CVE-2025-11756
Overview
Background
- `RendererURLLoaderThrottle`
- Safe Browsing’s renderer-side
blink::URLLoaderThrottlethat observes subresource loads (start, redirect) and, in extension-enabled builds, reports extension-initiated web requests to the browser for telemetry. - `ExtensionWebRequestReporter`
- a Mojo interface (
mojom::ExtensionWebRequestReporter) withSendWebRequestDataandClone, used by the throttle to send extension web-request data to the browser process. - `URLLoaderThrottleProviderImpl`
- the per-context renderer object in
chrome/renderer/url_loader_throttle_provider_impl.ccthat creates throttles and, before the fix, owned the bound reporter remote whose proxy pointer it handed to each throttle. - `mojo::Remote` / `mojo::PendingRemote`
- an owned, sequence-bound Mojo endpoint versus an unbound endpoint that can be moved to and bound on another sequence; calls on a remote whose pipe is closed are dropped instead of touching freed memory.
Root Cause Analysis
Before the patch, URLLoaderThrottleProviderImpl bound its own extension_web_request_reporter_ remote and passed extension_web_request_reporter_.get() — a raw interface pointer owned by the provider — into each RendererURLLoaderThrottle, which stored it in a raw_ptr<mojom::ExtensionWebRequestReporter, DanglingUntriaged>. The throttle’s lifetime is tied to the in-flight request, not to the provider, so when the provider was torn down (the commit cites a frame navigating away) while a throttled request was still pending, the throttle kept a dangling pointer. The redirect path (the code following BindExtensionWebRequestReporterPipeIfDetached() that sends redirect data when origin_extension_id_ is non-empty) and the removed detach code (extension_web_request_reporter_->Clone(...)) both dereferenced that raw pointer, yielding a use-after-free.
The fix changes the constructor to take a mojo::PendingRemote<mojom::ExtensionWebRequestReporter>, stores it in an owned mojo::Remote, and on detach simply Unbind()s it into pending_extension_web_request_reporter_ for rebinding on the new sequence; the throttle therefore owns its own pipe, and provider destruction only closes the pipe so later calls are dropped. The provider side now passes CloneExtensionWebRequestReporterPendingRemote(), but that helper’s definition (and the provider-side mojo::Receiver the commit message describes) is not included in the shown diff, so its implementation cannot be verified here.
mojo::Remote built from a cloned PendingRemote, replacing borrowed-object lifetime with Mojo connection lifetime.Attack Path
- Extension-initiated request
A subresource request whose initiator is an extension origin is created in an extensions-enabled build, so
RendererURLLoaderThrottlerecords a non-emptyorigin_extension_id_(the regression test uses achrome-extension://initiator). - Provider teardown while request is in flight
The
URLLoaderThrottleProviderImplthat owns the reporter remote is destroyed (e.g., the owning frame navigates away or is removed) while the throttled request is still pending, freeing the object behind the throttle’s raw pointer. - Redirect or detach callback
The request then receives a redirect (
WillRedirectRequest) or the throttle is detached to another sequence, and the pre-patch code calls through the danglingextension_web_request_reporter_pointer. - Use-after-free in the renderer The virtual call through freed memory crashes or, if the freed slot has been reallocated with controlled data, could redirect control flow within the renderer (inferred).
Impact Assessment
BUILDFLAG(ENABLE_EXTENSIONS) builds (desktop Chrome) and only on the extension-reporting path, which requires a request initiated by an extension plus a timing race between provider destruction and a redirect/detach of an in-flight request; ordinary web content alone does not obviously control the extension-initiator precondition, though whether a page can influence the redirect timing for such a request is not shown by the diff. Exploitation would at most yield memory corruption / code execution inside the renderer sandbox (inferred), and a full compromise would need a separate sandbox escape (inferred). The vendor rates it High severity; the provided metadata does not state in-the-wild exploitation.Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/renderer/url_loader_throttle_provider_impl.cc |
modified | |
extension_web_request_reporter_components/safe_browsing/content/renderer/renderer_url_loader_throttle.cc |
modified | |
ifcomponents/safe_browsing/content/renderer/renderer_url_loader_throttle.cc |
modified | |
BindExtensionWebRequestReporterPipeIfDetachedcomponents/safe_browsing/content/renderer/renderer_url_loader_throttle.cc |
modified | |
MockExtensionWebRequestReportercomponents/safe_browsing/content/renderer/renderer_url_loader_throttle_unittest.cc |
modified |
Files Changed
chrome/renderer/url_loader_throttle_provider_impl.cccomponents/safe_browsing/content/renderer/renderer_url_loader_throttle.cccomponents/safe_browsing/content/renderer/renderer_url_loader_throttle.hcomponents/safe_browsing/content/renderer/renderer_url_loader_throttle_unittest.cc
Audit Directions
- Raw pointers to Mojo proxies across lifetimesSearch for
raw_ptr<mojom::...>members (especially those taggedDanglingUntriaged) populated from another object’smojo::Remote::get(); any holder that can outlive the remote’s owner is a UAF candidate and should own a clonedPendingRemoteinstead. - Throttles and loaders outliving their provider/frameReview other
URLLoaderThrottleimplementations and throttle providers that hand borrowed pointers (to Safe Browsing, extension, or telemetry services) into throttles, since throttles survive frame navigation and run redirect/response callbacks later. - Sequence-migration (`DetachFromCurrentSequence`) pathsCheck detach/rebind logic in throttles for calls made on borrowed pointers during detach, and confirm that all state used after rebinding is owned by the throttle rather than by the creating-thread object.
Patch
From 8fee64979a32f85b4107f8e53e802f3ae782c6a1 Mon Sep 17 00:00:00 2001
From: Anunoy Ghosh <anunoy@chromium.org>
Date: Fri, 03 Oct 2025 14:06:47 -0700
Subject: [PATCH] safe_browsing: Fix UAF in RendererURLLoaderThrottle
A race condition could cause a Use-After-Free in the renderer when a
resource load was redirected.
The RendererURLLoaderThrottle held a raw_ptr to the
ExtensionWebRequestReporter. This reporter is owned by the
URLLoaderThrottleProviderImpl. If the provider was destroyed (e.g., due
to a frame navigating away) while a throttled request was in flight, the
reporter would be freed.
If the request then received a redirect, the throttle's
WillRedirectRequest method would attempt to dereference the dangling
pointer to the reporter, causing a crash.
This change fixes the UAF by replacing the raw_ptr with a
mojo::Remote<ExtensionWebRequestReporter>. The provider now holds a
mojo::Receiver for the reporter and clones a mojo::PendingRemote to pass
to the throttle. This leverages Mojo's connection-based lifetime
management. If the provider is destroyed, the pipe is closed, and any
subsequent calls on the throttle's remote are safely dropped.
To handle cases where the URLLoaderThrottle is used on a different
thread from where it was created, the PendingRemote is unbound from its
original thread and rebound on the thread where the throttle's methods
are invoked. This ensures that the mojo::Remote is bound to the correct
sequence.
A unit test was added to simulate the race condition by destroying the
reporter after a redirect is initiated, verifying that the crash no
longer occurs.
Bug: 447192722
Change-Id: Ie786b5520c10af6c9de8880be66239531c91bd32
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6997254
Reviewed-by: Ted Choc <tedchoc@chromium.org>
Commit-Queue: Anunoy Ghosh <anunoy@chromium.org>
Reviewed-by: Daniel Rubery <drubery@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1525014}
---
diff --git a/chrome/renderer/url_loader_throttle_provider_impl.cc b/chrome/renderer/url_loader_throttle_provider_impl.cc
index bda422a5..a1cde80 100644
--- a/chrome/renderer/url_loader_throttle_provider_impl.cc
+++ b/chrome/renderer/url_loader_throttle_provider_impl.cc
@@ -207,14 +207,9 @@
safe_browsing_.Bind(std::move(pending_safe_browsing_));
}
#if BUILDFLAG(ENABLE_EXTENSIONS)
- if (pending_extension_web_request_reporter_) {
- extension_web_request_reporter_.Bind(
- std::move(pending_extension_web_request_reporter_));
- }
-
auto throttle = std::make_unique<safe_browsing::RendererURLLoaderThrottle>(
safe_browsing_.get(), local_frame_token,
- extension_web_request_reporter_.get());
+ CloneExtensionWebRequestReporterPendingRemote());
#else
auto throttle = std::make_unique<safe_browsing::RendererURLLoaderThrottle>(
safe_browsing_.get(), local_frame_token);
diff --git a/components/safe_browsing/content/renderer/renderer_url_loader_throttle.cc b/components/safe_browsing/content/renderer/renderer_url_loader_throttle.cc
index 6358518..cfa31c3a 100644
--- a/components/safe_browsing/content/renderer/renderer_url_loader_throttle.cc
+++ b/components/safe_browsing/content/renderer/renderer_url_loader_throttle.cc
@@ -47,10 +47,12 @@
RendererURLLoaderThrottle::RendererURLLoaderThrottle(
mojom::SafeBrowsing* safe_browsing,
base::optional_ref<const blink::LocalFrameToken> local_frame_token,
- mojom::ExtensionWebRequestReporter* extension_web_request_reporter)
+ mojo::PendingRemote<mojom::ExtensionWebRequestReporter>
+ extension_web_request_reporter)
: safe_browsing_(safe_browsing),
frame_token_(local_frame_token.CopyAsOptional()),
- extension_web_request_reporter_(extension_web_request_reporter) {}
+ extension_web_request_reporter_(
+ std::move(extension_web_request_reporter)) {}
#endif // BUILDFLAG(ENABLE_EXTENSIONS)
RendererURLLoaderThrottle::~RendererURLLoaderThrottle() {
@@ -67,12 +69,12 @@
safe_browsing_ = nullptr;
#if BUILDFLAG(ENABLE_EXTENSIONS)
- // Create a new pipe to the ExtensionWebRequestReporter interface that can be
- // bound to a different sequence.
- extension_web_request_reporter_->Clone(
- extension_web_request_reporter_pending_remote_
- .InitWithNewPipeAndPassReceiver());
- extension_web_request_reporter_ = nullptr;
+ // Pass the pipe to the ExtensionWebRequestReporter interface to be bound to
+ // a different sequence.
+ if (extension_web_request_reporter_) {
+ pending_extension_web_request_reporter_ =
+ extension_web_request_reporter_.Unbind();
+ }
#endif // BUILDFLAG(ENABLE_EXTENSIONS)
}
@@ -112,7 +114,6 @@
#if BUILDFLAG(ENABLE_EXTENSIONS)
BindExtensionWebRequestReporterPipeIfDetached();
-
// Send redirected request data to the browser if request originated from an
// extension and the redirected url is HTTP/HTTPS scheme only.
if (!origin_extension_id_.empty() &&
@@ -218,18 +219,15 @@
#if BUILDFLAG(ENABLE_EXTENSIONS)
void RendererURLLoaderThrottle::
BindExtensionWebRequestReporterPipeIfDetached() {
- if (extension_web_request_reporter_pending_remote_.is_valid()) {
- extension_web_request_reporter_remote_.Bind(
- std::move(extension_web_request_reporter_pending_remote_));
- extension_web_request_reporter_ =
- extension_web_request_reporter_remote_.get();
+ if (pending_extension_web_request_reporter_) {
+ extension_web_request_reporter_.Bind(
+ std::move(pending_extension_web_request_reporter_));
}
}
void RendererURLLoaderThrottle::MaybeSendExtensionWebRequestData(
network::ResourceRequest* request) {
BindExtensionWebRequestReporterPipeIfDetached();
-
// Skip if request destination isn't HTTP/HTTPS (ex. extension scheme).
if (!request->url.SchemeIsHTTPOrHTTPS()) {
return;
diff --git a/components/safe_browsing/content/renderer/renderer_url_loader_throttle.h b/components/safe_browsing/content/renderer/renderer_url_loader_throttle.h
index 0d1b00a..9e05302 100644
--- a/components/safe_browsing/content/renderer/renderer_url_loader_throttle.h
+++ b/components/safe_browsing/content/renderer/renderer_url_loader_throttle.h
@@ -39,12 +39,13 @@
mojom::SafeBrowsing* safe_browsing,
base::optional_ref<const blink::LocalFrameToken> local_frame_token);
#if BUILDFLAG(ENABLE_EXTENSIONS)
- // |extension_web_request_reporter_pending_remote| is used for sending
+ // |extension_web_request_reporter| is used for sending
// extension web requests to the browser.
RendererURLLoaderThrottle(
mojom::SafeBrowsing* safe_browsing,
base::optional_ref<const blink::LocalFrameToken> local_frame_token,
- mojom::ExtensionWebRequestReporter* extension_web_request_reporter);
+ mojo::PendingRemote<mojom::ExtensionWebRequestReporter>
+ extension_web_request_reporter);
#endif // BUILDFLAG(ENABLE_EXTENSIONS)
~RendererURLLoaderThrottle() override;
@@ -57,6 +58,8 @@
DoesNotDeferChromeUrl);
FRIEND_TEST_ALL_PREFIXES(SBRendererUrlLoaderThrottleTest,
DoesNotDeferIframeUrl);
+ FRIEND_TEST_ALL_PREFIXES(SBRendererUrlLoaderThrottleTest,
+ WillRedirectRequest_ProviderDestroyed_NoCrash);
// blink::URLLoaderThrottle implementation.
void DetachFromCurrentSequence() override;
@@ -108,12 +111,10 @@
// originated from an extension and destination is HTTP/HTTPS scheme only.
void MaybeSendExtensionWebRequestData(network::ResourceRequest* request);
- raw_ptr<mojom::ExtensionWebRequestReporter, DanglingUntriaged>
+ mojo::Remote<mojom::ExtensionWebRequestReporter>
extension_web_request_reporter_;
mojo::PendingRemote<mojom::ExtensionWebRequestReporter>
- extension_web_request_reporter_pending_remote_;
- mojo::Remote<mojom::ExtensionWebRequestReporter>
- extension_web_request_reporter_remote_;
+ pending_extension_web_request_reporter_;
// Tracks if the request originated from an extension, used during redirects
// to send web request data to the telemetry service.
std::string origin_extension_id_;
diff --git a/components/safe_browsing/content/renderer/renderer_url_loader_throttle_unittest.cc b/components/safe_browsing/content/renderer/renderer_url_loader_throttle_unittest.cc
index 876d3d8..228b07c 100644
--- a/components/safe_browsing/content/renderer/renderer_url_loader_throttle_unittest.cc
+++ b/components/safe_browsing/content/renderer/renderer_url_loader_throttle_unittest.cc
@@ -146,4 +146,74 @@
EXPECT_FALSE(defer);
}
+#if BUILDFLAG(ENABLE_EXTENSIONS)
+class MockExtensionWebRequestReporter
+ : public mojom::ExtensionWebRequestReporter {
+ public:
+ MockExtensionWebRequestReporter() = default;
+ ~MockExtensionWebRequestReporter() override = default;
+
+ void SendWebRequestData(
+ const std::string& extension_id,
+ const GURL& url,
+ mojom::WebRequestProtocolType protocol_type,
+ mojom::WebRequestContactInitiatorType initiator_type) override {}
+
+ void Clone(mojo::PendingReceiver<mojom::ExtensionWebRequestReporter> receiver)
+ override {
+ clone_receiver_.Bind(std::move(receiver));
Regression Test / PoC
diff --git a/components/safe_browsing/content/renderer/renderer_url_loader_throttle_unittest.cc b/components/safe_browsing/content/renderer/renderer_url_loader_throttle_unittest.cc
index 876d3d8..228b07c 100644
--- a/components/safe_browsing/content/renderer/renderer_url_loader_throttle_unittest.cc
+++ b/components/safe_browsing/content/renderer/renderer_url_loader_throttle_unittest.cc
@@ -146,4 +146,74 @@
EXPECT_FALSE(defer);
}
+#if BUILDFLAG(ENABLE_EXTENSIONS)
+class MockExtensionWebRequestReporter
+ : public mojom::ExtensionWebRequestReporter {
+ public:
+ MockExtensionWebRequestReporter() = default;
+ ~MockExtensionWebRequestReporter() override = default;
+
+ void SendWebRequestData(
+ const std::string& extension_id,
+ const GURL& url,
+ mojom::WebRequestProtocolType protocol_type,
+ mojom::WebRequestContactInitiatorType initiator_type) override {}
+
+ void Clone(mojo::PendingReceiver<mojom::ExtensionWebRequestReporter> receiver)
+ override {
+ clone_receiver_.Bind(std::move(receiver));
+ }
+
+ mojo::Receiver<mojom::ExtensionWebRequestReporter> receiver_{this};
+
+ private:
+ mojo::Receiver<mojom::ExtensionWebRequestReporter> clone_receiver_{this};
+};
+
+TEST_F(SBRendererUrlLoaderThrottleTest,
+ WillRedirectRequest_ProviderDestroyed_NoCrash) {
+ auto reporter = std::make_unique<MockExtensionWebRequestReporter>();
+ mojo::Remote<mojom::ExtensionWebRequestReporter> remote;
+ reporter->receiver_.Bind(remote.BindNewPipeAndPassReceiver());
+
+ mojo::PendingRemote<mojom::ExtensionWebRequestReporter> pending_remote;
+ remote->Clone(pending_remote.InitWithNewPipeAndPassReceiver());
+
+ throttle_ = std::make_unique<RendererURLLoaderThrottle>(
+ safe_browsing_remote_.get(), std::nullopt, std::move(pending_remote));
+ throttle_->set_delegate(throttle_delegate_.get());
+
+ GURL url("http://example.com/");
+ bool defer = false;
+ network::ResourceRequest request =
+ GetResourceRequest(url, network::mojom::RequestDestination::kScript);
+ request.request_initiator =
+ url::Origin::Create(GURL("chrome-extension://abc"));
+ throttle_->WillStartRequest(&request, &defer);
+ EXPECT_FALSE(defer);
+
+ net::RedirectInfo redirect_info;
+ redirect_info.new_url = GURL("http://example.com/redirect");
+ auto response_head = network::mojom::URLResponseHead::New();
+ std::vector<std::string> to_be_removed_headers;
+ net::HttpRequestHeaders modified_headers;
+ net::HttpRequestHeaders modified_cors_exempt_headers;
+ throttle_->WillRedirectRequest(&redirect_info, *response_head, &defer,
+ &to_be_removed_headers, &modified_headers,
+ &modified_cors_exempt_headers);
+
+ // Destroy the reporter, simulating the URLLoaderThrottleProviderImpl being
+ // destroyed. This should cause the pipe in the throttle to be closed.
+ base::RunLoop run_loop;
+ remote.set_disconnect_handler(run_loop.QuitClosure());
+ reporter.reset();
+
+ // Run the message loop until the disconnection is detected. If the UAF bug
+ // exists, this will crash.
+ run_loop.Run();
+
+ // If we reach here, the test has passed because it didn't crash.
+}
+#endif // BUILDFLAG(ENABLE_EXTENSIONS)
+
} // namespace safe_browsing
Original Bug Report
UAF in safe_browsing::RendererURLLoaderThrottle::WillRedirectRequest due to Mojo Remote being freed during resource load lifecycle
VULNERABILITY DETAILS A UAF condition was detected in the renderer process within the Safe Browsing URL loading throttle mechanism. This vulnerability occurs when a resource load that triggers the safe_browsing::RendererURLLoaderThrottle is redirected, and a race condition is won against the tear-down of the associated renderer context. The crash occurs when safe_browsing::RendererURLLoaderThrottle::WillRedirectRequest attempts to dereference a raw_ptr to safe_browsing::mojom::ExtensionWebRequestReporter, which has been freed shortly beforehand as part of the URLLoaderThrottleProviderImpl destruction.
When the injected contentjs fetch the 307 Temporary Redirect url(in content.js) cause the UAF.
VERSION Chrome Version: 142.0.7433.0 (Developer Build) (64-bit) Operating System: Windows 10 Version 22H2 (Build 19045.6332)
REPRODUCTION CASE
- run the command: ./chrome.exe –user-data-dir=C:/tmp/test –no-sandbox –no-first-run –load-extension=“extension_dir” https://example.com https://example.com https://example.com
FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab]
==4664==ERROR: AddressSanitizer: heap-use-after-free on address 0x118c5a3b78f0 at pc 0x7ffd9d2b61bf bp 0x005380ffe380 sp 0x005380ffe3c8
READ of size 1 at 0x118c5a3b78f0 thread T5
#0 0x7ffd9d2b61be in base::internal::anonymous namespace'::CrashImmediatelyOnUseAfterFree C:\b\s\w\ir\cache\builder\src\base\memory\raw_ptr_asan_hooks.cc:54:17 #1 0x7ffd9d2b5d11 in base::internal::anonymous namespace’::SafelyUnwrapForDereference C:\b\s\w\ir\cache\builder\src\base\memory\raw_ptr_asan_hooks.cc:77:5
#2 0x7ffd9a5192b5 in base::internal::RawPtrHookableImpl<1>::SafelyUnwrapPtrForDereference C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\pointers\raw_ptr_hookable_impl.h:84
#3 0x7ffd9a5192b5 in base::raw_ptr<safe_browsing::mojom::ExtensionWebRequestReporter,1>::GetForDereference C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\pointers\raw_ptr.h:1019
#4 0x7ffd9a5192b5 in base::raw_ptr<safe_browsing::mojom::ExtensionWebRequestReporter,1>::operator-> C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\pointers\raw_ptr.h:665
#5 0x7ffd9a5192b5 in safe_browsing::RendererURLLoaderThrottle::WillRedirectRequest(struct net::RedirectInfo *, class network::mojom::URLResponseHead const &, bool *, class std::__Cr::vector<class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>>, class std::__Cr::allocator<class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>>>> *, class net::HttpRequestHeaders *, class net::HttpRequestHeaders *) C:\b\s\w\ir\cache\builder\src\components\safe_browsing\content\renderer\renderer_url_loader_throttle.cc:120:5
#6 0x7ffd8d82021b in blink::ThrottlingURLLoader::OnReceiveRedirect(struct net::RedirectInfo const &, class mojo::StructPtr<class network::mojom::URLResponseHead>) C:\b\s\w\ir\cache\builder\src\third_party\blink\common\loader\throttling_url_loader.cc:767:17
#7 0x7ffd8abbff74 in network::mojom::URLLoaderClientStubDispatch::Accept(class network::mojom::URLLoaderClient *, class mojo::Message *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\services\network\public\mojom\url_loader.mojom.cc:1191:13
#8 0x7ffd9cebadb4 in mojo::InterfaceEndpointClient::HandleValidatedMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:1060:54
#9 0x7ffd9ceb7b2a in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:43:19
#10 0x7ffd9cec147e in mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:731:20
#11 0x7ffd9cea2b1f in mojo::internal::MultiplexRouter::ProcessIncomingMessage(class mojo::internal::MultiplexRouter::MessageWrapper *, enum mojo::internal::MultiplexRouter::ClientCallBehavior, class base::SequencedTaskRunner *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\multiplex_router.cc:1164:42
#12 0x7ffd9cea109c in mojo::internal::MultiplexRouter::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\multiplex_router.cc:767:7
#13 0x7ffd9ceb7b2a in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:43:19
#14 0x7ffd9cedfa38 in mojo::Connector::DispatchMessageW(class mojo::ScopedHandleBase<class mojo::MessageHandle>) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc:561:49
#15 0x7ffd9cee1380 in mojo::Connector::ReadAllAvailableMessages(void) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc:619:14
#16 0x7ffd9cee0da7 in mojo::Connector::OnHandleReadyInternal C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc:450
#17 0x7ffd9cee0da7 in mojo::Connector::OnWatcherHandleReady(char const , unsigned int) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\connector.cc:416:3
#18 0x7ffd9cee2d23 in base::internal::DecayedFunctorTraits<void (mojo::Connector::)(const char *, unsigned int),mojo::Connector *,const char *const &>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:730
#19 0x7ffd9cee2d23 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (mojo::Connector::*const &)(const char *, unsigned int),mojo::Connector *,const char *const &>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:922
#20 0x7ffd9cee2d23 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::*const &)(const char *, unsigned int),mojo::Connector *,const char const &>,base::internal::BindState<1,1,0,void (mojo::Connector::)(const char *, unsigned int),base::internal::UnretainedWrappermojo::Connector,base::unretained_traits::MayNotDangle,0,base::internal::UnretainedWrapper<const char,base::unretained_traits::MayNotDangle,0> >,void (unsigned int)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1059
#21 0x7ffd9cee2d23 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl mojo::Connector::*const &)(char const *, unsigned int), class mojo::Connector , char const const &>, struct base::internal::BindState<1, 1, 0, void (__cdecl mojo::Connector::)(char const , unsigned int), class base::internal::UnretainedWrapper<class mojo::Connector, struct base::unretained_traits::MayNotDangle, 0>, class base::internal::UnretainedWrapper<char const, struct base::unretained_traits::MayNotDangle, 0>>, (unsigned int)>::Run(class base::internal::BindStateBase , unsigned int) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:979:12
#22 0x7ffd8d81047c in base::RepeatingCallback<(unsigned int)>::Run(unsigned int) const & C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:343:12
#23 0x7ffd8d81026f in base::internal::DecayedFunctorTraits<void ()(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:663
#24 0x7ffd8d81026f in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:922
#25 0x7ffd8d81026f in base::internal::Invoker<base::internal::FunctorTraits<void (const &)(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),const base::RepeatingCallback<void (unsigned int)> &>,base::internal::BindState<0,1,0,void ()(const base::RepeatingCallback<void (unsigned int)> &, unsigned int, const mojo::HandleSignalsState &),base::RepeatingCallback<void (unsigned int)> >,void (unsigned int, const mojo::HandleSignalsState &)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1059
#26 0x7ffd8d81026f in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl const &)(class base::RepeatingCallback<(unsigned int)> const &, unsigned int, struct mojo::HandleSignalsState const &), class base::RepeatingCallback<void __cdecl(unsigned int)> const &>, struct base::internal::BindState<0, 1, 0, void (__cdecl )(class base::RepeatingCallback<(unsigned int)> const &, unsigned int, struct mojo::HandleSignalsState const &), class base::RepeatingCallback<void __cdecl(unsigned int)>>, (unsigned int, struct mojo::HandleSignalsState const &)>::Run(class base::internal::BindStateBase , unsigned int, struct mojo::HandleSignalsState const &) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:979:12
#27 0x7ffd9d6a06fb in base::RepeatingCallback<(unsigned int, struct mojo::HandleSignalsState const &)>::Run(unsigned int, struct mojo::HandleSignalsState const &) const & C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:343:12
#28 0x7ffd9d69fff5 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, struct mojo::HandleSignalsState const &) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc:278:14
#29 0x7ffd9d6a11d8 in base::internal::DecayedFunctorTraits<void (mojo::SimpleWatcher::)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtrmojo::SimpleWatcher &&,int &&,unsigned int &&,mojo::HandleSignalsState &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:730
#30 0x7ffd9d6a11d8 in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (mojo::SimpleWatcher::&&)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtrmojo::SimpleWatcher &&,int &&,unsigned int &&,mojo::HandleSignalsState &&>,void,0,1,2,3>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:946
#31 0x7ffd9d6a11d8 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::&&)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtrmojo::SimpleWatcher &&,int &&,unsigned int &&,mojo::HandleSignalsState &&>,base::internal::BindState<1,1,0,void (mojo::SimpleWatcher::)(int, unsigned int, const mojo::HandleSignalsState &),base::WeakPtrmojo::SimpleWatcher,int,unsigned int,mojo::HandleSignalsState>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1059
#32 0x7ffd9d6a11d8 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl mojo::SimpleWatcher::&&)(int, unsigned int, struct mojo::HandleSignalsState const &), class base::WeakPtr<class mojo::SimpleWatcher> &&, int &&, unsigned int &&, struct mojo::HandleSignalsState &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl mojo::SimpleWatcher::)(int, unsigned int, struct mojo::HandleSignalsState const &), class base::WeakPtr<class mojo::SimpleWatcher>, int, unsigned int, struct mojo::HandleSignalsState>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:972:12
#33 0x7ffd9d171033 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
#34 0x7ffd9d171033 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34
#35 0x7ffd9d0c611c in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:104
#36 0x7ffd9d0c611c in base::internal::TaskTracker::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:686
#37 0x7ffd9d0c611c in base::internal::TaskTracker::RunSkipOnShutdown(struct base::internal::Task &, class base::TaskTraits const &, class base::internal::TaskSource *, class base::internal::SequenceToken const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:671:3
#38 0x7ffd9d0c475a in base::internal::TaskTracker::RunTaskWithShutdownBehavior C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:701
#39 0x7ffd9d0c475a in base::internal::TaskTracker::RunTask(struct base::internal::Task, class base::internal::TaskSource *, class base::TaskTraits const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:501:5
#40 0x7ffd9d0c382e in base::internal::TaskTracker::RunAndPopNextTask(class base::internal::RegisteredTaskSource) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:391:5
#41 0x7ffd9d0adc95 in base::internal::WorkerThread::RunWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:473:36
#42 0x7ffd9d0acaff in base::internal::WorkerThread::RunPooledWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:359:3
#43 0x7ffd9cfb8cd3 in base::`anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:114:13
#44 0x7ffddda3beee (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x18005beee)
#45 0x7ffe4c127373 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017373)
#46 0x7ffe4d6dcc90 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18004cc90)
0x118c5a3b78f0 is located 0 bytes inside of 16-byte region [0x118c5a3b78f0,0x118c5a3b7900)
freed by thread T5 here:
#0 0x7ffddda3d2c6 (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x18005d2c6)
#1 0x7ffd899008d8 in google::protobuf::ZeroCopyCodedInputStream::scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\chrome\common\profiler\thread_profiler_platform_configuration.cc:25:7 #2 0x7ffdb44c8b95 in std::__Cr::default_delete<safe_browsing::mojom::ExtensionWebRequestReporterProxy>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:77 #3 0x7ffdb44c8b95 in std::__Cr::unique_ptr<safe_browsing::mojom::ExtensionWebRequestReporterProxy,std::__Cr::default_delete<safe_browsing::mojom::ExtensionWebRequestReporterProxy> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:290 #4 0x7ffdb44c8b95 in std::__Cr::unique_ptr<safe_browsing::mojom::ExtensionWebRequestReporterProxy,std::__Cr::default_delete<safe_browsing::mojom::ExtensionWebRequestReporterProxy> >::~unique_ptr C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:259 #5 0x7ffdb44c8b95 in mojo::internal::InterfacePtrState<safe_browsing::mojom::ExtensionWebRequestReporter>::~InterfacePtrState C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_ptr_state.h:142 #6 0x7ffdb44c8b95 in mojo::Remote<safe_browsing::mojom::ExtensionWebRequestReporter>::~Remote C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\remote.h:88 #7 0x7ffdb44c8b95 in URLLoaderThrottleProviderImpl::~URLLoaderThrottleProviderImpl(void) C:\b\s\w\ir\cache\builder\src\chrome\renderer\url_loader_throttle_provider_impl.cc:175:1 #8 0x7ffdb44cbd0f in URLLoaderThrottleProviderImpl::scalar deleting dtor’(unsigned int) C:\b\s\w\ir\cache\builder\src\chrome\renderer\url_loader_throttle_provider_impl.cc:163:65
#9 0x7ffd9d0f4f77 in base::internal::DecayedFunctorTraits<void (*)(const void *),const void &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:663
#10 0x7ffd9d0f4f77 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (&&)(const void *),const void &&>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:922
#11 0x7ffd9d0f4f77 in base::internal::Invoker<base::internal::FunctorTraits<void (&&)(const void *),const void &&>,base::internal::BindState<0,1,0,void ()(const void *),base::internal::UnretainedWrapper<const void,base::unretained_traits::MayNotDangle,0> >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1059
#12 0x7ffd9d0f4f77 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl *&&)(void const *), void const *&&>, struct base::internal::BindState<0, 1, 0, void (__cdecl *)(void const *), class base::internal::UnretainedWrapper<void const, struct base::unretained_traits::MayNotDangle, 0>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:972:12
#13 0x7ffd9d171033 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
#14 0x7ffd9d171033 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34
#15 0x7ffd9d0c611c in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:104
#16 0x7ffd9d0c611c in base::internal::TaskTracker::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:686
#17 0x7ffd9d0c611c in base::internal::TaskTracker::RunSkipOnShutdown(struct base::internal::Task &, class base::TaskTraits const &, class base::internal::TaskSource *, class base::internal::SequenceToken const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:671:3
#18 0x7ffd9d0c475a in base::internal::TaskTracker::RunTaskWithShutdownBehavior C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:701
#19 0x7ffd9d0c475a in base::internal::TaskTracker::RunTask(struct base::internal::Task, class base::internal::TaskSource *, class base::TaskTraits const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:501:5
#20 0x7ffd9d0c382e in base::internal::TaskTracker::RunAndPopNextTask(class base::internal::RegisteredTaskSource) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:391:5
#21 0x7ffd9d0adc95 in base::internal::WorkerThread::RunWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:473:36
#22 0x7ffd9d0acaff in base::internal::WorkerThread::RunPooledWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:359:3
#23 0x7ffd9cfb8cd3 in base::`anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:114:13
#24 0x7ffddda3beee (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x18005beee)
#25 0x7ffe4c127373 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017373)
#26 0x7ffe4d6dcc90 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18004cc90)
previously allocated by thread T5 here: #0 0x7ffddda3c6ff (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x18005c6ff) #1 0x7ffd9a51b381 in std::__Cr::make_unique C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include__memory\unique_ptr.h:759 #2 0x7ffd9a51b381 in mojo::internal::InterfacePtrState<class safe_browsing::mojom::ExtensionWebRequestReporter>::ConfigureProxyIfNecessary(void) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_ptr_state.h:274:16 #3 0x7ffd9a51af64 in mojo::internal::InterfacePtrState<safe_browsing::mojom::ExtensionWebRequestReporter>::instance C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_ptr_state.h:145 #4 0x7ffd9a51af64 in mojo::Remote<class safe_browsing::mojom::ExtensionWebRequestReporter>::Bind(class mojo::PendingRemote<class safe_browsing::mojom::ExtensionWebRequestReporter>, class scoped_refptr<class base::SequencedTaskRunner>) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\remote.h:297:35 #5 0x7ffdb44c9ee8 in mojo::Remote<safe_browsing::mojom::ExtensionWebRequestReporter>::Bind C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\remote.h:270 #6 0x7ffdb44c9ee8 in URLLoaderThrottleProviderImpl::CreateThrottles(class base::optional_ref<class base::TokenType<class blink::LocalFrameTokenTypeMarker> const, 0>, struct network::ResourceRequest const &) C:\b\s\w\ir\cache\builder\src\chrome\renderer\url_loader_throttle_provider_impl.cc:211:39 #7 0x7ffd96a8fb12 in blink::BackgroundURLLoader::Context::StartOnBackground(class scoped_refptr<class blink::WebBackgroundResourceFetchAssets>, class std::__Cr::unique_ptr<struct network::ResourceRequest, struct std::__Cr::default_delete<struct network::ResourceRequest>>, class url::Origin const &, bool, class blink::Vector<class blink::String, 0, class blink::PartitionAllocator> const &, class std::__Cr::unique_ptr<class blink::ResourceLoadInfoNotifierWrapper, struct std::__Cr::default_delete<class blink::ResourceLoadInfoNotifierWrapper>>, bool, class std::__Cr::unique_ptr<class blink::BackgroundResponseProcessorFactory, struct std::__Cr::default_delete<class blink::BackgroundResponseProcessorFactory>>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\loader\fetch\url_loader\background_url_loader.cc:418:30 #8 0x7ffd96a90fd0 in base::internal::DecayedFunctorTraits<void (blink::BackgroundURLLoader::Context::)(scoped_refptrblink::WebBackgroundResourceFetchAssets, std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_deletenetwork::ResourceRequest >, const url::Origin &, bool, const blink::Vectorblink::String,0,blink::PartitionAllocator &, std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_deleteblink::ResourceLoadInfoNotifierWrapper >, bool, std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_deleteblink::BackgroundResponseProcessorFactory >),scoped_refptrblink::BackgroundURLLoader::Context &&,scoped_refptrblink::WebBackgroundResourceFetchAssets &&,std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_deletenetwork::ResourceRequest > &&,url::Origin &&,bool &&,blink::Vectorblink::String,0,blink::PartitionAllocator &&,std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_deleteblink::ResourceLoadInfoNotifierWrapper > &&,bool &&,std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_deleteblink::BackgroundResponseProcessorFactory > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:730 #9 0x7ffd96a90fd0 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (blink::BackgroundURLLoader::Context::&&)(scoped_refptrblink::WebBackgroundResourceFetchAssets, std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_deletenetwork::ResourceRequest >, const url::Origin &, bool, const blink::Vectorblink::String,0,blink::PartitionAllocator &, std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_deleteblink::ResourceLoadInfoNotifierWrapper >, bool, std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_deleteblink::BackgroundResponseProcessorFactory >),scoped_refptrblink::BackgroundURLLoader::Context &&,scoped_refptrblink::WebBackgroundResourceFetchAssets &&,std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_deletenetwork::ResourceRequest > &&,url::Origin &&,bool &&,blink::Vectorblink::String,0,blink::PartitionAllocator &&,std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_deleteblink::ResourceLoadInfoNotifierWrapper > &&,bool &&,std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_deleteblink::BackgroundResponseProcessorFactory > &&>,void,0,1,2,3,4,5,6,7,8>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:922 #10 0x7ffd96a90fd0 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::BackgroundURLLoader::Context::&&)(scoped_refptrblink::WebBackgroundResourceFetchAssets, std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_deletenetwork::ResourceRequest >, const url::Origin &, bool, const blink::Vectorblink::String,0,blink::PartitionAllocator &, std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_deleteblink::ResourceLoadInfoNotifierWrapper >, bool, std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_deleteblink::BackgroundResponseProcessorFactory >),scoped_refptrblink::BackgroundURLLoader::Context &&,scoped_refptrblink::WebBackgroundResourceFetchAssets &&,std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_deletenetwork::ResourceRequest > &&,url::Origin &&,bool &&,blink::Vectorblink::String,0,blink::PartitionAllocator &&,std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_deleteblink::ResourceLoadInfoNotifierWrapper > &&,bool &&,std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_deleteblink::BackgroundResponseProcessorFactory > &&>,base::internal::BindState<1,1,0,void (blink::BackgroundURLLoader::Context::)(scoped_refptrblink::WebBackgroundResourceFetchAssets, std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_deletenetwork::ResourceRequest >, const url::Origin &, bool, const blink::Vectorblink::String,0,blink::PartitionAllocator &, std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_deleteblink::ResourceLoadInfoNotifierWrapper >, bool, std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_deleteblink::BackgroundResponseProcessorFactory >),scoped_refptrblink::BackgroundURLLoader::Context,scoped_refptrblink::WebBackgroundResourceFetchAssets,std::__Cr::unique_ptr<network::ResourceRequest,std::__Cr::default_deletenetwork::ResourceRequest >,url::Origin,bool,blink::Vectorblink::String,0,blink::PartitionAllocator,std::__Cr::unique_ptr<blink::ResourceLoadInfoNotifierWrapper,std::__Cr::default_deleteblink::ResourceLoadInfoNotifierWrapper >,bool,std::__Cr::unique_ptr<blink::BackgroundResponseProcessorFactory,std::__Cr::default_deleteblink::BackgroundResponseProcessorFactory > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1059 #11 0x7ffd96a90fd0 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl blink::BackgroundURLLoader::Context::&&)(class scoped_refptr<class blink::WebBackgroundResourceFetchAssets>, class std::__Cr::unique_ptr<struct network::ResourceRequest, struct std::__Cr::default_delete<struct network::ResourceRequest>>, class url::Origin const &, bool, class blink::Vector<class blink::String, 0, class blink::PartitionAllocator> const &, class std::__Cr::unique_ptr<class blink::ResourceLoadInfoNotifierWrapper, struct std::__Cr::default_delete<class blink::ResourceLoadInfoNotifierWrapper>>, bool, class std::__Cr::unique_ptr<class blink::BackgroundResponseProcessorFactory, struct std::__Cr::default_delete<class blink::BackgroundResponseProcessorFactory>>), class scoped_refptr<class blink::BackgroundURLLoader::Context> &&, class scoped_refptr<class blink::WebBackgroundResourceFetchAssets> &&, class std::__Cr::unique_ptr<struct network::ResourceRequest, struct std::__Cr::default_delete<struct network::ResourceRequest>> &&, class url::Origin &&, bool &&, class blink::Vector<class blink::String, 0, class blink::PartitionAllocator> &&, class std::__Cr::unique_ptr<class blink::ResourceLoadInfoNotifierWrapper, struct std::__Cr::default_delete<class blink::ResourceLoadInfoNotifierWrapper>> &&, bool &&, class std::__Cr::unique_ptr<class blink::BackgroundResponseProcessorFactory, struct std::__Cr::default_delete<class blink::BackgroundResponseProcessorFactory>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl blink::BackgroundURLLoader::Context::)(class scoped_refptr<class blink::WebBackgroundResourceFetchAssets>, class std::__Cr::unique_ptr<struct network::ResourceRequest, struct std::__Cr::default_delete<struct network::ResourceRequest>>, class url::Origin const &, bool, class blink::Vector<class blink::String, 0, class blink::PartitionAllocator> const &, class std::__Cr::unique_ptr<class blink::ResourceLoadInfoNotifierWrapper, struct std::__Cr::default_delete<class blink::ResourceLoadInfoNotifierWrapper>>, bool, class std::__Cr::unique_ptr<class blink::BackgroundResponseProcessorFactory, struct std::__Cr::default_delete<class blink::BackgroundResponseProcessorFactory>>), class scoped_refptr<class blink::BackgroundURLLoader::Context>, class scoped_refptr<class blink::WebBackgroundResourceFetchAssets>, class std::__Cr::unique_ptr<struct network::ResourceRequest, struct std::__Cr::default_delete<struct network::ResourceRequest>>, class url::Origin, bool, class blink::Vector<class blink::String, 0, class blink::PartitionAllocator>, class std::__Cr::unique_ptr<class blink::ResourceLoadInfoNotifierWrapper, struct std::__Cr::default_delete<class blink::ResourceLoadInfoNotifierWrapper>>, bool, class std::__Cr::unique_ptr<class blink::BackgroundResponseProcessorFactory, struct std::__Cr::default_delete<class blink::BackgroundResponseProcessorFactory>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:972:12 #12 0x7ffd9d171033 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155 #13 0x7ffd9d171033 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34 #14 0x7ffd9d0c611c in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:104 #15 0x7ffd9d0c611c in base::internal::TaskTracker::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:686 #16 0x7ffd9d0c611c in base::internal::TaskTracker::RunSkipOnShutdown(struct base::internal::Task &, class base::TaskTraits const &, class base::internal::TaskSource *, class base::internal::SequenceToken const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:671:3 #17 0x7ffd9d0c475a in base::internal::TaskTracker::RunTaskWithShutdownBehavior C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:701 #18 0x7ffd9d0c475a in base::internal::TaskTracker::RunTask(struct base::internal::Task, class base::internal::TaskSource *, class base::TaskTraits const &) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:501:5 #19 0x7ffd9d0c382e in base::internal::TaskTracker::RunAndPopNextTask(class base::internal::RegisteredTaskSource) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:391:5 #20 0x7ffd9d0adc95 in base::internal::WorkerThread::RunWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:473:36 #21 0x7ffd9d0acaff in base::internal::WorkerThread::RunPooledWorker(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:359:3 #22 0x7ffd9cfb8cd3 in base::`anonymous namespace’::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:114:13 #23 0x7ffddda3beee (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x18005beee) #24 0x7ffe4c127373 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017373) #25 0x7ffe4d6dcc90 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18004cc90)
Thread T5 created by T0 here: #0 0x7ffddda3be04 (C:\chromium_version\latest_asan\clang_rt.asan_dynamic-x86_64.dll+0x18005be04) #1 0x7ffd9cfb7ffc in base::`anonymous namespace’::CreateThreadInternal C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:182:7 #2 0x7ffd9d0ab13f in base::internal::WorkerThread::Start(class scoped_refptr<class base::SingleThreadTaskRunner>, class base::WorkerThreadObserver *) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:185:3 #3 0x7ffd9d0bbc97 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group.cc:90:13 #4 0x7ffd9d0bb96d in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor(void) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group.cc:81:3 #5 0x7ffd9d0b0557 in base::internal::ThreadGroupImpl::ScopedCommandsExecutor::~ScopedCommandsExecutor C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group_impl.cc:43 #6 0x7ffd9d0b0557 in base::internal::ThreadGroupImpl::Start(unsigned __int64, unsigned __int64, class base::TimeDelta, class scoped_refptr<class base::SingleThreadTaskRunner>, class base::WorkerThreadObserver *, enum base::internal::ThreadGroup::WorkerEnvironment, bool, class std::__Cr::optional<class base::TimeDelta>) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group_impl.cc:252:3 #7 0x7ffd9d0a1805 in base::internal::ThreadPoolImpl::Start(struct base::ThreadPoolInstance::InitParams const &, class base::WorkerThreadObserver ) C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_pool_impl.cc:198:35 #8 0x7ffda725b2a8 in content::ChildProcess::ChildProcess(enum base::ThreadType, class std::__Cr::unique_ptr<struct base::ThreadPoolInstance::InitParams, struct std::__Cr::default_delete<struct base::ThreadPoolInstance::InitParams>>, bool) C:\b\s\w\ir\cache\builder\src\content\child\child_process.cc:113:20 #9 0x7ffda73679eb in content::RenderProcess::RenderProcess(class std::__Cr::unique_ptr<struct base::ThreadPoolInstance::InitParams, struct std::__Cr::default_delete<struct base::ThreadPoolInstance::InitParams>>) C:\b\s\w\ir\cache\builder\src\content\renderer\render_process.cc:18:7 #10 0x7ffda73670bd in content::RenderProcessImpl::RenderProcessImpl(void) C:\b\s\w\ir\cache\builder\src\content\renderer\render_process_impl.cc:98:7 #11 0x7ffda7367685 in content::RenderProcessImpl::Create(void) C:\b\s\w\ir\cache\builder\src\content\renderer\render_process_impl.cc:216:31 #12 0x7ffda7284806 in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:276:53 #13 0x7ffd99053b6c in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:764:14 #14 0x7ffd99055fa3 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1130:10 #15 0x7ffd9904a31f in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:346:36 #16 0x7ffd9904a88e in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359:10 #17 0x7ffd898f300f in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:228:12 #18 0x7ff784f5483b in MainDllLoader::Launch(struct HINSTANCE, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12 #19 0x7ff784f52085 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20 #20 0x7ff78542e7bf in invoke_main D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78 #21 0x7ff78542e7bf in __scrt_common_main_seh D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #22 0x7ffe4c127373 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017373) #23 0x7ffe4d6dcc90 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18004cc90)
SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\base\memory\raw_ptr_asan_hooks.cc:54:17 in base::internal::`anonymous namespace’::CrashImmediatelyOnUseAfterFree Shadow bytes around the buggy address: 0x118c5a3b7600: f7 fa fd fa f7 fa fd fa f7 fa fd fa f7 fa fd fa 0x118c5a3b7680: f7 fa fd fa f7 fa fd fa f7 fa fd fa f7 fa fd fa 0x118c5a3b7700: f7 fa fd fa f7 fa fd fa f7 fa fd fa f7 fa fd fa 0x118c5a3b7780: f7 fa fd fa f7 fa fd fa f7 fa fd fd f7 fa fd fd 0x118c5a3b7800: f7 fa fd fa f7 fa fd fa f7 fa fd fa f7 fa fd fa =>0x118c5a3b7880: f7 fa fd fa f7 fa fd fa f7 fa fd fd f7 fa[fd]fd 0x118c5a3b7900: f7 fa 00 fa f7 fa fd fa f7 fa fd fd f7 fa 00 fa 0x118c5a3b7980: f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa 0x118c5a3b7a00: f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa 0x118c5a3b7a80: f7 fa 00 fa f7 fa 00 00 f7 fa 00 00 f7 fa 00 fa 0x118c5a3b7b00: f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb
==4664==ADDITIONAL INFO
==4664==Note: Please include this section with the ASan report. Task trace: #0 0x7ffd9d6a0c9f in mojo::SimpleWatcher::Context::Notify(unsigned int, struct MojoHandleSignalsState, unsigned int) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc:102:13
Command line: "C:\asan\chrome.exe" --type=renderer --user-data-dir=C:/tmp/test--extensions-on-chrome-urls --no-pre-read-main-dll --no-sandbox --file-url-path-alias="/gen=C:\asan\gen" --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1.75 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1758707867337761 --launch-time-ticks=51381261914 --metrics-shmem-handle=3212,i,1427474096340128744,5752336122806041417,2097152 --field-trial-handle=1920,i,6349326568880425583,5959785934015148551,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3208 /prefetch:1
MiraclePtr Status: MANUAL ANALYSIS REQUIRED This crash occurred while a raw_ptr<T> object containing a dangling pointer was being dereferenced. This crash occurred in the thread pool. The sequence which invoked the “free” is unknown, so the crash may have been caused by a race condition that is mislabeled as a use-after-free. Make sure that the “free” is sequenced after the “use” (e.g. both are on the same sequence, or the “free” is in a task posted after the “use”). Otherwise, the crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.
==4664==END OF ADDITIONAL INFO ==4664==ABORTING