serving on http://127.0.0.1:18767/poc.html [807:807:0614/044942.529377:INFO:CONSOLE:33] "[POC] clicking spin button at (236.8, 36.5)", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044942.586476:INFO:CONSOLE:33] "[POC] input value before click: 5", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.063091:INFO:CONSOLE:33] "[POC] input value after pointerDown: 6 (expected 6)", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.171661:INFO:CONSOLE:33] "[POC] calling fs.moveBefore(legend2, legend1)...", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.171724:INFO:CONSOLE:33] "[POC] change fired. inMoveBefore=true", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.171783:INFO:CONSOLE:33] "[POC] victim.remove() OK", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.171829:INFO:CONSOLE:33] "[POC] victim.parentNode = null", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.171875:INFO:CONSOLE:33] "[POC] victim.isConnected = false", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.171936:INFO:CONSOLE:33] "[POC] victim.contentWindow = [object Window]", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.171983:INFO:CONSOLE:33] "[POC] victim.contentDocument = [object HTMLDocument]", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.172037:INFO:CONSOLE:33] "[POC] *** BUG CONFIRMED: detached iframe still has live contentWindow ***", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.172091:INFO:CONSOLE:33] "[POC] moveBefore returned.", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.172130:INFO:CONSOLE:33] "[POC] changeFiredDuringMove = true", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.172180:INFO:CONSOLE:33] "[POC] detachedButLive = true", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.172223:INFO:CONSOLE:33] "[POC] post-move: victim.isConnected=false contentWindow=[object Window]", source: http://127.0.0.1:18767/poc.html (33) [807:807:0614/044943.172277:INFO:CONSOLE:33] "[POC] [CRASH-EXPECTED] re-appending detached-but-live iframe...", source: http://127.0.0.1:18767/poc.html (33) [925:925:0614/044943.065931:FATAL:third_party/blink/renderer/core/html/html_frame_owner_element.cc:214] Security CHECK failed: !ContentFrame() || GetDocument().StatePreservingAtomicMoveInProgress(). #0 0x59cd2875496a (/chromium/chromium/src/out/asan/chrome+0x11248969) #1 0x59cd4157ba98 (/chromium/chromium/src/out/asan/chrome+0x2a06fa97) #2 0x59cd41538377 (/chromium/chromium/src/out/asan/chrome+0x2a02c376) #3 0x59cd4124157b (/chromium/chromium/src/out/asan/chrome+0x29d3557a) #4 0x59cd41243239 (/chromium/chromium/src/out/asan/chrome+0x29d37238) #5 0x59cd4fa4bb56 (/chromium/chromium/src/out/asan/chrome+0x3853fb55) #6 0x59cd4fd5b20f (/chromium/chromium/src/out/asan/chrome+0x3884f20e) #7 0x59cd4fd4fa3b (/chromium/chromium/src/out/asan/chrome+0x38843a3a) #8 0x59cd52aa7473 (/chromium/chromium/src/out/asan/chrome+0x3b59b472) #9 0x59cd52aa128f (/chromium/chromium/src/out/asan/chrome+0x3b59528e) #10 0x59cd52a9c85e (/chromium/chromium/src/out/asan/chrome+0x3b59085d) #11 0x59cd53b6885c (/chromium/chromium/src/out/asan/chrome+0x3c65c85b) #12 0x59cd33928654 (/chromium/chromium/src/out/asan/chrome+0x1c41c653) Task trace: #0 0x59cd5442e7fd (/chromium/chromium/src/out/asan/chrome+0x3cf227fc) #1 0x59cd42217fc4 (/chromium/chromium/src/out/asan/chrome+0x2ad0bfc3) Crash keys: "view-count" = "1" "loaded-origin-0" = "http://127.0.0.1:18767" "web-frame-count" = "2" "gpu-gl-renderer" = "ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)" "gpu-gl-vendor" = "Google Inc. (Google)" "gpu-generation-intel" = "0" "gpu-vsver" = "3.00" "gpu-psver" = "3.00" "gpu-driver" = "5.0.0" "gpu_count" = "0" "gpu-devid" = "0xffff" "gpu-venid" = "0xffff" "renderer_foreground" = "true" "v8_ro_space_firstpage_address" = "0x6c7e00000000" "v8_isolate_address" = "0x70d676a45000" "reentry_guard_tls_slot" = "unused" "osarch" = "x86_64" "pid" = "925" "ptype" = "renderer" "num-switches" = "26" Received signal 6 #0 0x59cd2875496a (/chromium/chromium/src/out/asan/chrome+0x11248969) #1 0x59cd4157ba98 (/chromium/chromium/src/out/asan/chrome+0x2a06fa97) #2 0x59cd41538377 (/chromium/chromium/src/out/asan/chrome+0x2a02c376) #3 0x59cd4157ae9f (/chromium/chromium/src/out/asan/chrome+0x2a06ee9e) #4 0x71c678840050 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x3c04f) #5 0x71c67888eeec (/usr/lib/x86_64-linux-gnu/libc.so.6+0x8aeeb) #6 0x71c67883ffb2 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x3bfb1) #7 0x71c67882a472 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x26471) #8 0x59cd4150b90a (/chromium/chromium/src/out/asan/chrome+0x29fff909) #9 0x59cd58c869cb (/chromium/chromium/src/out/asan/chrome+0x4177a9ca) #10 0x59cd412430aa (/chromium/chromium/src/out/asan/chrome+0x29d370a9) #11 0x59cd41242d08 (/chromium/chromium/src/out/asan/chrome+0x29d36d07) #12 0x59cd4124217a (/chromium/chromium/src/out/asan/chrome+0x29d36179) #13 0x59cd41243239 (/chromium/chromium/src/out/asan/chrome+0x29d37238) #14 0x59cd4fa4bb56 (/chromium/chromium/src/out/asan/chrome+0x3853fb55) #15 0x59cd4fd5b20f (/chromium/chromium/src/out/asan/chrome+0x3884f20e) #16 0x59cd4fd4fa3b (/chromium/chromium/src/out/asan/chrome+0x38843a3a) #17 0x59cd52aa7473 (/chromium/chromium/src/out/asan/chrome+0x3b59b472) #18 0x59cd52aa128f (/chromium/chromium/src/out/asan/chrome+0x3b59528e) #19 0x59cd52a9c85e (/chromium/chromium/src/out/asan/chrome+0x3b59085d) #20 0x59cd53b6885c (/chromium/chromium/src/out/asan/chrome+0x3c65c85b) #21 0x59cd33928654 (/chromium/chromium/src/out/asan/chrome+0x1c41c653) r8: 000059cd63349ff0 r9: 00007fffffffff01 r10: 0000000000000008 r11: 0000000000000246 r12: 0000000000000006 r13: 00006dc675650e80 r14: 00000db8ceaca1d0 r15: 00006e06769ecfb0 di: 000000000000039d si: 000000000000039d bp: 000071c677757380 bx: 000000000000039d dx: 0000000000000006 ax: 0000000000000000 cx: 000071c67888eeec sp: 00007ffd7a834500 ip: 000071c67888eeec efl: 0000000000000246 cgf: 002b000000000033 erf: 0000000000000000 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000 [end of stack trace] [807:822:0614/045027.682834:ERROR:google_apis/gcm/engine/connection_factory_impl.cc:484] ConnectionHandler failed with net error: -2 [807:807:0614/045027.683854:WARNING:content/common/zygote/zygote_communication_linux.cc:301] Error reading message from zygote: Connection reset by peer (104) [807:807:0614/045027.700160:ERROR:content/common/zygote/zygote_communication_linux.cc:291] Failed to send GetTerminationStatus message to zygote [807:807:0614/045027.700183:WARNING:content/common/zygote/zygote_communication_linux.cc:303] Socket closed prematurely.