[128679:128679:0526/191525.993474:ERROR:components/autofill/content/renderer/autofill_agent.cc:811] POC[renderer]: AutofillAgent::OnDestruct posting DeleteSoon [128679:128679:0526/191525.995843:ERROR:components/autofill/content/renderer/password_autofill_agent.cc:688] POC[renderer]: ~PasswordAutofillAgent this=0x74d4e0422480 [128588:128588:0526/191526.000251:ERROR:components/password_manager/content/browser/content_password_manager_driver.cc:530] POC[browser]: scheduling FillField for http://b.test:8080/iframe-b.html [128679:128679:0526/191526.006667:ERROR:components/autofill/content/renderer/autofill_agent.cc:811] POC[renderer]: AutofillAgent::OnDestruct posting DeleteSoon [128679:128679:0526/191526.007550:ERROR:components/autofill/content/renderer/password_autofill_agent.cc:688] POC[renderer]: ~PasswordAutofillAgent this=0x74d4e0425400 [128588:128588:0526/191529.001489:ERROR:components/password_manager/content/browser/content_password_manager_driver.cc:540] POC[browser]: sending FillField IPC [128677:128677:0526/191529.001821:ERROR:components/autofill/content/renderer/password_autofill_agent.cc:1049] POC[renderer]: DoFillField enter, this=0x74d4e03ebc00 [128588:128588:0526/191529.003371:INFO:CONSOLE:17] "iframe-b: autofill event fired, entering print() nested loop", source: http://b.test:8080/iframe-b.html (17) [128727:128727:0526/191529.586530:ERROR:content/renderer/render_frame_impl.cc:2230] POC[renderer]: RenderFrameImpl::Delete url=about:blank [128727:128727:0526/191529.587662:ERROR:components/autofill/content/renderer/autofill_agent.cc:811] POC[renderer]: AutofillAgent::OnDestruct posting DeleteSoon [128702:128702:0526/191529.664549:ERROR:components/autofill/content/renderer/autofill_agent.cc:811] POC[renderer]: AutofillAgent::OnDestruct posting DeleteSoon [128702:128702:0526/191529.665707:ERROR:components/autofill/content/renderer/password_autofill_agent.cc:688] POC[renderer]: ~PasswordAutofillAgent this=0x74d4e05d4f80 [128588:128588:0526/191530.514919:INFO:CONSOLE:20] "parent: removing iframe B (frees on-stack PasswordAutofillAgent)", source: http://a.test:8080/parent.html (20) [128677:128677:0526/191530.515588:ERROR:content/renderer/render_frame_impl.cc:2230] POC[renderer]: RenderFrameImpl::Delete url=http://b.test:8080/iframe-b.html [128677:128677:0526/191530.518317:ERROR:components/autofill/content/renderer/autofill_agent.cc:811] POC[renderer]: AutofillAgent::OnDestruct posting DeleteSoon [128588:128588:0526/191532.017660:INFO:CONSOLE:20] "parent: removing iframe C (quits nested loop → UAF)", source: http://a.test:8080/parent.html (20) [128677:128677:0526/191532.018612:ERROR:content/renderer/render_frame_impl.cc:2230] POC[renderer]: RenderFrameImpl::Delete url=http://b.test:8080/iframe-c.html [128677:128677:0526/191532.020615:ERROR:components/autofill/content/renderer/autofill_agent.cc:811] POC[renderer]: AutofillAgent::OnDestruct posting DeleteSoon [128677:128677:0526/191532.021106:ERROR:components/autofill/content/renderer/password_autofill_agent.cc:1051] POC[renderer]: DoFillField after SetAutofillValue (UAF next) Received signal 11 SEGV_MAPERR 000000000000