[.] Sanitizer coverage enabled. Counter map size: 8283429, Cmp map size: 262144
IMPORTANT DEBUGGING NOTE: batches of tests are run inside their
own process. For debugging a test inside a debugger, use the
--gtest_filter=<your_test_name> flag along with
--single-process-tests.
Using sharding settings from environment. This is shard 0/1
Using 1 parallel jobs.
[.] Sanitizer coverage enabled. Counter map size: 8283429, Cmp map size: 262144
Note: Google Test filter = RenderWidgetHostViewAuraOnBoundsChangedUAFTest.DestroyDuringOnTextInputTypeChanged
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from RenderWidgetHostViewAuraOnBoundsChangedUAFTest
[ RUN      ] RenderWidgetHostViewAuraOnBoundsChangedUAFTest.DestroyDuringOnTextInputTypeChanged
[4760:4760:WARNING:ui/gfx/linux/gbm_support_x11.cc:48] dri3 extension not supported.
=================================================================
==4760==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b078ddf1bc8 at pc 0x5f5c8ec67ed9 bp 0x7ffe9dc03110 sp 0x7ffe9dc03108
READ of size 8 at 0x7b078ddf1bc8 thread T0
    #0 0x5f5c8ec67ed8 in content::RenderWidgetHostViewAura::OnUpdateTextInputStateCalled(content::TextInputManager*, content::RenderWidgetHostViewBase*, bool) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1022:48
    #1 0x5f5c8ec9be68 in content::TextInputManager::NotifyObserversAboutInputStateUpdate(content::RenderWidgetHostViewBase*, bool) content/browser/renderer_host/text_input_manager.cc:495:14
    #2 0x5f5c8ec9ad17 in content::TextInputManager::UpdateTextInputState(content::RenderWidgetHostViewBase*, ui::mojom::TextInputState const&) content/browser/renderer_host/text_input_manager.cc:268:3
    #3 0x5f5c7e18aa51 in content::RenderWidgetHostViewAuraOnBoundsChangedUAFTest_DestroyDuringOnTextInputTypeChanged_Test::TestBody() content/browser/renderer_host/render_widget_host_view_aura_unittest.cc:7012:10
    #4 0x5f5c8329d10b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #5 0x5f5c832a0277 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #6 0x5f5c832a2373 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #7 0x5f5c832d202a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #8 0x5f5c832d0afe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #9 0x5f5c9316f40c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #10 0x5f5c92c1d075 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23
    #11 0x5f5c92801261 in base::internal::Invoker<base::internal::FunctorTraits<int (content::UnitTestTestSuite::*&&)(), content::UnitTestTestSuite*>, base::internal::BindState<true, true, false, int (content::UnitTestTestSuite::*)(), base::internal::UnretainedWrapper<content::UnitTestTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #12 0x5f5c931c5a94 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #13 0x5f5c931c53bb in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #14 0x5f5c92800dd4 in main content/test/run_all_unittests.cc:17:10
    #15 0x7d678fc2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7b078ddf1bc8 is located 328 bytes inside of 1232-byte region [0x7b078ddf1a80,0x7b078ddf1f50)
freed by thread T0 here:
    #0 0x5f5c78927991 in operator delete(void*) (/chromium/chromium/src/out/asan/content_unittests+0xfb2c991) (BuildId: bd7a00e8d46fee41)
    #1 0x5f5c9c1e60d4 in aura::Window::~Window() ui/aura/window.cc:245:16
    #2 0x5f5c9c1e8483 in aura::Window::~Window() ui/aura/window.cc:188:19
    #3 0x5f5c7e1ac178 in base::internal::BindLambdaForTestingHelper<content::RenderWidgetHostViewAuraOnBoundsChangedUAFTest_DestroyDuringOnTextInputTypeChanged_Test::TestBody()::$_0, void ()>::Run(content::RenderWidgetHostViewAuraOnBoundsChangedUAFTest_DestroyDuringOnTextInputTypeChanged_Test::TestBody()::$_0 const&) content/browser/renderer_host/render_widget_host_view_aura_unittest.cc:6999:36
    #4 0x5f5c7e1ac300 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(content::RenderWidgetHostViewAuraOnBoundsChangedUAFTest_DestroyDuringOnTextInputTypeChanged_Test::TestBody()::$_0 const&), content::RenderWidgetHostViewAuraOnBoundsChangedUAFTest_DestroyDuringOnTextInputTypeChanged_Test::TestBody()::$_0 const&>, base::internal::BindState<false, true, false, void (*)(content::RenderWidgetHostViewAuraOnBoundsChangedUAFTest_DestroyDuringOnTextInputTypeChanged_Test::TestBody()::$_0 const&), content::RenderWidgetHostViewAuraOnBoundsChangedUAFTest_DestroyDuringOnTextInputTypeChanged_Test::TestBody()::$_0>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #5 0x5f5c7e1b11c5 in content::DestroyingMockInputMethod::OnTextInputTypeChanged(ui::TextInputClient*) base/functional/callback.h:155:12
    #6 0x5f5c8ec67a6b in content::RenderWidgetHostViewAura::OnUpdateTextInputStateCalled(content::TextInputManager*, content::RenderWidgetHostViewBase*, bool) content/browser/renderer_host/render_widget_host_view_aura.cc:3431:23
    #7 0x5f5c8ec9be68 in content::TextInputManager::NotifyObserversAboutInputStateUpdate(content::RenderWidgetHostViewBase*, bool) content/browser/renderer_host/text_input_manager.cc:495:14
    #8 0x5f5c8ec9ad17 in content::TextInputManager::UpdateTextInputState(content::RenderWidgetHostViewBase*, ui::mojom::TextInputState const&) content/browser/renderer_host/text_input_manager.cc:268:3
    #9 0x5f5c7e18aa51 in content::RenderWidgetHostViewAuraOnBoundsChangedUAFTest_DestroyDuringOnTextInputTypeChanged_Test::TestBody() content/browser/renderer_host/render_widget_host_view_aura_unittest.cc:7012:10
    #10 0x5f5c8329d10b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #11 0x5f5c832a0277 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #12 0x5f5c832a2373 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #13 0x5f5c832d202a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #14 0x5f5c832d0afe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #15 0x5f5c9316f40c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #16 0x5f5c92c1d075 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23
    #17 0x5f5c92801261 in base::internal::Invoker<base::internal::FunctorTraits<int (content::UnitTestTestSuite::*&&)(), content::UnitTestTestSuite*>, base::internal::BindState<true, true, false, int (content::UnitTestTestSuite::*)(), base::internal::UnretainedWrapper<content::UnitTestTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #18 0x5f5c931c5a94 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #19 0x5f5c931c53bb in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #20 0x5f5c92800dd4 in main content/test/run_all_unittests.cc:17:10
    #21 0x7d678fc2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 here:
    #0 0x5f5c78927151 in operator new(unsigned long) (/chromium/chromium/src/out/asan/content_unittests+0xfb2c151) (BuildId: bd7a00e8d46fee41)
    #1 0x5f5c7e171be9 in content::RenderWidgetHostViewAuraTest::CreateView(bool) ui/aura/window_delegate.h:32:3
    #2 0x5f5c7e1a0ecb in content::RenderWidgetHostViewAuraTest::SetUpEnvironment() content/browser/renderer_host/render_widget_host_view_aura_unittest.cc:605:13
    #3 0x5f5c8329cfa1 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #4 0x5f5c832a0277 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #5 0x5f5c832a2373 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #6 0x5f5c832d202a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #7 0x5f5c832d0afe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x5f5c9316f40c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #9 0x5f5c92c1d075 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23
    #10 0x5f5c92801261 in base::internal::Invoker<base::internal::FunctorTraits<int (content::UnitTestTestSuite::*&&)(), content::UnitTestTestSuite*>, base::internal::BindState<true, true, false, int (content::UnitTestTestSuite::*)(), base::internal::UnretainedWrapper<content::UnitTestTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #11 0x5f5c931c5a94 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #12 0x5f5c931c53bb in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #13 0x5f5c92800dd4 in main content/test/run_all_unittests.cc:17:10
    #14 0x7d678fc2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Shadow bytes around the buggy address:
  0x7b078ddf1900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b078ddf1980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b078ddf1a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b078ddf1a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b078ddf1b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7b078ddf1b80: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd
  0x7b078ddf1c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b078ddf1c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b078ddf1d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b078ddf1d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b078ddf1e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
E0000 00:00:1781395411.344287    4760 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4760==ADDITIONAL INFO
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1781395411.344379    4760 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4760==Note: Please include this section with the ASan report.
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1781395411.344402    4760 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace:
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1781395411.344422    4760 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1781395411.344438    4760 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4760==END OF ADDITIONAL INFO
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1781395411.344456    4760 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==4760==ABORTING
=== Source Location Trace: ===
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

[1/1] RenderWidgetHostViewAuraOnBoundsChangedUAFTest.DestroyDuringOnTextInputTypeChanged (CRASHED)
1 test crashed:
    RenderWidgetHostViewAuraOnBoundsChangedUAFTest.DestroyDuringOnTextInputTypeChanged (../../content/browser/renderer_host/render_widget_host_view_aura_unittest.cc:6985)
Tests took 1 seconds.