Note: Google Test filter = WindowTest.ScopedCursorHiderCursorClientFreedDuringGetDisplay
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from WindowTest
[ RUN      ] WindowTest.ScopedCursorHiderCursorClientFreedDuringGetDisplay
=================================================================
==2443==ERROR: AddressSanitizer: heap-use-after-free on address 0x7a5d4dde5520 at pc 0x5a5d0fd50761 bp 0x7ffe8a37e2f0 sp 0x7ffe8a37e2e8
READ of size 8 at 0x7a5d4dde5520 thread T0
    #0 0x5a5d0fd50760 in aura::Window::OnDeviceScaleFactorChanged(float, float) ui/aura/window.cc:191:24
    #1 0x5a5d09801ebd in aura::test::(anonymous namespace)::WindowTest_ScopedCursorHiderCursorClientFreedDuringGetDisplay_Test::TestBody() ui/aura/window_unittest.cc:4616:18
    #2 0x5a5d0ef3f4db in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x5a5d0ef42137 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x5a5d0ef44233 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x5a5d0ef7376a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x5a5d0ef7223e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x5a5d0f51811c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x5a5d09629625 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), AuraTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<AuraTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x5a5d0f51ff04 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x5a5d0f51f82f in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x5a5d09628c38 in main ui/aura/test/run_all_unittests.cc:77:10
    #12 0x7ddd4f445249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 93ac61ec5a8eb1396f9fbd350e3169a558528a40)

0x7a5d4dde5520 is located 0 bytes inside of 88-byte region [0x7a5d4dde5520,0x7a5d4dde5578)
freed by thread T0 here:
    #0 0x5a5d094f3916 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/aura_unittests+0x5019916) (BuildId: ea40684689c15ef1)
    #1 0x5a5d0980398f in base::internal::BindLambdaForTestingHelper<aura::test::(anonymous namespace)::WindowTest_ScopedCursorHiderCursorClientFreedDuringGetDisplay_Test::TestBody()::$_0, void ()>::Run(aura::test::(anonymous namespace)::WindowTest_ScopedCursorHiderCursorClientFreedDuringGetDisplay_Test::TestBody()::$_0 const&) ui/aura/window_unittest.cc:4609:7
    #2 0x5a5d09803b00 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(aura::test::(anonymous namespace)::WindowTest_ScopedCursorHiderCursorClientFreedDuringGetDisplay_Test::TestBody()::$_0 const&), aura::test::(anonymous namespace)::WindowTest_ScopedCursorHiderCursorClientFreedDuringGetDisplay_Test::TestBody()::$_0 const&>, base::internal::BindState<false, true, false, void (*)(aura::test::(anonymous namespace)::WindowTest_ScopedCursorHiderCursorClientFreedDuringGetDisplay_Test::TestBody()::$_0 const&), aura::test::(anonymous namespace)::WindowTest_ScopedCursorHiderCursorClientFreedDuringGetDisplay_Test::TestBody()::$_0>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #3 0x5a5d0980476f in base::RepeatingCallback<void ()>::Run() const & base/functional/callback.h:346:12
    #4 0x5a5d09804211 in aura::test::(anonymous namespace)::ReentrantDisplayScreen::GetDisplayNearestWindow(aura::Window*) const ui/aura/window_unittest.cc:4548:21
    #5 0x5a5d0fd504be in aura::Window::OnDeviceScaleFactorChanged(float, float) ui/aura/window.cc:190:37
    #6 0x5a5d09801ebd in aura::test::(anonymous namespace)::WindowTest_ScopedCursorHiderCursorClientFreedDuringGetDisplay_Test::TestBody() ui/aura/window_unittest.cc:4616:18
    #7 0x5a5d0ef3f4db in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x5a5d0ef42137 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #9 0x5a5d0ef44233 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #10 0x5a5d0ef7376a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #11 0x5a5d0ef7223e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #12 0x5a5d0f51811c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #13 0x5a5d09629625 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), AuraTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<AuraTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #14 0x5a5d0f51ff04 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #15 0x5a5d0f51f82f in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #16 0x5a5d09628c38 in main ui/aura/test/run_all_unittests.cc:77:10
    #17 0x7ddd4f445249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 93ac61ec5a8eb1396f9fbd350e3169a558528a40)

previously allocated by thread T0 here:
    #0 0x5a5d094f2cc1 in operator new(unsigned long) (/chromium/chromium/src/out/asan/aura_unittests+0x5018cc1) (BuildId: ea40684689c15ef1)
    #1 0x5a5d098018e1 in aura::test::(anonymous namespace)::WindowTest_ScopedCursorHiderCursorClientFreedDuringGetDisplay_Test::TestBody() ui/aura/window_unittest.cc:4589:25
    #2 0x5a5d0ef3f4db in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x5a5d0ef42137 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x5a5d0ef44233 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x5a5d0ef7376a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x5a5d0ef7223e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x5a5d0f51811c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x5a5d09629625 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), AuraTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<AuraTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x5a5d0f51ff04 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x5a5d0f51f82f in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x5a5d09628c38 in main ui/aura/test/run_all_unittests.cc:77:10
    #12 0x7ddd4f445249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 93ac61ec5a8eb1396f9fbd350e3169a558528a40)

SUMMARY: AddressSanitizer: heap-use-after-free ui/aura/window.cc:191:24 in aura::Window::OnDeviceScaleFactorChanged(float, float)
Shadow bytes around the buggy address:
  0x7a5d4dde5280: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7a5d4dde5300: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x7a5d4dde5380: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x7a5d4dde5400: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x7a5d4dde5480: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7a5d4dde5500: fa fa fa fa[fd]fd fd fd fd fd fd fd fd fd fd fa
  0x7a5d4dde5580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7a5d4dde5600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7a5d4dde5680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7a5d4dde5700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7a5d4dde5780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2443==ADDITIONAL INFO

==2443==Note: Please include this section with the ASan report.
Task trace:


==2443==END OF ADDITIONAL INFO

==2443==ABORTING