IMPORTANT DEBUGGING NOTE: batches of tests are run inside their
own process. For debugging a test inside a debugger, use the
--gtest_filter=<your_test_name> flag along with
--single-process-tests.
Using sharding settings from environment. This is shard 0/1
Using 1 parallel jobs.
Note: Google Test filter = DemuxerConnectorUafTest.DanglingDemuxerOnDisconnect
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from DemuxerConnectorUafTest
[ RUN      ] DemuxerConnectorUafTest.DanglingDemuxerOnDisconnect
=================================================================
==1919==ERROR: AddressSanitizer: heap-use-after-free on address 0x7345e55e3490 at pc 0x615799a704fb bp 0x7fff11428530 sp 0x7fff11428528
READ of size 8 at 0x7345e55e3490 thread T0
    #0 0x615799a704fa in cast_streaming::FrameInjectingDemuxer::OnStreamsInitialized(mojo::StructPtr<cast_streaming::mojom::AudioStreamInitializationInfo>, mojo::StructPtr<cast_streaming::mojom::VideoStreamInitializationInfo>) base/memory/scoped_refptr.h:293:12
    #1 0x615799a6ed21 in cast_streaming::DemuxerConnector::OnStreamsInitialized(mojo::StructPtr<cast_streaming::mojom::AudioStreamInitializationInfo>, mojo::StructPtr<cast_streaming::mojom::VideoStreamInitializationInfo>) components/cast_streaming/renderer/frame/demuxer_connector.cc:115:13
    #2 0x615799a6eb33 in cast_streaming::DemuxerConnector::OnReceiverDisconnected() components/cast_streaming/renderer/frame/demuxer_connector.cc:91:5
    #3 0x615799a6f2c1 in base::internal::Invoker<base::internal::FunctorTraits<void (cast_streaming::DemuxerConnector::*&&)(), cast_streaming::DemuxerConnector*>, base::internal::BindState<true, true, false, void (cast_streaming::DemuxerConnector::*)(), base::internal::UnretainedWrapper<cast_streaming::DemuxerConnector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #4 0x61579b8c17be in mojo::InterfaceEndpointClient::NotifyError(std::__Cr::optional<mojo::DisconnectReason> const&) base/functional/callback.h:155:12
    #5 0x61579b8e8df3 in mojo::internal::MultiplexRouter::ProcessNotifyErrorTask(mojo::internal::MultiplexRouter::Task*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1135:13
    #6 0x61579b8df4cb in mojo::internal::MultiplexRouter::ProcessTasks(mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1043:15
    #7 0x61579b8e50b3 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:835:5
    #8 0x61579b8d6df1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #9 0x61579b8b1715 in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) mojo/public/cpp/bindings/lib/connector.cc:572:49
    #10 0x61579b8b2d9c in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:633:14
    #11 0x61579b8b27f9 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3
    #12 0x61579b8b4644 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12
    #13 0x61579926f69e in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12
    #14 0x61579926f43a in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12
    #15 0x61579b93ff90 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12
    #16 0x61579b93f8b7 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14
    #17 0x61579b940a97 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #18 0x615799c0da83 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #19 0x615799c7d212 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #20 0x615799c7bfba in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:345:40
    #21 0x615799c3d642 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #22 0x615799c7e974 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:657:12
    #23 0x615799bd2960 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #24 0x615799bd4fbc in base::RunLoop::RunUntilIdle() base/run_loop.cc:144:3
    #25 0x61579e7812d7 in base::test::TaskEnvironment::RunUntilIdle() base/test/task_environment.cc:757:51
    #26 0x615799a64f5d in cast_streaming::DemuxerConnectorUafTest_DanglingDemuxerOnDisconnect_Test::TestBody() components/cast_streaming/renderer/frame/demuxer_connector_unittest.cc:75:20
    #27 0x6157994f4e5b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #28 0x6157994f7027 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #29 0x6157994f9123 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #30 0x61579952865a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #31 0x61579952712e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #32 0x61579e7914cc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #33 0x615794ba3d11 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), TestSuiteNoAtExit*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<TestSuiteNoAtExit, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #34 0x61579e79e754 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #35 0x61579e79e07b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #36 0x615794ba39f5 in main media/test/run_all_unittests.cc:52:10
    #37 0x7695e6e95249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7345e55e3490 is located 16 bytes inside of 104-byte region [0x7345e55e3480,0x7345e55e34e8)
freed by thread T0 here:
    #0 0x615794ba2e16 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/cast_streaming_unittests+0x45ffe16) (BuildId: 481f4a12a9ca2037)
    #1 0x615799a64e95 in cast_streaming::DemuxerConnectorUafTest_DanglingDemuxerOnDisconnect_Test::TestBody() third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x6157994f4e5b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x6157994f7027 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x6157994f9123 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x61579952865a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x61579952712e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x61579e7914cc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x615794ba3d11 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), TestSuiteNoAtExit*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<TestSuiteNoAtExit, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x61579e79e754 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x61579e79e07b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x615794ba39f5 in main media/test/run_all_unittests.cc:52:10
    #12 0x7695e6e95249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 here:
    #0 0x615794ba2211 in operator new(unsigned long) (/chromium/chromium/src/out/asan/cast_streaming_unittests+0x45ff211) (BuildId: 481f4a12a9ca2037)
    #1 0x615799a64aad in cast_streaming::DemuxerConnectorUafTest_DanglingDemuxerOnDisconnect_Test::TestBody() third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x6157994f4e5b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x6157994f7027 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x6157994f9123 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x61579952865a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x61579952712e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x61579e7914cc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x615794ba3d11 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), TestSuiteNoAtExit*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<TestSuiteNoAtExit, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x61579e79e754 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x61579e79e07b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x615794ba39f5 in main media/test/run_all_unittests.cc:52:10
    #12 0x7695e6e95249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free base/memory/scoped_refptr.h:293:12 in cast_streaming::FrameInjectingDemuxer::OnStreamsInitialized(mojo::StructPtr<cast_streaming::mojom::AudioStreamInitializationInfo>, mojo::StructPtr<cast_streaming::mojom::VideoStreamInitializationInfo>)
Shadow bytes around the buggy address:
  0x7345e55e3200: fd fd fd fd fd fd fa fa fa fa fa fa fa fa 00 00
  0x7345e55e3280: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
  0x7345e55e3300: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x7345e55e3380: 00 fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00
  0x7345e55e3400: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
=>0x7345e55e3480: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x7345e55e3500: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
  0x7345e55e3580: fd fd fd fd fa fa fa fa fa fa fa fa fd fd fd fd
  0x7345e55e3600: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x7345e55e3680: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x7345e55e3700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==1919==ADDITIONAL INFO

==1919==Note: Please include this section with the ASan report.
Task trace:
    #0 0x61579b940403 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13


==1919==END OF ADDITIONAL INFO

==1919==ABORTING
[1/1] DemuxerConnectorUafTest.DanglingDemuxerOnDisconnect (CRASHED)
1 test crashed:
    DemuxerConnectorUafTest.DanglingDemuxerOnDisconnect (../../components/cast_streaming/renderer/frame/demuxer_connector_unittest.cc:38)
Tests took 0 seconds.