[.] Sanitizer coverage enabled. Counter map size: 8173247, Cmp map size: 262144
Note: Google Test filter = ExternalPointerTagCollisionTest.*
[==========] Running 2 tests from 1 test suite.
[----------] Global test environment set-up.
[----------] 2 tests from ExternalPointerTagCollisionTest
[ RUN      ] ExternalPointerTagCollisionTest.TagCollisionDefeatsTypeCheck
[       OK ] ExternalPointerTagCollisionTest.TagCollisionDefeatsTypeCheck (4 ms)
[ RUN      ] ExternalPointerTagCollisionTest.TypeConfusionViaHandleSwap
[POC] before: sendReportTo handle=000a0000  console.createTask handle=000a0040
[POC] after:  console.createTask handle=000a0000  → now resolves to ReportBindings* (0x7fff61c023e0) under kV8ConsoleTag
[POC] calling console.createTask('poc') with type-confused `this` — expecting out-of-sandbox crash
=================================================================
==2222==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6d76aa667b80 at pc 0x5eea5d030c11 bp 0x7fff61c01cb0 sp 0x7fff61c01ca8
READ of size 8 at 0x6d76aa667b80 thread T0
    #0 0x5eea5d030c10 in v8_inspector::V8Console::taskTemplate() v8/include/v8-local-handle.h:231:37
    #1 0x5eea5d030569 in v8_inspector::V8Console::createTask(v8::FunctionCallbackInfo<v8::Value> const&) v8/src/inspector/v8-console.cc:501:32
    #2 0x5eea5f8336d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #3 0x5eea5f831956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #4 0x5eea5f82e6db in Builtins_JSEntryTrampoline crtstuff.c
    #5 0x5eea5f82e42a in Builtins_JSEntry crtstuff.c
    #6 0x5eea5ab8b1c1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #7 0x5eea5ab8db22 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) v8/src/execution/execution.cc:575:10
    #8 0x5eea5a7a9083 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) v8/src/api/api.cc:2042:7
    #9 0x5eea53e71eaf in auction_worklet::ExternalPointerTagCollisionTest_TypeConfusionViaHandleSwap_Test::TestBody() content/services/auction_worklet/external_pointer_tag_collision_unittest.cc:329:17
    #10 0x5eea561b5cab in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #11 0x5eea561b8d27 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #12 0x5eea561bada3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #13 0x5eea561e9f24 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #14 0x5eea561e8a9a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #15 0x5eea66047570 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #16 0x5eea65b09525 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23
    #17 0x5eea65708961 in base::internal::Invoker<base::internal::FunctorTraits<int (content::UnitTestTestSuite::*&&)(), content::UnitTestTestSuite*>, base::internal::BindState<true, true, false, int (content::UnitTestTestSuite::*)(), base::internal::UnretainedWrapper<content::UnitTestTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #18 0x5eea6609c23b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #19 0x5eea6609bb5b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #20 0x5eea657084d4 in main content/test/run_all_unittests.cc:17:10
    #21 0x7136ac02b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x6d76aa667b80 is located 8 bytes after 40-byte region [0x6d76aa667b50,0x6d76aa667b78)
allocated by thread T0 here:
    #0 0x5eea4be5c40d in operator new(unsigned long) (/chromium/chromium/src/out/asan/content_unittests+0xf6b640d) (BuildId: 2c65959f30a0413f)
    #1 0x5eea65dcfe22 in scoped_refptr<base::sequence_manager::internal::TaskQueueImpl::GuardedTaskPoster> base::MakeRefCounted<base::sequence_manager::internal::TaskQueueImpl::GuardedTaskPoster, base::sequence_manager::internal::TaskQueueImpl*>(base::sequence_manager::internal::TaskQueueImpl*&&) base/memory/scoped_refptr.h:151:12
    #2 0x5eea65dcf693 in base::sequence_manager::internal::TaskQueueImpl::TaskQueueImpl(base::sequence_manager::internal::SequenceManagerImpl*, base::sequence_manager::internal::WakeUpQueue*, base::sequence_manager::TaskQueue::Spec const&) base/task/sequence_manager/task_queue_impl.cc:245:20
    #3 0x5eea65dba9d9 in base::sequence_manager::internal::SequenceManagerImpl::CreateTaskQueue(base::sequence_manager::TaskQueue::Spec const&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #4 0x5eea65ea1fc2 in base::internal::SequenceManagerThreadDelegate::SequenceManagerThreadDelegate(base::MessagePumpType, base::OnceCallback<std::__Cr::unique_ptr<base::MessagePump, std::__Cr::default_delete<base::MessagePump>> ()>, std::__Cr::unique_ptr<base::sequence_manager::SequenceManagerSettings, std::__Cr::default_delete<base::sequence_manager::SequenceManagerSettings>>) base/threading/thread.cc:72:48
    #5 0x5eea65ea03a3 in base::Thread::StartWithOptions(base::Thread::Options) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #6 0x5eea65e3ced9 in base::internal::ThreadPoolImpl::Start(base::ThreadPoolInstance::InitParams const&, base::WorkerThreadObserver*) base/task/thread_pool/thread_pool_impl.cc:160:25
    #7 0x5eea6602e179 in base::test::TaskEnvironment::InitializeThreadPool() base/test/task_environment.cc:544:30
    #8 0x5eea6602d24f in base::test::TaskEnvironment::TaskEnvironment(base::sequence_manager::SequenceManager::PrioritySettings, base::test::TaskEnvironment::TimeSource, base::test::TaskEnvironment::MainThreadType, base::test::TaskEnvironment::ThreadPoolExecutionMode, base::test::TaskEnvironment::ThreadingMode, base::test::TaskEnvironment::ThreadPoolCOMEnvironment, base::test::TaskEnvironment::ScopedExecutionFenceBehaviour, bool, base::trait_helpers::NotATraitTag) base/test/task_environment.cc:490:5
    #9 0x5eea4cb4ce7d in base::test::TaskEnvironment::TaskEnvironment<>(base::sequence_manager::SequenceManager::PrioritySettings, T...) base/test/task_environment.h:430:9
    #10 0x5eea4cb4cd1f in base::test::TaskEnvironment::TaskEnvironment<>(T...) base/test/task_environment.h:219:9
    #11 0x5eea53e7299f in auction_worklet::(anonymous namespace)::ExternalPointerTagCollisionTest::ExternalPointerTagCollisionTest() content/services/auction_worklet/external_pointer_tag_collision_unittest.cc:137:3
    #12 0x5eea53e72d20 in testing::internal::TestFactoryImpl<auction_worklet::ExternalPointerTagCollisionTest_TypeConfusionViaHandleSwap_Test>::CreateTest() content/services/auction_worklet/external_pointer_tag_collision_unittest.cc:214:1
    #13 0x5eea561b8ab0 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc
    #14 0x5eea561bada3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #15 0x5eea561e9f24 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #16 0x5eea561e8a9a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #17 0x5eea66047570 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #18 0x5eea65b09525 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23
    #19 0x5eea65708961 in base::internal::Invoker<base::internal::FunctorTraits<int (content::UnitTestTestSuite::*&&)(), content::UnitTestTestSuite*>, base::internal::BindState<true, true, false, int (content::UnitTestTestSuite::*)(), base::internal::UnretainedWrapper<content::UnitTestTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #20 0x5eea6609c23b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #21 0x5eea6609bb5b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #22 0x5eea657084d4 in main content/test/run_all_unittests.cc:17:10
    #23 0x7136ac02b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Shadow bytes around the buggy address:
  0x6d76aa667900: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x6d76aa667980: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x6d76aa667a00: fa fa 00 00 00 06 fc fc fa fa fd fd fd fd fd fa
  0x6d76aa667a80: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
  0x6d76aa667b00: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
=>0x6d76aa667b80:[fa]fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x6d76aa667c00: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x6d76aa667c80: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 00
  0x6d76aa667d00: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x6d76aa667d80: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
  0x6d76aa667e00: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
E0000 00:00:1778927084.762415    2222 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2222==ADDITIONAL INFO
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778927084.762538    2222 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2222==Note: Please include this section with the ASan report.
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778927084.762579    2222 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace:
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778927084.762608    2222 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778927084.762637    2222 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2222==END OF ADDITIONAL INFO
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778927084.762666    2222 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==2222==ABORTING
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31