==14311==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b42929cd618 at pc 0x7f02f8db442f bp 0x7ffd8fea2050 sp 0x7ffd8fea2048
READ of size 8 at 0x7b42929cd618 thread T0 (chrome)
    #0 0x7f02f8db442e in content::BackForwardCacheImpl::WillCommitNavigationToCachedEntry(content::BackForwardCacheImpl::Entry&, base::OnceCallback<void ()>) gen/third_party/libc++/src/include/__tree:208:12
    #1 0x7f02f8da2a0d in content::BackForwardCacheCommitDeferringCondition::WillCommitNavigation(base::OnceCallback<void ()>) content/browser/renderer_host/back_forward_cache_commit_deferring_condition.cc:65:11
    #2 0x7f02f8e14e8a in content::CommitDeferringConditionRunner::ProcessConditions() content/browser/renderer_host/commit_deferring_condition_runner.cc:219:24
    #3 0x7f02f90ae89e in content::NavigationRequest::RunCommitDeferringConditions(base::OnceCallback<void ()>) content/browser/renderer_host/navigation_request.cc:6507:21
    #4 0x7f02f90e327c in content::NavigationRequest::OnWillProcessResponseChecksComplete(content::NavigationThrottle::ThrottleCheckResult) content/browser/renderer_host/navigation_request.cc:6422:3
    #5 0x7f02f90fa969 in content::NavigationRequest::OnWillProcessResponseProcessed(content::NavigationThrottle::ThrottleCheckResult) content/browser/renderer_host/navigation_request.cc:8351:3
    #6 0x7f02f90f9001 in content::NavigationRequest::OnNavigationEventProcessed(content::NavigationThrottleEvent, content::NavigationThrottle::ThrottleCheckResult) content/browser/renderer_host/navigation_request.cc:8246:7
    #7 0x7f02f915f468 in content::NavigationThrottleRegistryImpl::OnEventProcessed(content::NavigationThrottleEvent, content::NavigationThrottle::ThrottleCheckResult) content/browser/renderer_host/navigation_throttle_registry_impl.cc:321:24
    #8 0x7f02f9164b1d in content::NavigationThrottleRunner::InformRegistry(content::NavigationThrottle::ThrottleCheckResult const&) content/browser/renderer_host/navigation_throttle_runner.cc:249:14
    #9 0x7f02f91637b0 in content::NavigationThrottleRunner::ProcessInternal() content/browser/renderer_host/navigation_throttle_runner.cc:238:3
    #10 0x7f02f9161afa in content::NavigationThrottleRunner::ProcessNavigationEvent(content::NavigationThrottleEvent) content/browser/renderer_host/navigation_throttle_runner.cc:131:3
    #11 0x7f02f915cfdf in content::NavigationThrottleRegistryImpl::ProcessNavigationEvent(content::NavigationThrottleEvent) content/browser/renderer_host/navigation_throttle_registry_impl.cc:219:32
    #12 0x7f02f90d21bd in content::NavigationRequest::WillProcessResponse() content/browser/renderer_host/navigation_request.cc:8617:23
    #13 0x7f02f90cf8c0 in content::NavigationRequest::SelectFrameHostForOnResponseStarted(mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, bool, content::SubresourceLoaderParams) content/browser/renderer_host/navigation_request.cc:5271:3
    #14 0x7f02f9128b70 in void base::internal::DecayedFunctorTraits<void (content::NavigationRequest::*)(mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, bool, content::SubresourceLoaderParams), base::WeakPtr<content::NavigationRequest>&&, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>&&, bool&&, content::SubresourceLoaderParams&&>::Invoke<void (content::NavigationRequest::*)(mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, bool, content::SubresourceLoaderParams), base::WeakPtr<content::NavigationRequest> const&, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, bool, content::SubresourceLoaderParams>(void (content::NavigationRequest::*)(mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, bool, content::SubresourceLoaderParams), base::WeakPtr<content::NavigationRequest> const&, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>&&, bool&&, content::SubresourceLoaderParams&&) base/functional/bind_internal.h:740:12
    #15 0x7f02f9128939 in base::internal::Invoker<base::internal::FunctorTraits<void (content::NavigationRequest::*&&)(mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, bool, content::SubresourceLoaderParams), base::WeakPtr<content::NavigationRequest>&&, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>&&, bool&&, content::SubresourceLoaderParams&&>, base::internal::BindState<true, true, false, void (content::NavigationRequest::*)(mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, bool, content::SubresourceLoaderParams), base::WeakPtr<content::NavigationRequest>, mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, bool, content::SubresourceLoaderParams>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:956:5
    #16 0x7f02f91a1bd4 in content::ProcessSelectionDeferringConditionRunner::ProcessNextCondition() base/functional/callback.h:155:12
    #17 0x7f02f91a1fba in content::ProcessSelectionDeferringConditionRunner::ResumeProcessing() content/browser/renderer_host/process_selection_deferring_condition_runner.cc:78:3
    #18 0x7f02f91a1b17 in content::ProcessSelectionDeferringConditionRunner::ProcessNextCondition() content/browser/renderer_host/process_selection_deferring_condition_runner.cc:70:7
    #19 0x7f02f91a1736 in content::ProcessSelectionDeferringConditionRunner::WillSelectFinalProcess(base::OnceCallback<void ()>) content/browser/renderer_host/process_selection_deferring_condition_runner.cc:50:3
    #20 0x7f02f90cb472 in content::NavigationRequest::OnResponseStarted(mojo::StructPtr<network::mojom::URLLoaderClientEndpoints>, mojo::StructPtr<network::mojom::URLResponseHead>, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>, content::GlobalRequestID, bool, net::NetworkAnonymizationKey, content::SubresourceLoaderParams, content::NavigationURLLoaderDelegate::EarlyHints) content/browser/renderer_host/navigation_request.cc:4957:34
    #21 0x7f02f883f89c in content::CachedNavigationURLLoader::OnResponseStarted() content/browser/loader/cached_navigation_url_loader.cc:35:14
    #22 0x7f02f88404c4 in base::internal::Invoker<base::internal::FunctorTraits<void (content::CachedNavigationURLLoader::*&&)(), base::WeakPtr<content::CachedNavigationURLLoader>&&>, base::internal::BindState<true, true, false, void (content::CachedNavigationURLLoader::*)(), base::WeakPtr<content::CachedNavigationURLLoader>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #23 0x7f0316565892 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #24 0x7f03165e77de in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #25 0x7f03165e67b6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #26 0x7f03167be7a7 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #27 0x7f03167c1f62 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #28 0x7f02cbb1ad3a in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) (BuildId: 6b4f160dbc5397c2f502dc4f08a8cff259917926)

0x7b42929cd618 is located 8 bytes inside of 48-byte region [0x7b42929cd610,0x7b42929cd640)
freed by thread T0 (chrome) here:
    #0 0x5613dffdf842 in operator delete(void*, unsigned long) (/home/sakura/chromium/src/out/asan-release/chrome+0x67e9842) (BuildId: f9c735cdb29002d9)
    #1 0x7f02f935047f in std::__Cr::__tree<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>, std::__Cr::less<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>>, std::__Cr::allocator<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>>>::__tree_deleter::operator()(std::__Cr::__tree_node<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>, void*>*) gen/third_party/libc++/src/include/__new/allocate.h:63:10
    #2 0x7f02f9314316 in content::RenderFrameHostManager::CommitPending(std::__Cr::unique_ptr<content::RenderFrameHostImpl, std::__Cr::default_delete<content::RenderFrameHostImpl>>, std::__Cr::unique_ptr<content::StoredPage, std::__Cr::default_delete<content::StoredPage>>, bool, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) gen/third_party/libc++/src/include/__tree:1361:64
    #3 0x7f02f93129f1 in content::RenderFrameHostManager::CommitPendingIfNecessary(content::RenderFrameHostImpl*, bool, bool, bool, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1093:5
    #4 0x7f02f9311e4e in content::RenderFrameHostManager::DidNavigateFrame(content::RenderFrameHostImpl*, bool, bool, bool, blink::FramePolicy const&, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1038:3
    #5 0x7f02f916977d in content::Navigator::DidNavigate(content::RenderFrameHostImpl*, content::mojom::DidCommitProvisionalLoadParams const&, std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, bool, bool) content/browser/renderer_host/navigator.cc:595:38
    #6 0x7f02f91f61ae in content::RenderFrameHostImpl::DidCommitNavigationInternal(std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitSameDocumentNavigationParams>, base::TimeTicks const&) content/browser/renderer_host/render_frame_host_impl.cc:16454:58
    #7 0x7f02f91f248f in content::RenderFrameHostImpl::DidCommitPageActivation(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>) content/browser/renderer_host/render_frame_host_impl.cc:6474:3
    #8 0x7f02f90f3f6b in content::NavigationRequest::CommitPageActivation() content/browser/renderer_host/navigation_request.cc:7277:25
    #9 0x7f02f90e54c8 in content::NavigationRequest::CommitNavigation() content/browser/renderer_host/navigation_request.cc:6769:5
    #10 0x7f02f91252f4 in base::internal::Invoker<base::internal::FunctorTraits<void (content::NavigationRequest::*&&)(), base::WeakPtr<content::NavigationRequest>&&>, base::internal::BindState<true, true, false, void (content::NavigationRequest::*)(), base::WeakPtr<content::NavigationRequest>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #11 0x7f02f90ead80 in content::NavigationRequest::OnCommitDeferringConditionChecksComplete(content::CommitDeferringCondition::NavigationType, std::__Cr::optional<base::IdType<content::FrameTreeNodeIdTag, int, -1, 1, 0>>) base/functional/callback.h:155:12
    #12 0x7f02f8e15237 in content::CommitDeferringConditionRunner::ProcessConditions() content/browser/renderer_host/commit_deferring_condition_runner.cc:246:14
    #13 0x7f02f8e15dfa in content::CommitDeferringConditionRunner::ResumeProcessing() content/browser/renderer_host/commit_deferring_condition_runner.cc:104:3
    #14 0x7f02f8e184a4 in base::internal::Invoker<base::internal::FunctorTraits<void (content::CommitDeferringConditionRunner::*&&)(), base::WeakPtr<content::CommitDeferringConditionRunner>&&>, base::internal::BindState<true, true, false, void (content::CommitDeferringConditionRunner::*)(), base::WeakPtr<content::CommitDeferringConditionRunner>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #15 0x7f02f8dbe772 in base::internal::Invoker<base::internal::FunctorTraits<content::BackForwardCacheImpl::WillCommitNavigationToCachedEntry(content::BackForwardCacheImpl::Entry&, base::OnceCallback<void ()>)::$_0&&, base::OnceCallback<void ()>&&>, base::internal::BindState<false, false, false, content::BackForwardCacheImpl::WillCommitNavigationToCachedEntry(content::BackForwardCacheImpl::Entry&, base::OnceCallback<void ()>)::$_0, base::OnceCallback<void ()>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/callback.h:155:12
    #16 0x7f03163744c0 in base::(anonymous namespace)::BarrierInfo::Run() base/functional/callback.h:155:12
    #17 0x7f031637486c in base::internal::Invoker<base::internal::FunctorTraits<void (base::(anonymous namespace)::BarrierInfo::* const&)(), std::__Cr::unique_ptr<base::(anonymous namespace)::BarrierInfo, std::__Cr::default_delete<base::(anonymous namespace)::BarrierInfo>> const&>, base::internal::BindState<true, true, false, void (base::(anonymous namespace)::BarrierInfo::*)(), std::__Cr::unique_ptr<base::(anonymous namespace)::BarrierInfo, std::__Cr::default_delete<base::(anonymous namespace)::BarrierInfo>>>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #18 0x7f02f7cf6a2a in mojo::internal::CallbackWithDeleteHelper<void ()>::Run() base/functional/callback.h:155:12
    #19 0x7f02f941de32 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::internal::CallbackWithDeleteHelper<void ()>::*&&)(), mojo::internal::CallbackWithDeleteHelper<void ()>*>, base::internal::BindState<true, true, false, void (mojo::internal::CallbackWithDeleteHelper<void ()>::*)(), base::internal::UnretainedWrapper<mojo::internal::CallbackWithDeleteHelper<void ()>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #20 0x7f02f7cf6ecd in mojo::internal::CallbackWithDeleteHelper<void ()>::~CallbackWithDeleteHelper() base/functional/callback.h:155:12
    #21 0x7f02f7cf6d29 in base::internal::BindState<true, true, false, void (mojo::internal::CallbackWithDeleteHelper<void ()>::*)(), std::__Cr::unique_ptr<mojo::internal::CallbackWithDeleteHelper<void ()>, std::__Cr::default_delete<mojo::internal::CallbackWithDeleteHelper<void ()>>>>::Destroy(base::internal::BindStateBase const*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #22 0x7f02f9197c57 in base::internal::BindState<true, true, false, void (content::PageLifecycleStateManager::*)(mojo::StructPtr<blink::mojom::PageLifecycleState>, base::OnceCallback<void ()>), base::WeakPtr<content::PageLifecycleStateManager>, mojo::StructPtr<blink::mojom::PageLifecycleState>, base::OnceCallback<void ()>>::Destroy(base::internal::BindStateBase const*) base/functional/callback.h:97:27
    #23 0x7f030a9fa29b in blink::mojom::PageBroadcast_SetPageLifecycleState_ForwardToCallback::~PageBroadcast_SetPageLifecycleState_ForwardToCallback() base/functional/callback.h:97:27
    #24 0x7f03171fe03a in mojo::InterfaceEndpointClient::SendMessageWithResponder(mojo::Message*, bool, mojo::InterfaceEndpointClient::SyncSendMode, std::__Cr::unique_ptr<mojo::MessageReceiver, std::__Cr::default_delete<mojo::MessageReceiver>>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #25 0x7f0317a2dd44 in mojo::internal::SendMojoMessage(mojo::MessageReceiverWithResponder&, mojo::Message&, std::__Cr::unique_ptr<mojo::MessageReceiver, std::__Cr::default_delete<mojo::MessageReceiver>>) mojo/public/cpp/bindings/lib/send_message_helper.cc:41:26
    #26 0x7f030a9f2c64 in blink::mojom::PageBroadcastProxy::SetPageLifecycleState(mojo::StructPtr<blink::mojom::PageLifecycleState>, mojo::StructPtr<blink::mojom::PageRestoreParams>, base::OnceCallback<void ()>) gen/third_party/blink/public/mojom/page/page.mojom.cc:668:3
    #27 0x7f02f9192dc9 in content::PageLifecycleStateManager::SendUpdatesToRendererIfNeeded(mojo::StructPtr<blink::mojom::PageRestoreParams>, base::OnceCallback<void ()>) content/browser/renderer_host/page_lifecycle_state_manager.cc:238:57
    #28 0x7f02f9195a80 in content::PageLifecycleStateManager::SetIsLeavingBackForwardCache(base::OnceCallback<void ()>) content/browser/renderer_host/page_lifecycle_state_manager.cc:200:3
    #29 0x7f02f94121cc in content::RenderViewHostImpl::PrepareToLeaveBackForwardCache(base::OnceCallback<void ()>) content/browser/renderer_host/render_view_host_impl.cc:677:34

previously allocated by thread T0 (chrome) here:
    #0 0x5613dffdec3d in operator new(unsigned long) (/home/sakura/chromium/src/out/asan-release/chrome+0x67e8c3d) (BuildId: f9c735cdb29002d9)
    #1 0x7f02f934feee in std::__Cr::pair<std::__Cr::__tree_iterator<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>, std::__Cr::__tree_node<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>, void*>*, long>, bool> std::__Cr::__tree<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>, std::__Cr::less<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>>, std::__Cr::allocator<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>>>::__emplace_unique<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>>(base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>&&)::'lambda'(base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0> const&, base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>&&)::operator()(base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0> const&, base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>&&) const gen/third_party/libc++/src/include/__new/allocate.h:43:28
    #2 0x7f02f934f84a in void absl::functional_internal::InvokeObject<content::RenderFrameHostManager::PrepareForCollectingPage(content::RenderFrameHostImpl*, std::__Cr::set<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>, std::__Cr::less<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>>, std::__Cr::allocator<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>>>*, absl::flat_hash_map<base::IdType<content::SiteInstanceGroupIdTag, int, 0, 1>, std::__Cr::unique_ptr<content::RenderFrameProxyHost, std::__Cr::default_delete<content::RenderFrameProxyHost>>, absl::hash_internal::Hash<base::IdType<content::SiteInstanceGroupIdTag, int, 0, 1>>, std::__Cr::equal_to<base::IdType<content::SiteInstanceGroupIdTag, int, 0, 1>>, std::__Cr::allocator<std::__Cr::pair<base::IdType<content::SiteInstanceGroupIdTag, int, 0, 1> const, std::__Cr::unique_ptr<content::RenderFrameProxyHost, std::__Cr::default_delete<content::RenderFrameProxyHost>>>>>*)::$_0 const&, void, content::RenderFrameHostImpl*>(absl::functional_internal::VoidPtr, absl::functional_internal::ForwardT<content::RenderFrameHostImpl*>::type) gen/third_party/libc++/src/include/__utility/try_key_extraction.h:44:10
    #3 0x7f02f92d1e70 in content::RenderFrameHost::FrameIterationAction absl::functional_internal::InvokeObject<content::RenderFrameHostImpl::ForEachRenderFrameHostImpl(base::FunctionRef<void (content::RenderFrameHostImpl*)>)::$_0 const&, content::RenderFrameHost::FrameIterationAction, content::RenderFrameHostImpl*>(absl::functional_internal::VoidPtr, absl::functional_internal::ForwardT<content::RenderFrameHostImpl*>::type) third_party/abseil-cpp/absl/functional/function_ref.h:165:12
    #4 0x7f02f91c5dee in content::RenderFrameHostImpl::ForEachRenderFrameHostImpl(base::FunctionRef<content::RenderFrameHost::FrameIterationAction (content::RenderFrameHostImpl*)>, bool) third_party/abseil-cpp/absl/functional/function_ref.h:165:12
    #5 0x7f02f91c5c36 in content::RenderFrameHostImpl::ForEachRenderFrameHostImpl(base::FunctionRef<void (content::RenderFrameHostImpl*)>) content/browser/renderer_host/render_frame_host_impl.cc:3392:3
    #6 0x7f02f9318522 in content::RenderFrameHostManager::PrepareForCollectingPage(content::RenderFrameHostImpl*, std::__Cr::set<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>, std::__Cr::less<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>>, std::__Cr::allocator<base::SafeRef<content::RenderViewHostImpl, (base::SafeRefTraits)0>>>*, absl::flat_hash_map<base::IdType<content::SiteInstanceGroupIdTag, int, 0, 1>, std::__Cr::unique_ptr<content::RenderFrameProxyHost, std::__Cr::default_delete<content::RenderFrameProxyHost>>, absl::hash_internal::Hash<base::IdType<content::SiteInstanceGroupIdTag, int, 0, 1>>, std::__Cr::equal_to<base::IdType<content::SiteInstanceGroupIdTag, int, 0, 1>>, std::__Cr::allocator<std::__Cr::pair<base::IdType<content::SiteInstanceGroupIdTag, int, 0, 1> const, std::__Cr::unique_ptr<content::RenderFrameProxyHost, std::__Cr::default_delete<content::RenderFrameProxyHost>>>>>*) content/browser/renderer_host/render_frame_host_manager.cc:1246:27
    #7 0x7f02f9318142 in content::RenderFrameHostManager::CollectPage(std::__Cr::unique_ptr<content::RenderFrameHostImpl, std::__Cr::default_delete<content::RenderFrameHostImpl>>) content/browser/renderer_host/render_frame_host_manager.cc:1320:3
    #8 0x7f02f931ab82 in content::RenderFrameHostManager::UnloadOldFrame(std::__Cr::unique_ptr<content::RenderFrameHostImpl, std::__Cr::default_delete<content::RenderFrameHostImpl>>, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1460:26
    #9 0x7f02f9314cdb in content::RenderFrameHostManager::CommitPending(std::__Cr::unique_ptr<content::RenderFrameHostImpl, std::__Cr::default_delete<content::RenderFrameHostImpl>>, std::__Cr::unique_ptr<content::StoredPage, std::__Cr::default_delete<content::StoredPage>>, bool, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:5552:3
    #10 0x7f02f93129f1 in content::RenderFrameHostManager::CommitPendingIfNecessary(content::RenderFrameHostImpl*, bool, bool, bool, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1093:5
    #11 0x7f02f9311e4e in content::RenderFrameHostManager::DidNavigateFrame(content::RenderFrameHostImpl*, bool, bool, bool, blink::FramePolicy const&, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1038:3
    #12 0x7f02f916977d in content::Navigator::DidNavigate(content::RenderFrameHostImpl*, content::mojom::DidCommitProvisionalLoadParams const&, std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, bool, bool) content/browser/renderer_host/navigator.cc:595:38
    #13 0x7f02f91f61ae in content::RenderFrameHostImpl::DidCommitNavigationInternal(std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitSameDocumentNavigationParams>, base::TimeTicks const&) content/browser/renderer_host/render_frame_host_impl.cc:16454:58
    #14 0x7f02f91f1740 in content::RenderFrameHostImpl::DidCommitNavigation(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>) content/browser/renderer_host/render_frame_host_impl.cc:17347:8
    #15 0x7f02f92c1390 in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, void, 0ul, 1ul>::MakeItSo<void (content::RenderFrameHostImpl::*)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), std::__Cr::tuple<base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>>(void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), std::__Cr::tuple<base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>&&) base/functional/bind_internal.h:740:12
    #16 0x7f02f92c10df in base::internal::Invoker<base::internal::FunctorTraits<void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, base::internal::BindState<true, true, false, void (content::RenderFrameHostImpl::*)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>)>::RunOnce(base::internal::BindStateBase*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>&&) base/functional/bind_internal.h:1069:14
    #17 0x7f02f6b632b9 in content::mojom::NavigationClient_CommitNavigation_ForwardToCallback::Accept(mojo::Message*) base/functional/callback.h:155:12
    #18 0x7f03171f96df in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1079:41
    #19 0x7f031721043b in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #20 0x7f03171fe944 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #21 0x7f03082eebf7 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #22 0x7f03082f0ebd in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #23 0x7f0316565892 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #24 0x7f03165e77de in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #25 0x7f03165e67b6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #26 0x7f03167bf049 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48
    #27 0x7f03165e8e58 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #28 0x7f03164d0cb2 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #29 0x7f02f7cc91c3 in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__tree:208:12 in content::BackForwardCacheImpl::WillCommitNavigationToCachedEntry(content::BackForwardCacheImpl::Entry&, base::OnceCallback<void ()>)
Shadow bytes around the buggy address:
  0x7b42929cd380: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fa
  0x7b42929cd400: f7 fa 00 00 00 00 00 00 f7 fa fd fd fd fd fd fd
  0x7b42929cd480: f7 fa fd fd fd fd fd fd f7 fa 00 00 00 00 00 00
  0x7b42929cd500: f7 fa fd fd fd fd fd fa f7 fa fd fd fd fd fd fd
  0x7b42929cd580: f7 fa fd fd fd fd fd fd f7 fa 00 00 00 00 00 fa
=>0x7b42929cd600: f7 fa fd[fd]fd fd fd fd f7 fa 00 00 00 00 00 00
  0x7b42929cd680: f7 fa fd fd fd fd fd fa f7 fa fd fd fd fd fd fa
  0x7b42929cd700: f7 fa 00 00 00 00 00 00 f7 fa 00 00 00 00 00 00
  0x7b42929cd780: f7 fa fd fd fd fd fd fa f7 fa fd fd fd fd fd fd
  0x7b42929cd800: f7 fa 00 00 00 00 00 fa f7 fa fd fd fd fd fd fd
  0x7b42929cd880: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==14311==ADDITIONAL INFO

==14311==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7f02f883fe3c in content::CachedNavigationURLLoader::Start() content/browser/loader/cached_navigation_url_loader.cc:72:11
    #1 0x7f03082e3eb8 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13
    #2 0x7f0316de584a in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13


Command line: `out/asan-release/chrome --disable-gpu --user-data-dir=/tmp/poc-asanlog-1776134032 --flag-switches-begin --flag-switches-end --ozone-platform=x11 http://localhost:8765/page1.html`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==14311==END OF ADDITIONAL INFO

==14311==ABORTING
[14378:14378:0100/000000.575103:ERROR:ui/gfx/x/connection.cc:66] X connection error received.