[0516/085445.538737:INFO:CONSOLE:34] "FONTLOAD OK 1 true", source: http://127.0.0.1:29317/poc.html (34)
[0516/085445.542915:INFO:CONSOLE:37] "FONTS READY loaded check: true", source: http://127.0.0.1:29317/poc.html (37)
=================================================================
==11147==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x765a00e03e50 at pc 0x57f37fba3e3a bp 0x7ffe76901aa0 sp 0x7ffe76901a98
WRITE of size 2 at 0x765a00e03e50 thread T0 (headless_shell)
    #0 0x57f37fba3e39 in OT::VarData::serialize(hb_serialize_context_t*, OT::VarData const*, hb_inc_bimap_t const&, hb_inc_bimap_t const&) third_party/harfbuzz/src/src/hb-open-type.hh:71:36
    #1 0x57f37fba087c in bool OT::OffsetTo<OT::VarData, OT::NumType<true, unsigned int, 4u>, void, true>::serialize_serialize<OT::VarData const*, hb_inc_bimap_t const&, hb_inc_bimap_t&>(hb_serialize_context_t*, OT::VarData const*&&, hb_inc_bimap_t const&, hb_inc_bimap_t&) third_party/harfbuzz/src/src/hb-open-type.hh:472:21
    #2 0x57f37fb9ef84 in OT::ItemVariationStore::serialize(hb_serialize_context_t*, OT::ItemVariationStore const*, hb_array_t<hb_inc_bimap_t const> const&) third_party/harfbuzz/src/src/graph/../hb-ot-layout-common.hh:3449:9
    #3 0x57f37fb5b474 in bool OT::OffsetTo<OT::ItemVariationStore, OT::NumType<true, unsigned int, 4u>, void, true>::serialize_serialize<OT::ItemVariationStore const*&, hb_array_t<hb_inc_bimap_t>>(hb_serialize_context_t*, OT::ItemVariationStore const*&, hb_array_t<hb_inc_bimap_t>&&) third_party/harfbuzz/src/src/hb-open-type.hh:472:21
    #4 0x57f37fb57702 in bool OT::HVARVVAR::_subset<OT::HVAR>(hb_subset_context_t*) const third_party/harfbuzz/src/src/hb-ot-var-hvar-table.hh:394:8
    #5 0x57f37fb4ec0b in _hb_subset_table_var(hb_subset_plan_t*, hb_vector_t<char, false>&, unsigned int, bool*) third_party/harfbuzz/src/src/hb-ot-var-hvar-table.hh:433:65
    #6 0x57f37fa43e45 in hb_subset_plan_execute_or_fail third_party/harfbuzz/src/src/hb-subset.cc:268:7
    #7 0x57f37fa3ff04 in hb_subset_or_fail third_party/harfbuzz/src/src/hb-subset.cc:359:24
    #8 0x57f37f3b3b04 in SkPDFSubsetFont(SkTypeface const&, SkPDFGlyphUse const&) third_party/skia/src/pdf/SkPDFSubsetFont.cpp:130:19
    #9 0x57f37f38a514 in SkPDFFont::emitSubset(SkPDFDocument*) const third_party/skia/src/pdf/SkPDFFont.cpp:471:30
    #10 0x57f37f277bb5 in SkPDFDocument::onClose(SkWStream*) third_party/skia/src/pdf/SkPDFDocument.cpp:681:12
    #11 0x57f3724c0192 in SkDocument::close() third_party/skia/src/core/SkDocument.cpp:57:23
    #12 0x57f38b8bd4b2 in printing::MetafileSkia::FinishDocument() printing/metafile_skia.cc:236:8
    #13 0x57f38ff6c895 in printing::PrintRenderFrameHelper::PrintPagesNative(blink::WebLocalFrame*, unsigned int, std::__Cr::vector<unsigned int, std::__Cr::allocator<unsigned int>> const&) components/printing/renderer/print_render_frame_helper.cc:2345:12
    #14 0x57f38ff5c2b5 in printing::PrintRenderFrameHelper::PrintPages() components/printing/renderer/print_render_frame_helper.cc:2266:8
    #15 0x57f38ff5b793 in printing::PrintRenderFrameHelper::PrintWithParams(mojo::StructPtr<printing::mojom::PrintPagesParams>, base::OnceCallback<void (base::expected<mojo::StructPtr<printing::mojom::PrintWithParamsResultData>, printing::mojom::PrintFailureReason>)>) components/printing/renderer/print_render_frame_helper.cc:1388:3
    #16 0x57f37b1d7670 in printing::mojom::PrintRenderFrameStubDispatch::AcceptWithResponder(printing::mojom::PrintRenderFrame*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_delete<mojo::MessageReceiverWithStatus>>) gen/components/printing/common/print.mojom.cc:3643:13
    #17 0x57f37d4d09b7 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56
    #18 0x57f37d4ee4e3 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24
    #19 0x57f37d4d6cc3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #20 0x57f37da1c443 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #21 0x57f37da1e8c5 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #22 0x57f37b4620e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #23 0x57f37b4d0c2c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #24 0x57f37b4cfaca in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #25 0x57f37b35ee82 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #26 0x57f37b4d2314 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #27 0x57f37b3f67a0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #28 0x57f385901423 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16
    #29 0x57f379d225c9 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #30 0x57f379d2387b in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #31 0x57f379d266f5 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #32 0x57f379d20028 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #33 0x57f379d2062c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #34 0x57f36b39691b in headless::(anonymous namespace)::HeadlessChildMain(content::ContentMainParams) headless/app/headless_shell.cc:195:12
    #35 0x57f36b396750 in headless::HeadlessShellMain(content::ContentMainParams) headless/app/headless_shell.cc:256:5
    #36 0x57f36b39b012 in main headless/app/headless_shell_main.cc:36:10
    #37 0x7a5a7fe45249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x765a00e03e50 is located 0 bytes after 898640-byte region [0x765a00d28800,0x765a00e03e50)
allocated by thread T0 (headless_shell) here:
    #0 0x57f36b35bd3c in realloc (/chromium/chromium/src/out/asan/headless_shell+0xb600d3c) (BuildId: 9edc463232f09aa4)
    #1 0x57f37fb53680 in _hb_subset_table_var(hb_subset_plan_t*, hb_vector_t<char, false>&, unsigned int, bool*) third_party/harfbuzz/src/src/hb-vector.hh:383:21
    #2 0x57f37fa43e45 in hb_subset_plan_execute_or_fail third_party/harfbuzz/src/src/hb-subset.cc:268:7
    #3 0x57f37fa3ff04 in hb_subset_or_fail third_party/harfbuzz/src/src/hb-subset.cc:359:24
    #4 0x57f37f3b3b04 in SkPDFSubsetFont(SkTypeface const&, SkPDFGlyphUse const&) third_party/skia/src/pdf/SkPDFSubsetFont.cpp:130:19
    #5 0x57f37f38a514 in SkPDFFont::emitSubset(SkPDFDocument*) const third_party/skia/src/pdf/SkPDFFont.cpp:471:30
    #6 0x57f37f277bb5 in SkPDFDocument::onClose(SkWStream*) third_party/skia/src/pdf/SkPDFDocument.cpp:681:12
    #7 0x57f3724c0192 in SkDocument::close() third_party/skia/src/core/SkDocument.cpp:57:23
    #8 0x57f38b8bd4b2 in printing::MetafileSkia::FinishDocument() printing/metafile_skia.cc:236:8
    #9 0x57f38ff6c895 in printing::PrintRenderFrameHelper::PrintPagesNative(blink::WebLocalFrame*, unsigned int, std::__Cr::vector<unsigned int, std::__Cr::allocator<unsigned int>> const&) components/printing/renderer/print_render_frame_helper.cc:2345:12
    #10 0x57f38ff5c2b5 in printing::PrintRenderFrameHelper::PrintPages() components/printing/renderer/print_render_frame_helper.cc:2266:8
    #11 0x57f38ff5b793 in printing::PrintRenderFrameHelper::PrintWithParams(mojo::StructPtr<printing::mojom::PrintPagesParams>, base::OnceCallback<void (base::expected<mojo::StructPtr<printing::mojom::PrintWithParamsResultData>, printing::mojom::PrintFailureReason>)>) components/printing/renderer/print_render_frame_helper.cc:1388:3
    #12 0x57f37b1d7670 in printing::mojom::PrintRenderFrameStubDispatch::AcceptWithResponder(printing::mojom::PrintRenderFrame*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_delete<mojo::MessageReceiverWithStatus>>) gen/components/printing/common/print.mojom.cc:3643:13
    #13 0x57f37d4d09b7 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56
    #14 0x57f37d4ee4e3 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24
    #15 0x57f37d4d6cc3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #16 0x57f37da1c443 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #17 0x57f37da1e8c5 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #18 0x57f37b4620e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #19 0x57f37b4d0c2c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #20 0x57f37b4cfaca in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #21 0x57f37b35ee82 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #22 0x57f37b4d2314 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #23 0x57f37b3f67a0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #24 0x57f385901423 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16
    #25 0x57f379d225c9 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #26 0x57f379d2387b in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #27 0x57f379d266f5 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #28 0x57f379d20028 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #29 0x57f379d2062c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10

SUMMARY: AddressSanitizer: heap-buffer-overflow third_party/harfbuzz/src/src/hb-open-type.hh:71:36 in OT::VarData::serialize(hb_serialize_context_t*, OT::VarData const*, hb_inc_bimap_t const&, hb_inc_bimap_t const&)
Shadow bytes around the buggy address:
  0x765a00e03b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x765a00e03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x765a00e03c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x765a00e03d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x765a00e03d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x765a00e03e00: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa
  0x765a00e03e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x765a00e03f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x765a00e03f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x765a00e04000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x765a00e04080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==11147==ADDITIONAL INFO

==11147==Note: Please include this section with the ASan report.
Task trace:
    #0 0x57f37da14afd in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13


Command line: `/proc/self/exe --type=renderer --headless=old --no-sandbox --allow-pre-commit-input --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1778580823322105 --launch-time-ticks=340856442074 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,6709653965808334355,17398090580418362656,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,5808213808333086316,1675853721399517248,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr`


==11147==END OF ADDITIONAL INFO

==11147==ABORTING