==2752==ERROR: AddressSanitizer: heap-use-after-free on address 0x7e10f8a2ffcd at pc 0x55d68566d00b bp 0x7ba0f02addd0 sp 0x7ba0f02ad590
READ of size 49 at 0x7e10f8a2ffcd thread T4 (ThreadPoolForeg)
    #0 0x55d68566d00a in __asan_memcpy (/chromium/chromium/src/out/asan/chrome+0x10dcd00a) (BuildId: b418477fa3e36859)
    #1 0x55d68c6a08dd in void v8::internal::String::WriteToFlat<unsigned char>(v8::internal::Tagged<v8::internal::String>, unsigned char*, unsigned int, unsigned int, v8::internal::SharedStringAccessGuardIfNeeded const&) v8/src/base/memcopy.h
    #2 0x55d68e1b5a0c in v8::internal::compiler::utils::ConcatenateStrings(v8::internal::Handle<v8::internal::String>, v8::internal::Handle<v8::internal::String>, v8::internal::compiler::JSHeapBroker*) v8/src/compiler/common-utils.cc:72:5
    #3 0x55d68d292c84 in v8::internal::maglev::MaglevGraphBuilder::BuildStringConcat(v8::internal::maglev::ValueNode*, v8::internal::maglev::ValueNode*) v8/src/maglev/maglev-graph-builder.cc:2557:9
    #4 0x55d68d2d58bc in v8::internal::maglev::ReduceResult v8::internal::maglev::MaglevGraphBuilder::VisitBinaryOperation<(Operation)0>() v8/src/maglev/maglev-graph-builder.cc
    #5 0x55d68d2bd240 in v8::internal::maglev::MaglevGraphBuilder::VisitSingleBytecode() v8/src/maglev/maglev-graph-builder.cc:8112:10
    #6 0x55d68d2e3ecd in v8::internal::maglev::MaglevGraphBuilder::BuildBody() v8/src/maglev/maglev-graph-builder.cc:17106:9
    #7 0x55d68d36a83f in v8::internal::maglev::MaglevGraphBuilder::Build() v8/src/maglev/maglev-graph-builder.cc:17005:3
    #8 0x55d68cf9d10b in v8::internal::maglev::MaglevCompiler::Compile(v8::internal::LocalIsolate*, v8::internal::maglev::MaglevCompilationInfo*) v8/src/maglev/maglev-compiler.cc:105:26
    #9 0x55d68d27507a in v8::internal::maglev::MaglevCompilationJob::ExecuteJobImpl(v8::internal::RuntimeCallStats*, v8::internal::LocalIsolate*) v8/src/maglev/maglev-concurrent-dispatcher.cc:132:8
    #10 0x55d68b5f97e8 in v8::internal::OptimizedCompilationJob::ExecuteJob(v8::internal::RuntimeCallStats*, v8::internal::LocalIsolate*) v8/src/codegen/compiler.cc:454:22
    #11 0x55d68d2792e7 in v8::internal::maglev::MaglevConcurrentDispatcher::JobTask::Run(v8::JobDelegate*) v8/src/maglev/maglev-concurrent-dispatcher.cc:287:18
    #12 0x55d6a4e3d2bf in base::internal::Invoker<base::internal::FunctorTraits<gin::V8Platform::CreateJobImpl(v8::TaskPriority, std::__Cr::unique_ptr<v8::JobTask, std::__Cr::default_delete<v8::JobTask>>, v8::SourceLocation const&)::$_0 const&, std::__Cr::unique_ptr<v8::JobTask, std::__Cr::default_delete<v8::JobTask>> const&>, base::internal::BindState<false, false, false, gin::V8Platform::CreateJobImpl(v8::TaskPriority, std::__Cr::unique_ptr<v8::JobTask, std::__Cr::default_delete<v8::JobTask>>, v8::SourceLocation const&)::$_0, std::__Cr::unique_ptr<v8::JobTask, std::__Cr::default_delete<v8::JobTask>>>, void (base::JobDelegate*)>::Run(base::internal::BindStateBase*, base::JobDelegate*) gin/v8_platform.cc:301:23
    #13 0x55d69d6f46cf in base::RepeatingCallback<void (base::JobDelegate*)>::Run(base::JobDelegate*) const & base/functional/callback.h:346:12
    #14 0x55d69d6f5f69 in base::internal::Invoker<base::internal::FunctorTraits<base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::ThreadType, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0 const&, base::internal::JobTaskSource*>, base::internal::BindState<false, false, false, base::internal::JobTaskSource::JobTaskSource(base::Location const&, base::TaskTraits const&, base::ThreadType, base::RepeatingCallback<void (base::JobDelegate*)>, base::RepeatingCallback<unsigned long (unsigned long)>, base::internal::PooledTaskRunnerDelegate*)::$_0, base::internal::UnretainedWrapper<base::internal::JobTaskSource, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/task/thread_pool/job_task_source.cc:114:32
    #15 0x55d69d65f326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #16 0x55d69d6fe502 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5
    #17 0x55d69d6fe74c in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:675:3
    #18 0x55d69d6fcd39 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:705:7
    #19 0x55d69d6fbfc2 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5
    #20 0x55d69d740cf3 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36
    #21 0x55d69d73fe34 in base::internal::WorkerThread::RunPooledWorker() base/task/thread_pool/worker_thread.cc:359:3
    #22 0x55d69d73f89b in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:339:7
    #23 0x55d69d7c8bee in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #24 0x55d68566cc46 in asan_thread_start(void*) asan_interceptors.cpp

0x7e10f8a2ffcd is located 11981 bytes inside of 12071-byte region [0x7e10f8a2d100,0x7e10f8a30027)
freed by thread T0 (chrome) here:
    #0 0x55d68566f086 in free (/chromium/chromium/src/out/asan/chrome+0x10dcf086) (BuildId: b418477fa3e36859)
    #1 0x55d6adbba3a7 in blink::ParkableStringImpl::DiscardUncompressedData() third_party/blink/renderer/platform/wtf/text/string_impl.h:331:11
    #2 0x55d6adbbf1b3 in blink::ParkableStringImpl::OnParkingCompleteOnMainThread(std::__Cr::unique_ptr<blink::BackgroundTaskParams, std::__Cr::default_delete<blink::BackgroundTaskParams>>, std::__Cr::unique_ptr<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>, std::__Cr::default_delete<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>>>, base::TimeDelta) third_party/blink/renderer/platform/bindings/parkable_string.cc:960:5
    #3 0x55d6adbc4a6e in base::internal::Invoker<base::internal::FunctorTraits<blink::ParkableStringImpl::CompressInBackground(std::__Cr::unique_ptr<blink::BackgroundTaskParams, std::__Cr::default_delete<blink::BackgroundTaskParams>>)::$_0&&, std::__Cr::unique_ptr<blink::BackgroundTaskParams, std::__Cr::default_delete<blink::BackgroundTaskParams>>&&, std::__Cr::unique_ptr<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>, std::__Cr::default_delete<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>>>&&, base::TimeDelta&&>, base::internal::BindState<false, false, false, blink::ParkableStringImpl::CompressInBackground(std::__Cr::unique_ptr<blink::BackgroundTaskParams, std::__Cr::default_delete<blink::BackgroundTaskParams>>)::$_0, std::__Cr::unique_ptr<blink::BackgroundTaskParams, std::__Cr::default_delete<blink::BackgroundTaskParams>>, std::__Cr::unique_ptr<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>, std::__Cr::default_delete<blink::Vector<unsigned char, 0u, blink::PartitionAllocator>>>, base::TimeDelta>, void ()>::RunOnce(base::internal::BindStateBase*) third_party/blink/renderer/platform/bindings/parkable_string.cc:924:21
    #4 0x55d69d65f326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #5 0x55d69d6d69c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #6 0x55d69d6d583a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #7 0x55d69d51d927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #8 0x55d69d6d80d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #9 0x55d69d5d9ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #10 0x55d6a99631fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #11 0x55d6991776ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #12 0x55d699178a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #13 0x55d69917b728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #14 0x55d699175101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #15 0x55d6991756fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #16 0x55d6856a9b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #17 0x7fa0fa82b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T4 (ThreadPoolForeg) here:
    #0 0x55d68566f324 in malloc (/chromium/chromium/src/out/asan/chrome+0x10dcf324) (BuildId: b418477fa3e36859)
    #1 0x55d69d8f1db3 in void* partition_alloc::PartitionRoot::Alloc<(partition_alloc::internal::AllocFlags)0>(unsigned long, char const*) base/allocator/partition_allocator/src/partition_alloc/partition_root.h:2208:56
    #2 0x55d6a3881170 in blink::StringImpl::CreateUninitialized(unsigned long, base::span<unsigned char, 18446744073709551615ul, unsigned char*>&) third_party/blink/renderer/platform/wtf/text/string_impl.cc:199:29
    #3 0x55d6a38f8b46 in blink::TextCodecLatin1::Decode(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>, blink::FlushBehavior, bool, bool&) third_party/blink/renderer/platform/wtf/text/wtf_string.h:74:12
    #4 0x55d6aeaeea8a in blink::TextResourceDecoder::Decode(base::span<char const, 18446744073709551615ul, char const*>, blink::String*) third_party/blink/renderer/core/html/parser/text_resource_decoder.cc:427:27
    #5 0x55d6ab7eb345 in blink::ScriptDecoderWithClient::DidReceiveData(blink::Vector<char, 0u, blink::PartitionAllocator>, bool) third_party/blink/renderer/core/html/parser/text_resource_decoder.h:78:55
    #6 0x55d6ab7f06ae in base::internal::Invoker<base::internal::FunctorTraits<void (blink::ScriptDecoderWithClient::*&&)(blink::Vector<char, 0u, blink::PartitionAllocator>, bool), blink::ScriptDecoderWithClient*, blink::Vector<char, 0u, blink::PartitionAllocator>&&, bool&&>, base::internal::BindState<true, true, false, void (blink::ScriptDecoderWithClient::*)(blink::Vector<char, 0u, blink::PartitionAllocator>, bool), blink::CrossThreadUnretainedWrapper<blink::ScriptDecoderWithClient>, blink::Vector<char, 0u, blink::PartitionAllocator>, bool>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #7 0x55d69d65f326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #8 0x55d69d6fe502 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5
    #9 0x55d69d6fe74c in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:675:3
    #10 0x55d69d6fcd39 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:705:7
    #11 0x55d69d6fbfc2 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5
    #12 0x55d69d740cf3 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36
    #13 0x55d69d73fe34 in base::internal::WorkerThread::RunPooledWorker() base/task/thread_pool/worker_thread.cc:359:3
    #14 0x55d69d73f89b in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:339:7
    #15 0x55d69d7c8bee in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #16 0x55d68566cc46 in asan_thread_start(void*) asan_interceptors.cpp

Thread T4 (ThreadPoolForeg) created by T0 (chrome) here:
    #0 0x55d685652a71 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10db2a71) (BuildId: b418477fa3e36859)
    #1 0x55d69d7c8242 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x55d69d73e5e4 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*) base/task/thread_pool/worker_thread.cc:185:3
    #3 0x55d69d735bd5 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush() base/task/thread_pool/thread_group.cc:65:13
    #4 0x55d69d735890 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor() base/task/thread_pool/thread_group.cc:56:3
    #5 0x55d69d72b264 in base::internal::ThreadGroupImpl::Start(unsigned long, unsigned long, base::TimeDelta, scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*, base::internal::ThreadGroup::WorkerEnvironment, bool, std::__Cr::optional<base::TimeDelta>) base/task/thread_pool/thread_group_impl.cc:71:3
    #6 0x55d69d704126 in base::internal::ThreadPoolImpl::Start(base::ThreadPoolInstance::InitParams const&, base::WorkerThreadObserver*) base/task/thread_pool/thread_pool_impl.cc:241:35
    #7 0x55d6a9739dbe in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>, bool) content/child/child_process.cc:112:20
    #8 0x55d6a98bf0a0 in content::RenderProcess::RenderProcess(std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>) content/renderer/render_process.cc:18:7
    #9 0x55d6a98be8d8 in content::RenderProcessImpl::RenderProcessImpl() content/renderer/render_process_impl.cc:98:7
    #10 0x55d6a98bee80 in content::RenderProcessImpl::Create() content/renderer/render_process_impl.cc:223:31
    #11 0x55d6a9962e10 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:274:53
    #12 0x55d6991776ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #13 0x55d699178a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #14 0x55d69917b728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #15 0x55d699175101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #16 0x55d6991756fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #17 0x55d6856a9b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #18 0x7fa0fa82b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free (/chromium/chromium/src/out/asan/chrome+0x10dcd00a) (BuildId: b418477fa3e36859) in __asan_memcpy
Shadow bytes around the buggy address:
  0x7e10f8a2fd00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7e10f8a2fd80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7e10f8a2fe00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7e10f8a2fe80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7e10f8a2ff00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7e10f8a2ff80: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd
  0x7e10f8a30000: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
  0x7e10f8a30080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7e10f8a30100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7e10f8a30180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7e10f8a30200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2752==ADDITIONAL INFO

==2752==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55d6a4e26b3f in gin::V8ToBaseLocation(v8::SourceLocation const&) gin/converter.cc:289:10
    #1 0x55d6ae96dc27 in blink::HTMLDocumentParser::SchedulePumpTokenizer(bool) third_party/blink/renderer/core/html/parser/html_document_parser.cc:864:7
    #2 0x55d6ae995392 in blink::HTMLParserScriptRunner::PendingScriptFinished(blink::PendingScript*) third_party/blink/renderer/core/script/html_parser_script_runner.cc:277:18
    #3 0x55d6ab7ecc06 in blink::ScriptDecoderWithClient::FinishDecode(blink::CrossThreadOnceFunction<void ()>) third_party/blink/renderer/bindings/core/v8/script_decoder.cc:261:29


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=2676 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1775711236998024 --launch-time-ticks=145740544119 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,596448326018441900,4550841622140723035,2097152 --field-trial-handle=3,i,5282841726684430940,13446572179243068665,262144 --disable-features=BackgroundResourceFetch --variations-seed-version --pseudonymization-salt-handle=7,i,5896733146786690075,9251517332446392998,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==2752==END OF ADDITIONAL INFO

==2752==ABORTING