==7732==ERROR: AddressSanitizer: use-after-poison on address 0x7b5073e0b8a0 at pc 0x7ed07770516b bp 0x7ffe66aff2a0 sp 0x7ffe66aff298
READ of size 4 at 0x7b5073e0b8a0 thread T0 (chrome)
    #0 0x7ed07770516a in pa_operation_unref noflist.c:68:7
    #1 0x5fa4cfe28e94 in media::PulseLoopbackManager::MakeLoopbackStream(media::AudioParameters const&, base::RepeatingCallback<void (std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&)>, bool) media/audio/pulse/pulse_loopback_manager.cc:100:5
    #2 0x5fa4cfe1d0a8 in media::AudioManagerPulse::MakeInputStream(media::AudioParameters const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, base::RepeatingCallback<void (std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&)>) media/audio/pulse/audio_manager_pulse.cc:275:33
    #3 0x5fa4cfe1d2aa in media::AudioManagerPulse::MakeLowLatencyInputStream(media::AudioParameters const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, base::RepeatingCallback<void (std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&)> const&) media/audio/pulse/audio_manager_pulse.cc:174:10
    #4 0x5fa4cfd8ae5e in media::AudioManagerBase::MakeAudioInputStream(media::AudioParameters const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, base::RepeatingCallback<void (std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&)> const&) media/audio/audio_manager_base.cc
    #5 0x5fa4dcdd9233 in audio::InputController::DoCreate(media::AudioManager*, media::AudioParameters const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, bool, base::OnceCallback<std::__Cr::unique_ptr<audio::LoopbackMixin, std::__Cr::default_delete<audio::LoopbackMixin>> (std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, media::AudioParameters const&, base::RepeatingCallback<void (media::AudioBus const*, base::TimeTicks, double, media::AudioGlitchInfo const&)>)>) services/audio/input_controller.cc:720:33
    #6 0x5fa4dcdd8bab in audio::InputController::Create(media::AudioManager*, audio::InputController::EventHandler*, audio::InputController::SyncWriter*, std::__Cr::unique_ptr<audio::ReferenceSignalProvider, std::__Cr::default_delete<audio::ReferenceSignalProvider>>, media::AecdumpRecordingManager*, base::raw_ptr<audio::MlModelManager, (partition_alloc::internal::RawPtrTraits)0>, mojo::StructPtr<media::mojom::AudioProcessingConfig>, base::OnceCallback<std::__Cr::unique_ptr<audio::LoopbackMixin, std::__Cr::default_delete<audio::LoopbackMixin>> (std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, media::AudioParameters const&, base::RepeatingCallback<void (media::AudioBus const*, base::TimeTicks, double, media::AudioGlitchInfo const&)>)>, media::AudioParameters const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, bool) services/audio/input_controller.cc:501:15
    #7 0x5fa4dcde667f in audio::InputStream::InputStream(base::OnceCallback<void (mojo::StructPtr<media::mojom::ReadWriteAudioDataPipe>, bool, std::__Cr::optional<base::UnguessableToken> const&)>, base::OnceCallback<void (audio::InputStream*)>, mojo::PendingReceiver<media::mojom::AudioInputStream>, mojo::PendingRemote<media::mojom::AudioInputStreamClient>, mojo::PendingRemote<media::mojom::AudioInputStreamObserver>, mojo::SharedRemote<media::mojom::AudioLog>, media::AudioManager*, media::AecdumpRecordingManager*, base::raw_ptr<audio::MlModelManager, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<audio::ReferenceSignalProvider, std::__Cr::default_delete<audio::ReferenceSignalProvider>>, mojo::StructPtr<media::mojom::AudioProcessingConfig>, base::OnceCallback<std::__Cr::unique_ptr<audio::LoopbackMixin, std::__Cr::default_delete<audio::LoopbackMixin>> (std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, media::AudioParameters const&, base::RepeatingCallback<void (media::AudioBus const*, base::TimeTicks, double, media::AudioGlitchInfo const&)>)>, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, media::AudioParameters const&, unsigned int, bool) services/audio/input_stream.cc:151:17
    #8 0x5fa4dce43000 in std::__Cr::unique_ptr<audio::InputStream, std::__Cr::default_delete<audio::InputStream>> std::__Cr::make_unique<audio::InputStream, base::OnceCallback<void (mojo::StructPtr<media::mojom::ReadWriteAudioDataPipe>, bool, std::__Cr::optional<base::UnguessableToken> const&)>, base::OnceCallback<void (audio::InputStream*)>, mojo::PendingReceiver<media::mojom::AudioInputStream>, mojo::PendingRemote<media::mojom::AudioInputStreamClient>, mojo::PendingRemote<media::mojom::AudioInputStreamObserver>, mojo::SharedRemote<media::mojom::AudioLog>, base::raw_ptr<media::AudioManager, (partition_alloc::internal::RawPtrTraits)0> const&, base::raw_ptr<media::AecdumpRecordingManager, (partition_alloc::internal::RawPtrTraits)0> const&, base::raw_ptr<audio::MlModelManager, (partition_alloc::internal::RawPtrTraits)0> const&, std::__Cr::unique_ptr<audio::ReferenceSignalProvider, std::__Cr::default_delete<audio::ReferenceSignalProvider>>, mojo::StructPtr<media::mojom::AudioProcessingConfig>, base::OnceCallback<std::__Cr::unique_ptr<audio::LoopbackMixin, std::__Cr::default_delete<audio::LoopbackMixin>> (std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, media::AudioParameters const&, base::RepeatingCallback<void (media::AudioBus const*, base::TimeTicks, double, media::AudioGlitchInfo const&)>)>, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, media::AudioParameters const&, unsigned int&, bool&, 0>(base::OnceCallback<void (mojo::StructPtr<media::mojom::ReadWriteAudioDataPipe>, bool, std::__Cr::optional<base::UnguessableToken> const&)>&&, base::OnceCallback<void (audio::InputStream*)>&&, mojo::PendingReceiver<media::mojom::AudioInputStream>&&, mojo::PendingRemote<media::mojom::AudioInputStreamClient>&&, mojo::PendingRemote<media::mojom::AudioInputStreamObserver>&&, mojo::SharedRemote<media::mojom::AudioLog>&&, base::raw_ptr<media::AudioManager, (partition_alloc::internal::RawPtrTraits)0> const&, base::raw_ptr<media::AecdumpRecordingManager, (partition_alloc::internal::RawPtrTraits)0> const&, base::raw_ptr<audio::MlModelManager, (partition_alloc::internal::RawPtrTraits)0> const&, std::__Cr::unique_ptr<audio::ReferenceSignalProvider, std::__Cr::default_delete<audio::ReferenceSignalProvider>>&&, mojo::StructPtr<media::mojom::AudioProcessingConfig>&&, base::OnceCallback<std::__Cr::unique_ptr<audio::LoopbackMixin, std::__Cr::default_delete<audio::LoopbackMixin>> (std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, media::AudioParameters const&, base::RepeatingCallback<void (media::AudioBus const*, base::TimeTicks, double, media::AudioGlitchInfo const&)>)>&&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, media::AudioParameters const&, unsigned int&, bool&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #9 0x5fa4dce41e55 in audio::StreamFactory::CreateInputStream(mojo::PendingReceiver<media::mojom::AudioInputStream>, mojo::PendingRemote<media::mojom::AudioInputStreamClient>, mojo::PendingRemote<media::mojom::AudioInputStreamObserver>, mojo::PendingRemote<media::mojom::AudioLog>, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, media::AudioParameters const&, base::UnguessableToken const&, unsigned int, bool, mojo::StructPtr<media::mojom::AudioProcessingConfig>, base::OnceCallback<void (mojo::StructPtr<media::mojom::ReadWriteAudioDataPipe>, bool, std::__Cr::optional<base::UnguessableToken> const&)>) services/audio/stream_factory.cc:134:25
    #10 0x5fa4d2c80f74 in media::mojom::AudioStreamFactoryStubDispatch::AcceptWithResponder(media::mojom::AudioStreamFactory*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_delete<mojo::MessageReceiverWithStatus>>) gen/media/mojo/mojom/audio_stream_factory.mojom.cc:1768:13
    #11 0x5fa4e7627bc7 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56
    #12 0x5fa4e76456f3 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24
    #13 0x5fa4e762ded3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #14 0x5fa4e76556c8 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42
    #15 0x5fa4e7653ba8 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7
    #16 0x5fa4e76457f1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #17 0x5fa4e761e72c in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) mojo/public/cpp/bindings/lib/connector.cc:567:49
    #18 0x5fa4e761fdb0 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14
    #19 0x5fa4e761f809 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3
    #20 0x5fa4e7621664 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12
    #21 0x5fa4d3b5eb5e in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12
    #22 0x5fa4d3b5e8fa in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12
    #23 0x5fa4e76c1c30 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12
    #24 0x5fa4e76c1570 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14
    #25 0x5fa4e76c2737 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #26 0x5fa4e686da23 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #27 0x5fa4e68dca4c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #28 0x5fa4e68db8ea in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #29 0x5fa4e672ec42 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #30 0x5fa4e68de134 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #31 0x5fa4e67e90d0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #32 0x5fa4df5dabbd in content::UtilityMain(content::MainFunctionParams) content/utility/utility_main.cc:486:12
    #33 0x5fa4e306b39b in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:763:14
    #34 0x5fa4e306e3b5 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #35 0x5fa4e3067ce8 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #36 0x5fa4e30682ec in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #37 0x5fa4ce6b6266 in ChromeMain chrome/app/chrome_main.cc:194:12
    #38 0x7ed07620b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)
0x7b5073e0b8a0 is located 0 bytes inside of 88-byte region [0x7b5073e0b8a0,0x7b5073e0b8f8)
allocated by thread T0 (chrome) here:
    #0 0x5fa4ce67b934 in malloc (/chromium/chromium/src/out/asan/chrome+0x10e03934) (BuildId: 9c407a5ebc5d6733)
    #1 0x7ed076e27956 in pa_xmalloc (/lib/x86_64-linux-gnu/libpulse.so.0+0x3a956) (BuildId: 22ebe53366cdd39b5a991194ed263cdb99430478)
SUMMARY: AddressSanitizer: use-after-poison noflist.c:68:7 in pa_operation_unref
Shadow bytes around the buggy address:
  0x7b5073e0b600: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b5073e0b680: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x7b5073e0b700: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7b5073e0b780: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b5073e0b800: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7b5073e0b880: fa fa f7 fa[f7]f7 f7 f7 f7 f7 f7 f7 00 00 00 fa
  0x7b5073e0b900: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b5073e0b980: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b5073e0ba00: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b5073e0ba80: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b5073e0bb00: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
NOTE: the stack trace above identifies the code that *accessed* the poisoned memory.
To identify the code that *poisoned* the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=<size>.
==7732==ADDITIONAL INFO
==7732==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5fa4e76c20a3 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13
Command line: `/proc/self/exe --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=none --no-sandbox --crashpad-handler-pid=7636 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,12825387870292287362,10280336021489376711,524288 --field-trial-handle=3,i,2116236786189396282,15814626909727252074,262144 --enable-features=PulseaudioLoopbackForScreenShare --disable-features=WebRtcPipeWireCapturer --variations-seed-version --pseudonymization-salt-handle=7,i,16582606254075695708,11295052998514051674,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=stderr --v=1 --vmodule=*pulse*=3,*audio_manager*=3,audio_service*=3`
==7732==END OF ADDITIONAL INFO
==7732==ABORTING