:0413/105736.068329:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [6672:6702:0413/105736.068934:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [6672:6672:0413/105736.069422:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6672:6702:0413/105736.250707:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [6672:6702:0413/105736.250970:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [6672:6672:0413/105736.963950:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6672:6702:0413/105736.964540:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [6672:6672:0413/105736.965104:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [6672:6672:0413/105736.966731:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [6672:6672:0413/105736.966783:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [6672:6672:0413/105737.070877:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6672:6702:0413/105737.071689:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [6672:6699:0413/105737.126458:ERROR:crypto/nss_util.cc:79] Failed to create /usr/local/google/home/vmiura/.local/share/pki/nssdb directory. [6672:6672:0413/105737.128877:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6672:6702:0413/105737.129326:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [6672:6672:0413/105737.237433:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [6672:6672:0413/105737.237553:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. [6672:6672:0413/105737.246920:INFO:CONSOLE:25] "[POC] ready. (1) click the select, (2) press ArrowDown in the popup, (3) wait, (4) click anywhere on the page", source: http://127.0.0.1:18080/poc.html (25) [6672:6672:0413/105741.621067:INFO:CONSOLE:25] "[POC] selOld mousedown -> select popup opening; arming OUTER colorA.click() in 1200ms", source: http://127.0.0.1:18080/poc.html (25) [6672:6672:0413/105742.822379:INFO:CONSOLE:25] "[POC] firing colorA.click() [OUTER OpenPagePopup -> CancelPagePopup of select]", source: http://127.0.0.1:18080/poc.html (25) [6672:6672:0413/105742.830528:INFO:CONSOLE:25] "[POC] selOld change fired (inside CancelPagePopup) -> colorB.click() [INNER OpenPagePopup]", source: http://127.0.0.1:18080/poc.html (25) [6672:6702:0413/105742.881077:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR [6672:6702:0413/105742.882774:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR [6672:6702:0413/105742.883915:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR [6672:6672:0413/105742.918993:INFO:CONSOLE:25] "[POC] colorB.click() returned; OUTER OpenPagePopup resumes -> page_popup_ = popup_A; popup_B orphaned (refcount=1)", source: http://127.0.0.1:18080/poc.html (25) [6672:6672:0413/105742.977820:INFO:CONSOLE:25] "[POC] colorA.click() returned; two color popups now exist (browser side)", source: http://127.0.0.1:18080/poc.html (25) [6672:6672:0413/105744.410815:INFO:CONSOLE:25] "[POC] triggering AX deref of dangling popup_ on colorB", source: http://127.0.0.1:18080/poc.html (25) ================================================================= ==6786==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c35dbf09c10 at pc 0x557d7f267966 bp 0x7fffdece57c0 sp 0x7fffdece57b8 READ of size 8 at 0x7c35dbf09c10 thread T0 (chrome) #0 0x557d7f267965 in non-virtual thunk to blink::ColorChooserPopupUIController::RootAXObject(blink::Element*) third_party/blink/renderer/core/html/forms/color_chooser_popup_ui_controller.cc:85:27 #1 0x557d831ac8ca in blink::AXNodeObject::AddPopupChildren() third_party/blink/renderer/modules/accessibility/ax_node_object.cc:6101:50 #2 0x557d831ae181 in blink::AXNodeObject::AddChildrenImpl() third_party/blink/renderer/modules/accessibility/ax_node_object.cc:6270:3 #3 0x557d831af2c8 in blink::AXNodeObject::AddChildren() third_party/blink/renderer/modules/accessibility/ax_node_object.cc:6348:3 #4 0x557d8311c58b in blink::AXObject::UpdateChildrenIfNecessary() third_party/blink/renderer/modules/accessibility/ax_object.cc:6646:3 #5 0x557d83067f64 in blink::AXObjectCacheImpl::FireTreeUpdatedEventForAXID(blink::AXObjectCacheImpl::TreeUpdateParams*, blink::Document&) third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc:4200:16 #6 0x557d8305d6c2 in blink::AXObjectCacheImpl::ProcessCleanLayoutCallbacks(blink::Document&) third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc:4044:7 #7 0x557d83059e1d in blink::AXObjectCacheImpl::CommitAXUpdates(blink::Document&, bool) third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc:3568:9 #8 0x557d7d7d10e9 in void absl::functional_internal::InvokeObject(absl::functional_internal::VoidPtr, absl::functional_internal::ForwardT::type) third_party/blink/renderer/core/frame/local_frame_view.cc:3010:28 #9 0x557d7d75f113 in blink::LocalFrameView::ForAllNonThrottledLocalFrameViews(base::FunctionRef, blink::LocalFrameView::TraversalOrder) third_party/abseil-cpp/absl/functional/function_ref.h:165:12 #10 0x557d7d769edb in blink::LocalFrameView::RunAccessibilitySteps() third_party/blink/renderer/core/frame/local_frame_view.cc:3005:3 #11 0x557d7d769757 in blink::LocalFrameView::RunPostLifecycleSteps() third_party/blink/renderer/core/frame/local_frame_view.cc:1035:5 #12 0x557d7d769b4e in blink::LocalFrameView::DidBeginMainFrame() third_party/blink/renderer/core/frame/local_frame_view.cc:1026:5 #13 0x557d7d8e8500 in blink::WebFrameWidgetImpl::DidBeginMainFrame() third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:1687:17 #14 0x557d758887f8 in cc::LayerTreeHost::DidBeginMainFrame() cc/trees/layer_tree_host.cc:383:12 #15 0x557d75b9074d in cc::ProxyMain::BeginMainFrame(std::__Cr::unique_ptr>) cc/trees/proxy_main.cc:534:21 #16 0x557d75bb7775 in base::internal::Invoker>), base::WeakPtr&&, std::__Cr::unique_ptr>&&>, base::internal::BindState>), base::WeakPtr, std::__Cr::unique_ptr>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #17 0x557d6fd69326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #18 0x557d6fde09c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #19 0x557d6fddf83a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #20 0x557d6fc27927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #21 0x557d6fde20d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #22 0x557d6fce3ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #23 0x557d7c06d1fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16 #24 0x557d6b8816ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14 #25 0x557d6b882a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12 #26 0x557d6b885728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10 #27 0x557d6b87f101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #28 0x557d6b87f6fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 #29 0x557d57db4b39 in ChromeMain chrome/app/chrome_main.cc:191:12 #30 0x7f25ddc2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7c35dbf09c10 is located 16 bytes inside of 256-byte region [0x7c35dbf09c00,0x7c35dbf09d00) freed by thread T0 (chrome) here: #0 0x557d57d7a086 in free (/chromium/chromium/src/out/asan/chrome+0x10dcf086) (BuildId: 0440b075dbd4a9a3) #1 0x557d817a5c90 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #2 0x557d6fb2fdb9 in mojo::InterfaceEndpointClient::NotifyError(std::__Cr::optional const&) base/functional/callback.h:155:12 #3 0x557d73a3888d in IPC::ChannelAssociatedGroupController::NotifyEndpointOfError(IPC::ChannelAssociatedGroupController::Endpoint*, bool) ipc/ipc_mojo_bootstrap.cc:977:15 #4 0x557d73a39625 in IPC::ChannelAssociatedGroupController::NotifyEndpointOfErrorOnEndpointThread(unsigned int, base::raw_ptr) ipc/ipc_mojo_bootstrap.cc:1001:5 #5 0x557d73a39939 in void base::internal::Invoker), IPC::ChannelAssociatedGroupController*&&, unsigned int&&, base::raw_ptr>, base::internal::BindState), scoped_refptr, unsigned int, base::internal::UnretainedWrapper>, void ()>::RunImpl), std::__Cr::tuple, unsigned int, base::internal::UnretainedWrapper>, 0ul, 1ul, 2ul>(void (IPC::ChannelAssociatedGroupController::*&&)(unsigned int, base::raw_ptr), std::__Cr::tuple, unsigned int, base::internal::UnretainedWrapper>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:740:12 #6 0x557d6fd69326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #7 0x557d6fde09c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #8 0x557d6fddf83a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #9 0x557d6fc27927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #10 0x557d6fde20d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #11 0x557d6fce3ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #12 0x557d7c06d1fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16 #13 0x557d6b8816ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14 #14 0x557d6b882a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12 #15 0x557d6b885728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10 #16 0x557d6b87f101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #17 0x557d6b87f6fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 #18 0x557d57db4b39 in ChromeMain chrome/app/chrome_main.cc:191:12 #19 0x7f25ddc2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 (chrome) here: #0 0x557d57d7a324 in malloc (/chromium/chromium/src/out/asan/chrome+0x10dcf324) (BuildId: 0440b075dbd4a9a3) #1 0x557d6fffbdb3 in void* partition_alloc::PartitionRoot::Alloc<(partition_alloc::internal::AllocFlags)0>(unsigned long, char const*) base/allocator/partition_allocator/src/partition_alloc/partition_root.h:2208:56 #2 0x557d817a55f2 in blink::WebPagePopupImpl::Create(blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, blink::WebViewImpl*, blink::AgentGroupScheduler&, display::ScreenInfos const&, blink::PagePopupClient*) third_party/blink/renderer/core/exported/web_page_popup_impl.h:74:3 #3 0x557d817efe3b in blink::WebViewImpl::OpenPagePopup(blink::PagePopupClient*) third_party/blink/renderer/core/exported/web_view_impl.cc:1094:17 #4 0x557d7f25b585 in blink::ChromeClientImpl::OpenPagePopup(blink::PagePopupClient*) third_party/blink/renderer/core/page/chrome_client_impl.cc:1003:21 #5 0x557d7f267593 in blink::ColorChooserPopupUIController::OpenUI() third_party/blink/renderer/core/html/forms/color_chooser_popup_ui_controller.cc:241:28 #6 0x557d7f25918a in blink::ChromeClientImpl::OpenColorChooser(blink::LocalFrame*, blink::ColorChooserClient*, blink::Color const&) third_party/blink/renderer/core/page/chrome_client_impl.cc:791:15 #7 0x557d7f2b66de in blink::ColorInputType::OpenPopupView() third_party/blink/renderer/core/html/forms/color_input_type.cc:201:29 #8 0x557d7f2b6297 in blink::ColorInputType::HandleDOMActivateEvent(blink::Event&) third_party/blink/renderer/core/html/forms/color_input_type.cc:188:5 #9 0x557d80ff4694 in blink::HTMLInputElement::DefaultEventHandler(blink::Event&) third_party/blink/renderer/core/html/forms/html_input_element.cc:1559:23 #10 0x557d80fa0a7b in blink::EventDispatcher::DispatchEventPostProcess(blink::Node*, blink::EventDispatchHandlingState*) third_party/blink/renderer/core/dom/events/event_dispatcher.cc:444:12 #11 0x557d80f9ea25 in blink::EventDispatcher::Dispatch() third_party/blink/renderer/core/dom/events/event_dispatcher.cc:269:3 #12 0x557d80f9cf13 in blink::EventDispatcher::DispatchEvent(blink::Node&, blink::Event&) third_party/blink/renderer/core/dom/events/event_dispatcher.cc:79:16 #13 0x557d7cf4843f in blink::Node::DispatchDOMActivateEvent(int, blink::Event&) third_party/blink/renderer/core/dom/node.cc:3489:3 #14 0x557d7cf48b2e in blink::Node::DefaultEventHandler(blink::Event&) third_party/blink/renderer/core/dom/node.cc:3546:9 #15 0x557d80eb96bd in blink::Element::DefaultEventHandler(blink::Event&) third_party/blink/renderer/core/dom/element.cc:2072:18 #16 0x557d7dba25c9 in blink::HTMLFormControlElement::DefaultEventHandler(blink::Event&) third_party/blink/renderer/core/html/forms/html_form_control_element.cc:414:16 #17 0x557d80ff4c6a in blink::HTMLInputElement::DefaultEventHandler(blink::Event&) third_party/blink/renderer/core/html/forms/html_input_element.cc:1616:25 #18 0x557d80fa0a7b in blink::EventDispatcher::DispatchEventPostProcess(blink::Node*, blink::EventDispatchHandlingState*) third_party/blink/renderer/core/dom/events/event_dispatcher.cc:444:12 #19 0x557d80f9ea25 in blink::EventDispatcher::Dispatch() third_party/blink/renderer/core/dom/events/event_dispatcher.cc:269:3 #20 0x557d80f9d96a in blink::EventDispatcher::DispatchSimulatedClick(blink::Node&, blink::Event const*, blink::SimulatedClickCreationScope) third_party/blink/renderer/core/dom/events/event_dispatcher.cc:154:8 #21 0x557d7dd5e1a7 in blink::HTMLElement::click() third_party/blink/renderer/core/html/html_element.cc:3044:3 #22 0x557d82da3d97 in blink::(anonymous namespace)::v8_html_element::ClickOperationCallback(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_html_element.cc:4601:17 #23 0x557d62cc46e3 in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc #24 0x557d62cc2902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc #25 0x557d62cbf69b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc #26 0x557d62cbf3ea in Builtins_JSEntry setup-isolate-deserialize.cc #27 0x557d5df157ad in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12 #28 0x557d5df13e22 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>) v8/src/execution/execution.cc:564:10 #29 0x557d5dac2849 in v8::Function::Call(v8::Isolate*, v8::Local, v8::Local, int, v8::Local*) v8/src/api/api.cc:5603:27 SUMMARY: AddressSanitizer: heap-use-after-free third_party/blink/renderer/core/html/forms/color_chooser_popup_ui_controller.cc:85:27 in non-virtual thunk to blink::ColorChooserPopupUIController::RootAXObject(blink::Element*) Shadow bytes around the buggy address: 0x7c35dbf09980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c35dbf09a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x7c35dbf09a80: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd 0x7c35dbf09b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c35dbf09b80: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa =>0x7c35dbf09c00: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c35dbf09c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c35dbf09d00: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd 0x7c35dbf09d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c35dbf09e00: fd fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x7c35dbf09e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==6786==ADDITIONAL INFO ==6786==Note: Please include this section with the ASan report. Task trace: #0 0x557d75baec6f in cc::ProxyImpl::ScheduledActionSendBeginMainFrame(viz::BeginFrameArgs const&) cc/trees/proxy_impl.cc:763:7 Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=6682 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc --change-stack-guard-on-fork=enable --no-sandbox --remote-debugging-port=19222 --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1775927720986130 --launch-time-ticks=150135694330 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,1445533651446270611,14495946031067033266,2097152 --field-trial-handle=3,i,10228668360401831126,4451106581373788998,262144 --disable-features=CalculateNativeWinOcclusion,Translate --variations-seed-version --pseudonymization-salt-handle=7,i,14978051687081848528,826054645880117531,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr --v=0` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==6786==END OF ADDITIONAL INFO ==6786==ABORTING [6725:6757:0413/105755.212120:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_. [6725:6757:0413/105755.212393:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.