PatchGap
Chrome · WebAudio › Internals>Media

CVE-2025-4372

UAF in WebAudio (Internals>Media)
Medium patch-now ~ plausible CVSS 8.8 chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
8.8
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in WebAudio
DescriptionUse after free in WebAudio
ComponentWebAudio
Sub-componentInternals>Media
Bug ClassUAF
Action tierpatch-now — corruption primitive, web-reachable in default config (plausible) — upheld by independent review by AI
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Independent review by AIPlausible
Reviewer notes: Diff only adds ActiveScriptWrappable keep-alive while the context is running; which component holds the dangling reference after collection (audio thread, MediaStream source, Dispose pre-finalizer) is asserted, not shown by the diff.
A second, independent AI reviewer (not a human) re-derived this analysis from the fixing commit and the vendor advisory, looking for errors.
Tracker412057896
Fix commitaa3e1b188a94 (chromium/src) +12/-2
CWECWE-416 (Use-after-free)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEVNot listed
CreditedHuang Xilin of Ant Group Light-Year Security Lab
Reported2025-04-20 · bounty $7000 (per vendor advisory)
Fix landed2025-04-24 (public git)
Disclosed2025-05-06
Patch gap12 days — fix public in source before the advisory

Background

`MediaStreamAudioDestinationNode`
A Web Audio AudioNode that acts as an endpoint in the audio graph and exposes its output as a MediaStream source (used by WebRTC, MediaRecorder, etc.).
Blink garbage collection (Oilpan)
Blink’s tracing GC; a wrapper (JS-side object) may be collected when it is only reachable through JavaScript and no C++ code keeps it alive, potentially freeing the underlying node.
`ActiveScriptWrappable`
A base class letting a garbage-collected DOM object tell the GC it still has “pending activity,” keeping the object (and its JS wrapper) alive while HasPendingActivity() returns true.
`HasPendingActivity()`
The overridable predicate the GC consults; here it returns true while context()->ContextState() is V8AudioContextState::Enum::kRunning.

Root Cause Analysis

Verify before building a PoC

This analysis is consistent with the fixing commit but not fully provable from it: part of the vulnerable path lives in code the fix commit does not touch. Confirm the trigger and the sink against the source before relying on it for exploit development.
What the commit does not establish: Diff only adds ActiveScriptWrappable keep-alive while the context is running; which component holds the dangling reference after collection (audio thread, MediaStream source, Dispose pre-finalizer) is asserted, not shown by the diff.

Before the patch, MediaStreamAudioDestinationNode derived only from AudioNode and was not an ActiveScriptWrappable, so it had no way to signal pending activity to the garbage collector. When script dropped its references but the node was still active (feeding a running AudioContext and its associated MediaStream), the GC could collect the wrapper and free the node while audio processing / stream consumers still referenced it, producing a use-after-free. The invariant violated is that an object still doing background work (an active audio destination in a running context) must remain alive until that work stops.

The fix makes the class also inherit ActiveScriptWrappable<MediaStreamAudioDestinationNode>, adds the IDL [ActiveScriptWrappable] attribute, initializes the base in the constructor, grants friendship via active_script_wrappable_creation_key.h, and implements HasPendingActivity() to return true while the context state is kRunning. This keeps the node alive exactly while it has pending activity, eliminating the premature free.

Key insight
The core mistake was that MediaStreamAudioDestinationNode was not an ActiveScriptWrappable, so an active node could be garbage-collected and freed while still in use; the fix makes it an ActiveScriptWrappable whose HasPendingActivity() reports activity while the AudioContext is running, so the GC keeps it alive.

Attack Path

  1. Create the node Script constructs a MediaStreamAudioDestinationNode on a running AudioContext, wiring its output into the graph / a consumer.
  2. Drop script references The page releases all reachable JavaScript references to the node so its only liveness would come from pending activity it could not previously report.
  3. Force garbage collection Trigger GC so the wrapper/node is collected and freed even though the context is still running and processing audio. (inferred) Precise timing/heap grooming to win the race is not shown by the patch.
  4. Use the freed node Continued audio processing or stream/wrapper access dereferences the freed MediaStreamAudioDestinationNode, causing the use-after-free. (inferred) Any conversion of this UAF into a read/write primitive or code execution is not demonstrated by the diff.

Impact Assessment

An attacker-controlled page can trigger a use-after-free of a MediaStreamAudioDestinationNode in the renderer process by releasing references to a node that is still active in a running AudioContext and forcing GC, per the advisory’s “use after free in WebAudio.” The precondition is script creating and then dropping references to an active destination node while the context keeps running. The advisory does not report in-the-wild exploitation; any escalation from the UAF to memory corruption or code execution is (inferred).

Changed Functions

FunctionChangeNotes
MODULES_EXPORT
third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.h
 modified

Files Changed

  • third_party/blink/renderer/bindings/core/v8/active_script_wrappable_creation_key.h
  • third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.cc
  • third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.h
  • third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.idl

Audit Directions

  • Missing `ActiveScriptWrappable`
    Audit other AudioNode subclasses and DOM objects that continue background work (audio processing, streams, timers, network) after script references are dropped but do not implement ActiveScriptWrappable/HasPendingActivity().
  • `HasPendingActivity()` correctness
    Review existing HasPendingActivity() implementations to confirm they report activity for the full lifetime of the underlying work (e.g. context/stream state), not a too-narrow window that still allows premature collection.
  • WebAudio lifetime coupling
    Examine nodes that bridge Web Audio to the MediaStream/WebRTC ecosystem for object-lifetime mismatches between the audio graph, the stream, and their JS wrappers.

Patch

view commit
From aa3e1b188a94da972cfbfaf47713ef5460cff25f Mon Sep 17 00:00:00 2001
From: Michael Wilson <mjwilson@chromium.org>
Date: Thu, 24 Apr 2025 08:03:59 -0700
Subject: [PATCH] Make MediaStreamAudioDestinationNode ActiveScriptWrappable

Bug: 412057896
Change-Id: I482742448cd22d8a9bd57ac58847f796405d14e4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6482260
Commit-Queue: Michael Wilson <mjwilson@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Hongchan Choi <hongchan@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1451160}
---

diff --git a/third_party/blink/renderer/bindings/core/v8/active_script_wrappable_creation_key.h b/third_party/blink/renderer/bindings/core/v8/active_script_wrappable_creation_key.h
index f438368..49275ae 100644
--- a/third_party/blink/renderer/bindings/core/v8/active_script_wrappable_creation_key.h
+++ b/third_party/blink/renderer/bindings/core/v8/active_script_wrappable_creation_key.h
@@ -66,6 +66,7 @@
   friend class MediaSource;
   friend class MediaRecorder;
   friend class MediaStream;
+  friend class MediaStreamAudioDestinationNode;
   friend class MediaStreamAudioSourceNode;
   friend class MediaStreamTrack;
   friend class MessagePort;
diff --git a/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.cc b/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.cc
index fbee7333..dc1b5149 100644
--- a/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.cc
+++ b/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.cc
@@ -50,7 +50,8 @@
 MediaStreamAudioDestinationNode::MediaStreamAudioDestinationNode(
     AudioContext& context,
     uint32_t number_of_channels)
-    : AudioNode(context) {
+    : AudioNode(context),
+      ActiveScriptWrappable<MediaStreamAudioDestinationNode>({}) {
   DVLOG(1) << "Creating WebAudio media stream source.";
   auto audio_source = std::make_unique<WebAudioMediaStreamSource>(
     context.GetExecutionContext()->GetTaskRunner(TaskType::kInternalMedia));
@@ -135,6 +136,10 @@
   return node;
 }
 
+bool MediaStreamAudioDestinationNode::HasPendingActivity() const {
+  return context()->ContextState() == V8AudioContextState::Enum::kRunning;
+}
+
 void MediaStreamAudioDestinationNode::Trace(Visitor* visitor) const {
   visitor->Trace(stream_);
   visitor->Trace(source_);
diff --git a/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.h b/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.h
index 300e981..4a2b948 100644
--- a/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.h
+++ b/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.h
@@ -42,7 +42,9 @@
 // MediaStreamAudioDestinationNode is an AudioNode that represents an endpoint
 // in the Web Audio graph and also functions as an audio stream source for
 // MediaStream ecosystem. (e.g., WebRTC, MediaRecorder)
-class MODULES_EXPORT MediaStreamAudioDestinationNode final : public AudioNode {
+class MODULES_EXPORT MediaStreamAudioDestinationNode final
+    : public AudioNode,
+      public ActiveScriptWrappable<MediaStreamAudioDestinationNode> {
   DEFINE_WRAPPERTYPEINFO();
   USING_PRE_FINALIZER(MediaStreamAudioDestinationNode, Dispose);
 
@@ -59,6 +61,7 @@
   MediaStream* stream() const { return stream_.Get(); }
   MediaStreamSource* source() const { return source_.Get(); }
 
+  bool HasPendingActivity() const final;
   void Trace(Visitor*) const final;
   void Dispose();
 
diff --git a/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.idl b/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.idl
index 833a9b4..981688bc 100644
--- a/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.idl
+++ b/third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_node.idl
@@ -25,6 +25,7 @@
 
 // https://webaudio.github.io/web-audio-api/#mediastreamaudiodestinationnode
 [
+    ActiveScriptWrappable,
     Exposed=Window
 ] interface MediaStreamAudioDestinationNode : AudioNode {
     [RaisesException, Measure] constructor(AudioContext context, optional AudioNodeOptions options = {});
Loading diff…

Original Bug Report

reported by su...@gmail.com

Security: Uaf in media::AudioBus

Steps to reproduce the problem

This vulnerability is a race condition vulnerability with a very low probability of being triggered. I am still trying to reproduce the vulnerability and construct a PoC.

Problem Description

I currently don’t know the root cause of this vulnerability. For now, I can only provide the stack backtrace of the vulnerability. You can analyze it based on the stack backtrace first, and I will provide a more detailed vulnerability analysis later.

Summary

Security: Uaf in media::AudioBus

Custom Questions

Type of crash:

tab

Crash state:

==4065400==ERROR: AddressSanitizer: heap-use-after-free on address 0x706aed7ea2f0 at pc 0x5a2da2f06753 bp 0x700a511fcc70 sp 0x700a511fcc68
READ of size 8 at 0x706aed7ea2f0 thread T26 (Semi-Realtime A)
==4065400==WARNING: invalid path to external symbolizer!
==4065400==WARNING: Failed to use and restart external symbolizer!
    #0 0x5a2da2f06752 in media::AudioBus::AllChannelsSubspan(unsigned long, unsigned long) const ./../../media/base/audio_bus.cc:406:24
    #1 0x5a2da2f05d1b in media::AudioBus::CopyPartialFramesTo(int, int, int, media::AudioBus*) const ./../../media/base/audio_bus.cc:370:39
    #2 0x5a2d8bc9b388 in media::AudioPushFifo::Push(media::AudioBus const&) ./../../media/base/audio_push_fifo.cc:60:17
    #3 0x5a2db1bb09eb in blink::WebAudioMediaStreamSource::ConsumeAudio(WTF::Vector<float const*, 0u, WTF::PartitionAllocator> const&, int) ./../../third_party/blink/renderer/platform/mediastream/webaudio_media_stream_source.cc:78:9
    #4 0x5a2db1bcf4d0 in blink::MediaStreamAudioDestinationHandler::ConsumeAudio(blink::AudioBus*, int) ./../../third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_handler.cc:219:28
    #5 0x5a2db1bced69 in blink::MediaStreamAudioDestinationHandler::Process(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_handler.cc:89:3
    #6 0x5a2db1a86696 in blink::AudioHandler::ProcessIfNecessary(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/audio_handler.cc:325:7
    #7 0x5a2db1b788f3 in blink::DeferredTaskHandler::ProcessAutomaticPullNodes(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc:198:41
    #8 0x5a2db1c0d370 in blink::RealtimeAudioDestinationHandler::Render(blink::AudioBus*, unsigned int, blink::AudioIOPosition const&, blink::AudioCallbackMetric const&, base::TimeDelta, media::AudioGlitchInfo const&) ./../../third_party/blink/renderer/modules/webaudio/realtime_audio_destination_handler.cc:262:37
    #9 0x5a2db1c1bd0c in blink::AudioDestination::PullFromCallback(blink::AudioBus*, base::TimeDelta) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:672:14
    #10 0x5a2db1c154e0 in blink::AudioDestination::RequestRender(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks, bool) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:643:7
    #11 0x5a2db1c148ba in blink::AudioDestination::RequestRenderWait(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:559:8
    #12 0x5a2db1c1dcca in Invoke<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks> ./../../base/functional/bind_internal.h:731:12
    #13 0x5a2db1c1dcca in MakeItSo<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), std::__Cr::tuple<scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks> > ./../../base/functional/bind_internal.h:923:12
    #14 0x5a2db1c1dcca in RunImpl<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), std::__Cr::tuple<scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks>, 0UL, 1UL, 2UL, 3UL, 4UL, 5UL, 6UL> ./../../base/functional/bind_internal.h:1060:14
    #15 0x5a2db1c1dcca in base::internal::Invoker<base::internal::FunctorTraits<void (blink::AudioDestination::*&&)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks), scoped_refptr<blink::AudioDestination>&&, unsigned int&&, unsigned int&&, base::TimeDelta&&, base::TimeTicks&&, media::AudioGlitchInfo&&, base::TimeTicks&&>, base::internal::BindState<true, true, false, void (blink::AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks), scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:973:12
    #16 0x5a2d9e3e8da6 in Run ./../../base/functional/callback.h:156:12
    #17 0x5a2d9e3e8da6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/task/common/task_annotator.cc:209:34
    #18 0x5a2d9e45a768 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:458:11)> ./../../base/task/common/task_annotator.h:106:5
    #19 0x5a2d9e45a768 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:456:23
    #20 0x5a2d9e45964c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #21 0x5a2d9e45b49a in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:0:0
    #22 0x5a2d9e2b4273 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:42:55
    #23 0x5a2d9e45c04b in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:629:12
    #24 0x5a2d9e36c9af in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:134:14
    #25 0x5a2d99da7576 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() ./../../third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:187:14
    #26 0x5a2d9e534b49 in base::(anonymous namespace)::ThreadFunc(void*) ./../../base/threading/platform_thread_posix.cc:103:13
    #27 0x5a2d88cf9b86 in asan_thread_start(void*) _asan_rtl_:28

0x706aed7ea2f0 is located 16 bytes inside of 64-byte region [0x706aed7ea2e0,0x706aed7ea320)
freed by thread T0 (chrome) here:
    #0 0x5a2d88d3688d in operator delete(void*) _asan_rtl_:3
    #1 0x5a2da2f00726 in ~vector ./../../third_party/libc++/src/include/__vector/vector.h:257:67
    #2 0x5a2da2f00726 in media::AudioBus::~AudioBus() ./../../media/base/audio_bus.cc:130:1
    #3 0x5a2da2f00853 in media::AudioBus::~AudioBus() ./../../media/base/audio_bus.cc:126:23
    #4 0x5a2d8bc9ae30 in operator() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:76:5
    #5 0x5a2d8bc9ae30 in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:287:7
    #6 0x5a2d8bc9ae30 in ~unique_ptr ./../../third_party/libc++/src/include/__memory/unique_ptr.h:256:71
    #7 0x5a2d8bc9ae30 in media::AudioPushFifo::~AudioPushFifo() ./../../media/base/audio_push_fifo.cc:19:31
    #8 0x5a2db1bb00ba in ~WebAudioMediaStreamSource ./../../third_party/blink/renderer/platform/mediastream/webaudio_media_stream_source.cc:29:1
    #9 0x5a2db1bb00ba in blink::WebAudioMediaStreamSource::~WebAudioMediaStreamSource() ./../../third_party/blink/renderer/platform/mediastream/webaudio_media_stream_source.cc:27:57
    #10 0x5a2db1bbd0a5 in operator() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:76:5
    #11 0x5a2db1bbd0a5 in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:287:7
    #12 0x5a2db1bbd0a5 in Dispose ./../../third_party/blink/renderer/platform/mediastream/media_stream_source.cc:264:20
    #13 0x5a2db1bbd0a5 in blink::MediaStreamSource::InvokePreFinalizer(cppgc::LivenessBroker const&, void*) ./../../third_party/blink/renderer/platform/mediastream/media_stream_source.h:60:3
    #14 0x5a2d9109b6e9 in operator() ./../../v8/src/heap/cppgc/prefinalizer-handler.cc:71:31
    #15 0x5a2d9109b6e9 in remove_if<std::__Cr::reverse_iterator<std::__Cr::__wrap_iter<cppgc::internal::PreFinalizer *> >, (lambda at ../../v8/src/heap/cppgc/prefinalizer-handler.cc:70:22)> ./../../third_party/libc++/src/include/__algorithm/remove_if.h:32:12
    #16 0x5a2d9109b6e9 in cppgc::internal::PreFinalizerHandler::InvokePreFinalizers() ./../../v8/src/heap/cppgc/prefinalizer-handler.cc:68:7
    #17 0x5a2d910688c7 in cppgc::internal::HeapBase::ExecutePreFinalizers() ./../../v8/src/heap/cppgc/heap-base.cc:169:26
    #18 0x5a2d8efb96e6 in v8::internal::CppHeap::CompactAndSweep() ./../../v8/src/heap/cppgc-js/cpp-heap.cc:990:51
    #19 0x5a2d8f0f1f05 in v8::internal::Heap::PerformGarbageCollection(v8::internal::GarbageCollector, v8::internal::GarbageCollectionReason, char const*) ./../../v8/src/heap/heap.cc:2299:32
    #20 0x5a2d8f1416fb in v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags)::$_0::operator()() const ./../../v8/src/heap/heap.cc:1670:7
    #21 0x5a2d8f140ecc in void heap::base::Stack::SetMarkerAndCallbackImpl<v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags)::$_0>(heap::base::Stack*, void*, void const*) ./../../v8/src/heap/base/stack.h:174:5
    #22 0x5a2d910c1c12 in PushAllRegistersAndIterateStack push_registers_asm.cc:0:0
    #23 0x5a2d8f0e59cc in SetMarkerIfNeededAndCallback<(lambda at ../../v8/src/heap/heap.cc:1638:40)> ./../../v8/src/heap/base/stack.h:76:7
    #24 0x5a2d8f0e59cc in v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) ./../../v8/src/heap/heap.cc:1638:11
    #25 0x5a2d8f0eb2a2 in CollectAllGarbage ./../../v8/src/heap/heap.cc:1269:3
    #26 0x5a2d8f0eb2a2 in v8::internal::Heap::HandleExternalMemoryInterrupt() ./../../v8/src/heap/heap.cc:1436:5
    #27 0x5a2d8f9d372e in CreateExtension ./../../v8/src/objects/js-array-buffer.cc:261:20
    #28 0x5a2d8f9d372e in v8::internal::JSArrayBuffer::Setup(v8::internal::SharedFlag, v8::internal::ResizableFlag, std::__Cr::shared_ptr<v8::internal::BackingStore>, v8::internal::Isolate*) ./../../v8/src/objects/js-array-buffer.cc:119:3
    #29 0x5a2d8f03de0d in v8::internal::Factory::NewJSArrayBuffer(std::__Cr::shared_ptr<v8::internal::BackingStore>, v8::internal::AllocationType) ./../../v8/src/heap/factory.cc:3504:11
    #30 0x5a2d90f06220 in v8::internal::WasmMemoryObject::New(v8::internal::Isolate*, int, int, v8::internal::SharedFlag, v8::internal::wasm::AddressType) ./../../v8/src/wasm/wasm-objects.cc:1000:33
    #31 0x5a2d90ea7dc9 in WebAssemblyMemoryImpl ./../../v8/src/wasm/wasm-js.cc:1632:8
    #32 0x5a2d90ea7dc9 in v8::internal::wasm::WebAssemblyMemory(v8::FunctionCallbackInfo<v8::Value> const&) ./../../v8/src/wasm/wasm-js.cc:3215:1
    #33 0x5a2d8ea4fc02 in v8::internal::FunctionCallbackArguments::CallOrConstruct(v8::internal::Tagged<v8::internal::FunctionTemplateInfo>, bool) ./../../v8/src/api/api-arguments-inl.h:93:3
    #34 0x5a2d8ea4df9a in v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<true>(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::HeapObject>, v8::internal::DirectHandle<v8::internal::FunctionTemplateInfo>, v8::internal::DirectHandle<v8::internal::Object>, unsigned long*, int) ./../../v8/src/builtins/builtins-api.cc:104:16
    #35 0x5a2d8ea4c06f in v8::internal::Builtin_Impl_HandleApiConstruct(v8::internal::BuiltinArguments, v8::internal::Isolate*) ./../../v8/src/builtins/builtins-api.cc:135:3
    #36 0x5a2d92ff2fb5 in Builtins_CEntry_Return1_ArgvOnStack_BuiltinExit setup-isolate-deserialize.cc:0:0
    #37 0x5a2d92f48aa4 in Builtins_JSBuiltinsConstructStub setup-isolate-deserialize.cc:0:0
    #24 0x5a2de008dbc4  ([anon:v8]+0x8dbc4)
    #25 0x5a2de0085664  ([anon:v8]+0x85664)
    #40 0x5a2d92f4971b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc:0:0
    #41 0x5a2d92f4946a in Builtins_JSEntry setup-isolate-deserialize.cc:0:0
    #42 0x5a2d8ee48571 in Call ./../../v8/src/execution/simulator.h:212:12
    #43 0x5a2d8ee48571 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) ./../../v8/src/execution/execution.cc:440:22
    #44 0x5a2d8ee46f89 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) ./../../v8/src/execution/execution.cc:530:10

previously allocated by thread T26 (Semi-Realtime A) here:
    #0 0x5a2d88d3602d in operator new(unsigned long) _asan_rtl_:3
    #1 0x5a2da2effb92 in __libcpp_operator_new<unsigned long> ./../../third_party/libc++/src/include/__new/allocate.h:37:10
    #2 0x5a2da2effb92 in __libcpp_allocate<base::span<float, 18446744073709551615UL, float *> > ./../../third_party/libc++/src/include/__new/allocate.h:64:28
    #3 0x5a2da2effb92 in allocate ./../../third_party/libc++/src/include/__memory/allocator.h:105:14
    #4 0x5a2da2effb92 in __allocate_at_least<std::__Cr::allocator<base::span<float, 18446744073709551615UL, float *> > > ./../../third_party/libc++/src/include/__memory/allocate_at_least.h:41:19
    #5 0x5a2da2effb92 in __split_buffer ./../../third_party/libc++/src/include/__split_buffer:325:25
    #6 0x5a2da2effb92 in std::__Cr::vector<base::span<float, 18446744073709551615ul, float*>, std::__Cr::allocator<base::span<float, 18446744073709551615ul, float*>>>::reserve(unsigned long) ./../../third_party/libc++/src/include/__vector/vector.h:1110:49
    #7 0x5a2da2efe575 in media::AudioBus::BuildChannelData(int, base::span<float, 18446744073709551615ul, float*>) ./../../media/base/audio_bus.cc:325:17
    #8 0x5a2da2efddf6 in media::AudioBus::AudioBus(int, int) ./../../media/base/audio_bus.cc:84:3
    #9 0x5a2da2f0089e in media::AudioBus::Create(int, int) ./../../media/base/audio_bus.cc:133:31
    #10 0x5a2d8bc9b244 in media::AudioPushFifo::Push(media::AudioBus const&) ./../../media/base/audio_push_fifo.cc:43:20
    #11 0x5a2db1bb09eb in blink::WebAudioMediaStreamSource::ConsumeAudio(WTF::Vector<float const*, 0u, WTF::PartitionAllocator> const&, int) ./../../third_party/blink/renderer/platform/mediastream/webaudio_media_stream_source.cc:78:9
    #12 0x5a2db1bcf4d0 in blink::MediaStreamAudioDestinationHandler::ConsumeAudio(blink::AudioBus*, int) ./../../third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_handler.cc:219:28
    #13 0x5a2db1bced69 in blink::MediaStreamAudioDestinationHandler::Process(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_handler.cc:89:3
    #14 0x5a2db1a86696 in blink::AudioHandler::ProcessIfNecessary(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/audio_handler.cc:325:7
    #15 0x5a2db1b788f3 in blink::DeferredTaskHandler::ProcessAutomaticPullNodes(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc:198:41
    #16 0x5a2db1c0d370 in blink::RealtimeAudioDestinationHandler::Render(blink::AudioBus*, unsigned int, blink::AudioIOPosition const&, blink::AudioCallbackMetric const&, base::TimeDelta, media::AudioGlitchInfo const&) ./../../third_party/blink/renderer/modules/webaudio/realtime_audio_destination_handler.cc:262:37
    #17 0x5a2db1c1bd0c in blink::AudioDestination::PullFromCallback(blink::AudioBus*, base::TimeDelta) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:672:14
    #18 0x5a2db1c154e0 in blink::AudioDestination::RequestRender(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks, bool) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:643:7
    #19 0x5a2db1c148ba in blink::AudioDestination::RequestRenderWait(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:559:8
    #20 0x5a2db1c1dcca in Invoke<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks> ./../../base/functional/bind_internal.h:731:12
    #21 0x5a2db1c1dcca in MakeItSo<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), std::__Cr::tuple<scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks> > ./../../base/functional/bind_internal.h:923:12
    #22 0x5a2db1c1dcca in RunImpl<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), std::__Cr::tuple<scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks>, 0UL, 1UL, 2UL, 3UL, 4UL, 5UL, 6UL> ./../../base/functional/bind_internal.h:1060:14
    #23 0x5a2db1c1dcca in base::internal::Invoker<base::internal::FunctorTraits<void (blink::AudioDestination::*&&)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks), scoped_refptr<blink::AudioDestination>&&, unsigned int&&, unsigned int&&, base::TimeDelta&&, base::TimeTicks&&, media::AudioGlitchInfo&&, base::TimeTicks&&>, base::internal::BindState<true, true, false, void (blink::AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks), scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:973:12
    #24 0x5a2d9e3e8da6 in Run ./../../base/functional/callback.h:156:12
    #25 0x5a2d9e3e8da6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/task/common/task_annotator.cc:209:34
    #26 0x5a2d9e45a768 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:458:11)> ./../../base/task/common/task_annotator.h:106:5
    #27 0x5a2d9e45a768 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:456:23
    #28 0x5a2d9e45964c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #29 0x5a2d9e45b49a in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:0:0
    #30 0x5a2d9e2b4273 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:42:55
    #31 0x5a2d9e45c04b in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:629:12
    #32 0x5a2d9e36c9af in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:134:14
    #33 0x5a2d99da7576 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() ./../../third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:187:14
    #34 0x5a2d9e534b49 in base::(anonymous namespace)::ThreadFunc(void*) ./../../base/threading/platform_thread_posix.cc:103:13
    #35 0x5a2d88cf9b86 in asan_thread_start(void*) _asan_rtl_:28

Thread T26 (Semi-Realtime A) created by T0 (chrome) here:
    #0 0x5a2d88ce0381 in ___interceptor_pthread_create _asan_rtl_:3
    #1 0x5a2d9e534138 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) ./../../base/threading/platform_thread_posix.cc:151:13
    #2 0x5a2d9e4d8f1c in base::SimpleThread::StartAsync() ./../../base/threading/simple_thread.cc:55:13
    #3 0x5a2d99da4f7a in blink::NonMainThread::CreateThread(blink::ThreadCreationParams const&) ./../../third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:41:11
    #4 0x5a2dae30a5da in blink::WorkerBackingThread::WorkerBackingThread(blink::ThreadCreationParams const&) ./../../third_party/blink/renderer/core/workers/worker_backing_thread.cc:125:23
    #5 0x5a2db1c40850 in make_unique<blink::WorkerBackingThread, const blink::ThreadCreationParams &, 0> ./../../third_party/libc++/src/include/__memory/unique_ptr.h:754:30
    #6 0x5a2db1c40850 in blink::WorkletThreadHolder<blink::SemiRealtimeAudioWorkletThread>::EnsureInstance(blink::ThreadCreationParams const&) ./../../third_party/blink/renderer/core/workers/worklet_thread_holder.h:36:9
    #7 0x5a2db1c41a77 in EnsureSharedBackingThread ./../../third_party/blink/renderer/modules/webaudio/semi_realtime_audio_worklet_thread.cc:24:3
    #8 0x5a2db1c41a77 in blink::SemiRealtimeAudioWorkletThread::SemiRealtimeAudioWorkletThread(blink::WorkerReportingProxy&) ./../../third_party/blink/renderer/modules/webaudio/semi_realtime_audio_worklet_thread.cc:53:5
    #9 0x5a2db1b02498 in make_unique<blink::SemiRealtimeAudioWorkletThread, blink::WorkerReportingProxy &, 0> ./../../third_party/libc++/src/include/__memory/unique_ptr.h:754:30
    #10 0x5a2db1b02498 in CreateWorkletThreadWithConstraints ./../../third_party/blink/renderer/modules/webaudio/audio_worklet_messaging_proxy.cc:136:10
    #11 0x5a2db1b02498 in blink::AudioWorkletMessagingProxy::CreateWorkerThread() ./../../third_party/blink/renderer/modules/webaudio/audio_worklet_messaging_proxy.cc:117:10
    #12 0x5a2dae301725 in blink::ThreadedMessagingProxyBase::InitializeWorkerThread(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::optional<blink::WorkerBackingThreadStartupData> const&, std::__Cr::optional<base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const> const&, std::__Cr::unique_ptr<blink::WorkerDevToolsParams, std::__Cr::default_delete<blink::WorkerDevToolsParams>>) ./../../third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc:77:20
    #13 0x5a2db1b085c8 in blink::ThreadedWorkletMessagingProxy::Initialize(blink::WorkerClients*, blink::WorkletModuleResponsesMap*, std::__Cr::optional<blink::WorkerBackingThreadStartupData> const&, mojo::StructPtr<blink::mojom::blink::WorkletGlobalScopeCreationParams>) ./../../third_party/blink/renderer/core/workers/threaded_worklet_messaging_proxy.cc:161:3
    #14 0x5a2db1aff34d in blink::AudioWorklet::CreateGlobalScope() ./../../third_party/blink/renderer/modules/webaudio/audio_worklet.cc:81:10
    #15 0x5a2dae34ba0f in blink::Worklet::FetchAndInvokeScript(blink::KURL const&, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks*) ./../../third_party/blink/renderer/core/workers/worklet.cc:170:24
    #16 0x5a2dae34c9a9 in Invoke<void (Worklet::*)(const blink::KURL &, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks *), cppgc::internal::BasicPersistent<blink::Worklet, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, blink::KURL, blink::V8RequestCredentials::Enum, cppgc::internal::BasicPersistent<blink::WorkletPendingTasks, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> > ./../../base/functional/bind_internal.h:731:12
    #17 0x5a2dae34c9a9 in MakeItSo<void (Worklet::*)(const blink::KURL &, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks *), std::__Cr::tuple<cppgc::internal::BasicPersistent<blink::Worklet, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, blink::KURL, blink::V8RequestCredentials::Enum, cppgc::internal::BasicPersistent<blink::WorkletPendingTasks, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> > > ./../../base/functional/bind_internal.h:923:12
    #18 0x5a2dae34c9a9 in RunImpl<void (Worklet::*)(const blink::KURL &, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks *), std::__Cr::tuple<cppgc::internal::BasicPersistent<blink::Worklet, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, blink::KURL, blink::V8RequestCredentials::Enum, cppgc::internal::BasicPersistent<blink::WorkletPendingTasks, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> >, 0UL, 1UL, 2UL, 3UL> ./../../base/functional/bind_internal.h:1060:14
    #19 0x5a2dae34c9a9 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::Worklet::*&&)(blink::KURL const&, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks*), cppgc::internal::BasicPersistent<blink::Worklet, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, blink::KURL&&, blink::V8RequestCredentials::Enum&&, cppgc::internal::BasicPersistent<blink::WorkletPendingTasks, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&>, base::internal::BindState<true, true, false, void (blink::Worklet::*)(blink::KURL const&, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks*), cppgc::internal::BasicPersistent<blink::Worklet, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, blink::KURL, blink::V8RequestCredentials::Enum, cppgc::internal::BasicPersistent<blink::WorkletPendingTasks, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:973:12
    #20 0x5a2d9e3e8da6 in Run ./../../base/functional/callback.h:156:12
    #21 0x5a2d9e3e8da6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/task/common/task_annotator.cc:209:34
    #22 0x5a2d9e45a768 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:458:11)> ./../../base/task/common/task_annotator.h:106:5
    #23 0x5a2d9e45a768 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:456:23
    #24 0x5a2d9e45964c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #25 0x5a2d9e45b49a in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:0:0
    #26 0x5a2d9e2b4273 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:42:55
    #27 0x5a2d9e45c04b in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:629:12
    #28 0x5a2d9e36c9af in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:134:14
    #29 0x5a2db61dd704 in content::RendererMain(content::MainFunctionParams) ./../../content/renderer/renderer_main.cc:369:16
    #30 0x5a2d9b145945 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:781:14
    #31 0x5a2d9b148345 in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner_impl.cc:1155:10
    #32 0x5a2d9b14290b in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ./../../content/app/content_main.cc:359:36
    #33 0x5a2d9b142e2b in content::ContentMain(content::ContentMainParams) ./../../content/app/content_main.cc:372:10
    #34 0x5a2d88d3793f in ChromeMain ./../../chrome/app/chrome_main.cc:222:12
    #35 0x740afb82a1c9 in __libc_init_first ??:?
    #36 0x740afb82a28a in __libc_start_main ??:0:0
    #37 0x5a2d88c5c029 in _start ??:0:0

SUMMARY: AddressSanitizer: heap-use-after-free (/mnt/hdd/projects/fuzzframe/gen/browser/chrome/asan-linux-release-1444497/chrome+0x299bd752) (BuildId: 87a681a21b42e59d)
Shadow bytes around the buggy address:
  0x706aed7ea000: fd fd fd fd fa fa f7 fa fd fd fd fd fd fd fd fd
  0x706aed7ea080: fa fa f7 fa fd fd fd fd fd fd fd fd fa fa f7 fa
  0x706aed7ea100: fd fd fd fd fd fd fd fa fa fa f7 fa fd fd fd fd
  0x706aed7ea180: fd fd fd fd fa fa f7 fa 00 00 00 00 00 00 00 00
  0x706aed7ea200: fa fa f7 fa fd fd fd fd fd fd fd fa fa fa f7 fa
=>0x706aed7ea280: fd fd fd fd fd fd fd fd fa fa f7 fa fd fd[fd]fd
  0x706aed7ea300: fd fd fd fd fa fa f7 fa fd fd fd fd fd fd fd fd
  0x706aed7ea380: fa fa f7 fa fd fd fd fd fd fd fd fd fa fa f7 fa
  0x706aed7ea400: fd fd fd fd fd fd fd fa fa fa f7 fa fd fd fd fd
  0x706aed7ea480: fd fd fd fd fa fa f7 fa fd fd fd fd fd fd fd fd
  0x706aed7ea500: fa fa f7 fa fd fd fd fd fd fd fd fd fa fa f7 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==4065400==ADDITIONAL INFO

==4065400==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5a2db1c12bf6 in blink::AudioDestination::Render(base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, media::AudioBus*) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:176:34

Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=4063554 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/mnt/hdd/projects/fuzzframe/gen/profiles/axozvv_g --change-stack-guard-on-fork=enable --no-sandbox --autoplay-policy=no-user-gesture-required --enable-experimental-web-platform-features --enable-blink-test-features --file-url-path-alias=/gen=/mnt/hdd/projects/fuzzframe/gen/browser/chrome/asan-linux-release-1444497/gen --no-zygote --remote-debugging-port=0 --use-cmd-decoder=passthrough --use-fake-ui-for-media-stream --enable-gpu-benchmarking --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --time-ticks-at-unix-epoch=-1744620123386165 --launch-time-ticks=383119095541 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,4833047310778064916,10982801936508415139,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyIncludeJSCallStacksInCrashReports,DocumentPolicyNegotiation,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PartitionedPopins,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessHeaders,ThirdPartyStoragePartitioning --disable-features=PaintHolding --variations-seed-version --enable-logging --v=0`

MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==4065400==END OF ADDITIONAL INFO
==4065400==ABORTING

Reporter credit:

Reporter credit: Huang Xilin of Ant Group Light-Year Security Lab

Additional Data

Category: Security
Chrome Channel: Dev
Regression: N/A

View on issue tracker
Links in the report
On This Page