# BFCache Commit Deferring Condition Reentrant UAF

## Environment

- Tested commit: `123ee915f2e081733b59fad9eeb7c59e899597c4`
- Platform: Linux x86_64
- Build: `out/asan-release` (ASAN-enabled release build)

## Steps

1. Apply the renderer patch (simulates a compromised renderer closing the PageBroadcast associated receiver upon BFCache entry):

```
cd ~/chromium/src
git apply issue_bfcache_commit_defer_uaf/patch.diff
```

2. Build:

```
autoninja -C out/asan-release chrome
```

3. Start the HTTP server:

```
cd ~/chromium/src
python3 issue_bfcache_commit_defer_uaf/server.py &
```

4. Launch Chrome:

```
ASAN_OPTIONS=detect_odr_violation=0 xvfb-run -a out/asan-release/chrome \
  --user-data-dir=/tmp/poc-bfcache-uaf \
  http://localhost:8765/page1.html
```

5. The browser process crashes within approximately 4 seconds with a heap-use-after-free in `BackForwardCacheImpl::WillCommitNavigationToCachedEntry`. No user interaction is required.

6. Clean up:

```
cd ~/chromium/src
git checkout -- .
kill %1
```