=================================================================
==2161==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c15185fed60 at pc 0x55fa20fc1c8d bp 0x7fff2be13df0 sp 0x7fff2be13de8
READ of size 8 at 0x7c15185fed60 thread T0 (chrome)
    #0 0x55fa20fc1c8c in blink::SegmentedBuffer::Iterator::operator++() third_party/blink/renderer/platform/wtf/vector.h:479:36
    #1 0x55fa29ff7ad1 in blink::DocumentLoader::ProcessDataBuffer(blink::DocumentLoader::BodyData*) third_party/blink/renderer/core/loader/document_loader.cc:1901:25
    #2 0x55fa2a016e15 in blink::DocumentLoader::ResumeParser() third_party/blink/renderer/core/loader/document_loader.cc:3394:3
    #3 0x55fa28956b0b in blink::WebFrameWidgetImpl::Resize(gfx::Size const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:2630:9
    #4 0x55fa2894ff07 in blink::WebFrameWidgetImpl::ApplyVisualPropertiesSizing(blink::VisualProperties const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:2015:5
    #5 0x55fa2894e0c4 in blink::WebFrameWidgetImpl::UpdateVisualProperties(blink::VisualProperties const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:1863:3
    #6 0x55fa2b9b0bdc in blink::WidgetBase::UpdateVisualProperties(blink::VisualProperties const&) third_party/blink/renderer/platform/widget/widget_base.cc:551:12
    #7 0x55fa131f0525 in blink::mojom::blink::WidgetStubDispatch::Accept(blink::mojom::blink::Widget*, mojo::Message*) gen/third_party/blink/public/mojom/widget/platform_widget.mojom-blink.cc:2346:13
    #8 0x55fa1ab8c069 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #9 0x55fa1aba9ef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #10 0x55fa1ab92513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #11 0x55fa1eab27dd in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #12 0x55fa1eab4c65 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #13 0x55fa1adcc326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #14 0x55fa1ae439c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #15 0x55fa1ae4283a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #16 0x55fa1ac8a927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #17 0x55fa1ae450d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #18 0x55fa1ad46ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #19 0x55fa270d01fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #20 0x55fa168e46ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #21 0x55fa168e5a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #22 0x55fa168e8728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #23 0x55fa168e2101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #24 0x55fa168e26fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #25 0x55fa02e17b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #26 0x7f151a42b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7c15185fed60 is located 32 bytes inside of 192-byte region [0x7c15185fed40,0x7c15185fee00)
freed by thread T0 (chrome) here:
    #0 0x55fa02ddd086 in free (/chromium/chromium/src/out/asan/chrome+0x10dcf086) (BuildId: 69f7faa6b4074eb6)
    #1 0x55fa20fc5636 in blink::Vector<blink::SegmentedBuffer::Segment, 0u, blink::PartitionAllocator>::ReallocateBuffer(unsigned int) third_party/blink/renderer/platform/wtf/allocator/partition_allocator.h:45:50
    #2 0x55fa20fc2124 in blink::SegmentedBuffer::Append(blink::Vector<char, 0u, blink::PartitionAllocator>&&) third_party/blink/renderer/platform/wtf/vector.h:2258:5
    #3 0x55fa20fc1e2f in blink::SegmentedBuffer::Append(base::span<char const, 18446744073709551615ul, char const*>) third_party/blink/renderer/platform/wtf/shared_buffer.cc:73:3
    #4 0x55fa29ff798d in blink::DocumentLoader::ProcessDataBuffer(blink::DocumentLoader::BodyData*) third_party/blink/renderer/core/loader/document_loader.cc:1890:13
    #5 0x55fa29ff629e in blink::DocumentLoader::BodyDataReceivedImpl(blink::DocumentLoader::BodyData&) third_party/blink/renderer/core/loader/document_loader.cc:1339:3
    #6 0x55fa29ff6719 in non-virtual thunk to blink::DocumentLoader::BodyDataReceived(base::span<char const, 18446744073709551615ul, char const*>) third_party/blink/renderer/core/loader/document_loader.cc:1285:3
    #7 0x55fa137f2bb9 in blink::NavigationBodyLoader::MainThreadBodyReader::DataReceived(base::span<char const, 18446744073709551615ul, char const*>) third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:346:23
    #8 0x55fa137ead8f in blink::(anonymous namespace)::ReadFromDataPipeImpl(blink::(anonymous namespace)::BodyReader&, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>&, mojo::SimpleWatcher&) third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:147:17
    #9 0x55fa137ea693 in blink::NavigationBodyLoader::ReadFromDataPipe() third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:548:3
    #10 0x55fa137e5afb in blink::NavigationBodyLoader::OnReadable(unsigned int) third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:507:3
    #11 0x55fa2873321f in blink::LocalFrame::SetContextPaused(bool) third_party/blink/renderer/core/frame/local_frame.cc:3075:12
    #12 0x55fa28731e37 in blink::LocalFrame::OnPageLifecycleStateUpdated() third_party/blink/renderer/core/frame/local_frame.cc:3043:3
    #13 0x55fa2a41a145 in blink::Page::SetPaused(bool) third_party/blink/renderer/core/page/page.cc:731:20
    #14 0x55fa2a486639 in blink::ScopedPagePauser::~ScopedPagePauser() third_party/blink/renderer/core/page/scoped_page_pauser.cc:69:11
    #15 0x55fa2a2b2847 in blink::ChromeClient::OpenJavaScriptAlert(blink::LocalFrame*, blink::String const&) third_party/blink/renderer/core/page/chrome_client.cc:117:1
    #16 0x55fa2d204675 in blink::(anonymous namespace)::v8_window::AlertOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_window.cc:15314:17
    #17 0x55fa0dd276e3 in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc
    #18 0x55fa0dd25902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc
    #19 0x55fa0dd2269b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc
    #20 0x55fa0dd223ea in Builtins_JSEntry setup-isolate-deserialize.cc
    #21 0x55fa08f787ad in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12
    #22 0x55fa08f7af54 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) v8/src/execution/execution.cc:574:10
    #23 0x55fa08af4228 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) v8/src/api/api.cc:2042:7
    #24 0x55fa27239b0d in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local<v8::Script>, v8::Local<v8::Data>, blink::ExecutionContext*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:509:22
    #25 0x55fa2723b496 in blink::V8ScriptRunner::CompileAndRunScript(blink::ScriptState*, blink::ClassicScript*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:633:22
    #26 0x55fa2a8ad822 in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/core/script/classic_script.cc:227:10
    #27 0x55fa2a910657 in blink::Script::RunScriptOnScriptState(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/core/script/script.cc:35:17
    #28 0x55fa2a910a8b in blink::Script::RunScript(blink::LocalDOMWindow*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption) third_party/blink/renderer/core/script/script.cc:42:3
    #29 0x55fa2a92c276 in blink::PendingScript::ExecuteScriptBlockInternal(blink::Script*, blink::ScriptElementBase*, bool, bool, bool, base::TimeTicks, bool) third_party/blink/renderer/core/script/pending_script.cc:312:13

previously allocated by thread T0 (chrome) here:
    #0 0x55fa02ddd324 in malloc (/chromium/chromium/src/out/asan/chrome+0x10dcf324) (BuildId: 69f7faa6b4074eb6)
    #1 0x55fa1b05edb3 in void* partition_alloc::PartitionRoot::Alloc<(partition_alloc::internal::AllocFlags)0>(unsigned long, char const*) base/allocator/partition_allocator/src/partition_alloc/partition_root.h:2208:56
    #2 0x55fa20fc516a in blink::Vector<blink::SegmentedBuffer::Segment, 0u, blink::PartitionAllocator>::ReallocateBuffer(unsigned int) third_party/blink/renderer/platform/wtf/allocator/partition_allocator.h:42:9
    #3 0x55fa20fc2124 in blink::SegmentedBuffer::Append(blink::Vector<char, 0u, blink::PartitionAllocator>&&) third_party/blink/renderer/platform/wtf/vector.h:2258:5
    #4 0x55fa20fc1e2f in blink::SegmentedBuffer::Append(base::span<char const, 18446744073709551615ul, char const*>) third_party/blink/renderer/platform/wtf/shared_buffer.cc:73:3
    #5 0x55fa29ff798d in blink::DocumentLoader::ProcessDataBuffer(blink::DocumentLoader::BodyData*) third_party/blink/renderer/core/loader/document_loader.cc:1890:13
    #6 0x55fa29ff629e in blink::DocumentLoader::BodyDataReceivedImpl(blink::DocumentLoader::BodyData&) third_party/blink/renderer/core/loader/document_loader.cc:1339:3
    #7 0x55fa29ff6719 in non-virtual thunk to blink::DocumentLoader::BodyDataReceived(base::span<char const, 18446744073709551615ul, char const*>) third_party/blink/renderer/core/loader/document_loader.cc:1285:3
    #8 0x55fa137f2bb9 in blink::NavigationBodyLoader::MainThreadBodyReader::DataReceived(base::span<char const, 18446744073709551615ul, char const*>) third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:346:23
    #9 0x55fa137ead8f in blink::(anonymous namespace)::ReadFromDataPipeImpl(blink::(anonymous namespace)::BodyReader&, mojo::ScopedHandleBase<mojo::DataPipeConsumerHandle>&, mojo::SimpleWatcher&) third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:147:17
    #10 0x55fa137ea693 in blink::NavigationBodyLoader::ReadFromDataPipe() third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:548:3
    #11 0x55fa137e5afb in blink::NavigationBodyLoader::OnReadable(unsigned int) third_party/blink/renderer/platform/loader/fetch/url_loader/navigation_body_loader.cc:507:3
    #12 0x55fa28956ad6 in blink::WebFrameWidgetImpl::Resize(gfx::Size const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:2629:9
    #13 0x55fa2894ff07 in blink::WebFrameWidgetImpl::ApplyVisualPropertiesSizing(blink::VisualProperties const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:2015:5
    #14 0x55fa2894e0c4 in blink::WebFrameWidgetImpl::UpdateVisualProperties(blink::VisualProperties const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:1863:3
    #15 0x55fa2b9b0bdc in blink::WidgetBase::UpdateVisualProperties(blink::VisualProperties const&) third_party/blink/renderer/platform/widget/widget_base.cc:551:12
    #16 0x55fa131f0525 in blink::mojom::blink::WidgetStubDispatch::Accept(blink::mojom::blink::Widget*, mojo::Message*) gen/third_party/blink/public/mojom/widget/platform_widget.mojom-blink.cc:2346:13
    #17 0x55fa1ab8c069 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #18 0x55fa1aba9ef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #19 0x55fa1ab92513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #20 0x55fa1eab27dd in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #21 0x55fa1eab4c65 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #22 0x55fa1adcc326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #23 0x55fa1ae439c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #24 0x55fa1ae4283a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #25 0x55fa1ac8a927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #26 0x55fa1ae450d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #27 0x55fa1ad46ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #28 0x55fa270d01fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #29 0x55fa168e46ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14

SUMMARY: AddressSanitizer: heap-use-after-free third_party/blink/renderer/platform/wtf/vector.h:479:36 in blink::SegmentedBuffer::Iterator::operator++()
Shadow bytes around the buggy address:
  0x7c15185fea80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c15185feb00: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 00
  0x7c15185feb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa
  0x7c15185fec00: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 00
  0x7c15185fec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7c15185fed00: fa fa fa fa fa fa f7 fa fd fd fd fd[fd]fd fd fd
  0x7c15185fed80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c15185fee00: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 00
  0x7c15185fee80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c15185fef00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c15185fef80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2161==ADDITIONAL INFO

==2161==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55fa1eaabdf7 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=2084 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1775447330840308 --launch-time-ticks=13367622709 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,13057944927381260641,203225777910896943,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,8397555697015455767,14792909497603879421,4 --trace-process-track-uuid=3190708991934122588`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==2161==END OF ADDITIONAL INFO

==2161==ABORTING