Steps to reproduce the problem

This vulnerability is a race condition vulnerability with a very low probability of being triggered. I am still trying to reproduce the vulnerability and construct a PoC.

Problem Description

I currently don’t know the root cause of this vulnerability. For now, I can only provide the stack backtrace of the vulnerability. You can analyze it based on the stack backtrace first, and I will provide a more detailed vulnerability analysis later.

Summary

Security: Uaf in media::AudioBus

Custom Questions

Type of crash:

tab

Crash state:

==4065400==ERROR: AddressSanitizer: heap-use-after-free on address 0x706aed7ea2f0 at pc 0x5a2da2f06753 bp 0x700a511fcc70 sp 0x700a511fcc68
READ of size 8 at 0x706aed7ea2f0 thread T26 (Semi-Realtime A)
==4065400==WARNING: invalid path to external symbolizer!
==4065400==WARNING: Failed to use and restart external symbolizer!
    #0 0x5a2da2f06752 in media::AudioBus::AllChannelsSubspan(unsigned long, unsigned long) const ./../../media/base/audio_bus.cc:406:24
    #1 0x5a2da2f05d1b in media::AudioBus::CopyPartialFramesTo(int, int, int, media::AudioBus*) const ./../../media/base/audio_bus.cc:370:39
    #2 0x5a2d8bc9b388 in media::AudioPushFifo::Push(media::AudioBus const&) ./../../media/base/audio_push_fifo.cc:60:17
    #3 0x5a2db1bb09eb in blink::WebAudioMediaStreamSource::ConsumeAudio(WTF::Vector<float const*, 0u, WTF::PartitionAllocator> const&, int) ./../../third_party/blink/renderer/platform/mediastream/webaudio_media_stream_source.cc:78:9
    #4 0x5a2db1bcf4d0 in blink::MediaStreamAudioDestinationHandler::ConsumeAudio(blink::AudioBus*, int) ./../../third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_handler.cc:219:28
    #5 0x5a2db1bced69 in blink::MediaStreamAudioDestinationHandler::Process(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_handler.cc:89:3
    #6 0x5a2db1a86696 in blink::AudioHandler::ProcessIfNecessary(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/audio_handler.cc:325:7
    #7 0x5a2db1b788f3 in blink::DeferredTaskHandler::ProcessAutomaticPullNodes(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc:198:41
    #8 0x5a2db1c0d370 in blink::RealtimeAudioDestinationHandler::Render(blink::AudioBus*, unsigned int, blink::AudioIOPosition const&, blink::AudioCallbackMetric const&, base::TimeDelta, media::AudioGlitchInfo const&) ./../../third_party/blink/renderer/modules/webaudio/realtime_audio_destination_handler.cc:262:37
    #9 0x5a2db1c1bd0c in blink::AudioDestination::PullFromCallback(blink::AudioBus*, base::TimeDelta) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:672:14
    #10 0x5a2db1c154e0 in blink::AudioDestination::RequestRender(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks, bool) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:643:7
    #11 0x5a2db1c148ba in blink::AudioDestination::RequestRenderWait(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:559:8
    #12 0x5a2db1c1dcca in Invoke<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks> ./../../base/functional/bind_internal.h:731:12
    #13 0x5a2db1c1dcca in MakeItSo<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), std::__Cr::tuple<scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks> > ./../../base/functional/bind_internal.h:923:12
    #14 0x5a2db1c1dcca in RunImpl<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), std::__Cr::tuple<scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks>, 0UL, 1UL, 2UL, 3UL, 4UL, 5UL, 6UL> ./../../base/functional/bind_internal.h:1060:14
    #15 0x5a2db1c1dcca in base::internal::Invoker<base::internal::FunctorTraits<void (blink::AudioDestination::*&&)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks), scoped_refptr<blink::AudioDestination>&&, unsigned int&&, unsigned int&&, base::TimeDelta&&, base::TimeTicks&&, media::AudioGlitchInfo&&, base::TimeTicks&&>, base::internal::BindState<true, true, false, void (blink::AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks), scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:973:12
    #16 0x5a2d9e3e8da6 in Run ./../../base/functional/callback.h:156:12
    #17 0x5a2d9e3e8da6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/task/common/task_annotator.cc:209:34
    #18 0x5a2d9e45a768 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:458:11)> ./../../base/task/common/task_annotator.h:106:5
    #19 0x5a2d9e45a768 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:456:23
    #20 0x5a2d9e45964c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #21 0x5a2d9e45b49a in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:0:0
    #22 0x5a2d9e2b4273 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:42:55
    #23 0x5a2d9e45c04b in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:629:12
    #24 0x5a2d9e36c9af in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:134:14
    #25 0x5a2d99da7576 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() ./../../third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:187:14
    #26 0x5a2d9e534b49 in base::(anonymous namespace)::ThreadFunc(void*) ./../../base/threading/platform_thread_posix.cc:103:13
    #27 0x5a2d88cf9b86 in asan_thread_start(void*) _asan_rtl_:28

0x706aed7ea2f0 is located 16 bytes inside of 64-byte region [0x706aed7ea2e0,0x706aed7ea320)
freed by thread T0 (chrome) here:
    #0 0x5a2d88d3688d in operator delete(void*) _asan_rtl_:3
    #1 0x5a2da2f00726 in ~vector ./../../third_party/libc++/src/include/__vector/vector.h:257:67
    #2 0x5a2da2f00726 in media::AudioBus::~AudioBus() ./../../media/base/audio_bus.cc:130:1
    #3 0x5a2da2f00853 in media::AudioBus::~AudioBus() ./../../media/base/audio_bus.cc:126:23
    #4 0x5a2d8bc9ae30 in operator() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:76:5
    #5 0x5a2d8bc9ae30 in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:287:7
    #6 0x5a2d8bc9ae30 in ~unique_ptr ./../../third_party/libc++/src/include/__memory/unique_ptr.h:256:71
    #7 0x5a2d8bc9ae30 in media::AudioPushFifo::~AudioPushFifo() ./../../media/base/audio_push_fifo.cc:19:31
    #8 0x5a2db1bb00ba in ~WebAudioMediaStreamSource ./../../third_party/blink/renderer/platform/mediastream/webaudio_media_stream_source.cc:29:1
    #9 0x5a2db1bb00ba in blink::WebAudioMediaStreamSource::~WebAudioMediaStreamSource() ./../../third_party/blink/renderer/platform/mediastream/webaudio_media_stream_source.cc:27:57
    #10 0x5a2db1bbd0a5 in operator() ./../../third_party/libc++/src/include/__memory/unique_ptr.h:76:5
    #11 0x5a2db1bbd0a5 in reset ./../../third_party/libc++/src/include/__memory/unique_ptr.h:287:7
    #12 0x5a2db1bbd0a5 in Dispose ./../../third_party/blink/renderer/platform/mediastream/media_stream_source.cc:264:20
    #13 0x5a2db1bbd0a5 in blink::MediaStreamSource::InvokePreFinalizer(cppgc::LivenessBroker const&, void*) ./../../third_party/blink/renderer/platform/mediastream/media_stream_source.h:60:3
    #14 0x5a2d9109b6e9 in operator() ./../../v8/src/heap/cppgc/prefinalizer-handler.cc:71:31
    #15 0x5a2d9109b6e9 in remove_if<std::__Cr::reverse_iterator<std::__Cr::__wrap_iter<cppgc::internal::PreFinalizer *> >, (lambda at ../../v8/src/heap/cppgc/prefinalizer-handler.cc:70:22)> ./../../third_party/libc++/src/include/__algorithm/remove_if.h:32:12
    #16 0x5a2d9109b6e9 in cppgc::internal::PreFinalizerHandler::InvokePreFinalizers() ./../../v8/src/heap/cppgc/prefinalizer-handler.cc:68:7
    #17 0x5a2d910688c7 in cppgc::internal::HeapBase::ExecutePreFinalizers() ./../../v8/src/heap/cppgc/heap-base.cc:169:26
    #18 0x5a2d8efb96e6 in v8::internal::CppHeap::CompactAndSweep() ./../../v8/src/heap/cppgc-js/cpp-heap.cc:990:51
    #19 0x5a2d8f0f1f05 in v8::internal::Heap::PerformGarbageCollection(v8::internal::GarbageCollector, v8::internal::GarbageCollectionReason, char const*) ./../../v8/src/heap/heap.cc:2299:32
    #20 0x5a2d8f1416fb in v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags)::$_0::operator()() const ./../../v8/src/heap/heap.cc:1670:7
    #21 0x5a2d8f140ecc in void heap::base::Stack::SetMarkerAndCallbackImpl<v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags)::$_0>(heap::base::Stack*, void*, void const*) ./../../v8/src/heap/base/stack.h:174:5
    #22 0x5a2d910c1c12 in PushAllRegistersAndIterateStack push_registers_asm.cc:0:0
    #23 0x5a2d8f0e59cc in SetMarkerIfNeededAndCallback<(lambda at ../../v8/src/heap/heap.cc:1638:40)> ./../../v8/src/heap/base/stack.h:76:7
    #24 0x5a2d8f0e59cc in v8::internal::Heap::CollectGarbage(v8::internal::AllocationSpace, v8::internal::GarbageCollectionReason, v8::GCCallbackFlags) ./../../v8/src/heap/heap.cc:1638:11
    #25 0x5a2d8f0eb2a2 in CollectAllGarbage ./../../v8/src/heap/heap.cc:1269:3
    #26 0x5a2d8f0eb2a2 in v8::internal::Heap::HandleExternalMemoryInterrupt() ./../../v8/src/heap/heap.cc:1436:5
    #27 0x5a2d8f9d372e in CreateExtension ./../../v8/src/objects/js-array-buffer.cc:261:20
    #28 0x5a2d8f9d372e in v8::internal::JSArrayBuffer::Setup(v8::internal::SharedFlag, v8::internal::ResizableFlag, std::__Cr::shared_ptr<v8::internal::BackingStore>, v8::internal::Isolate*) ./../../v8/src/objects/js-array-buffer.cc:119:3
    #29 0x5a2d8f03de0d in v8::internal::Factory::NewJSArrayBuffer(std::__Cr::shared_ptr<v8::internal::BackingStore>, v8::internal::AllocationType) ./../../v8/src/heap/factory.cc:3504:11
    #30 0x5a2d90f06220 in v8::internal::WasmMemoryObject::New(v8::internal::Isolate*, int, int, v8::internal::SharedFlag, v8::internal::wasm::AddressType) ./../../v8/src/wasm/wasm-objects.cc:1000:33
    #31 0x5a2d90ea7dc9 in WebAssemblyMemoryImpl ./../../v8/src/wasm/wasm-js.cc:1632:8
    #32 0x5a2d90ea7dc9 in v8::internal::wasm::WebAssemblyMemory(v8::FunctionCallbackInfo<v8::Value> const&) ./../../v8/src/wasm/wasm-js.cc:3215:1
    #33 0x5a2d8ea4fc02 in v8::internal::FunctionCallbackArguments::CallOrConstruct(v8::internal::Tagged<v8::internal::FunctionTemplateInfo>, bool) ./../../v8/src/api/api-arguments-inl.h:93:3
    #34 0x5a2d8ea4df9a in v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<true>(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::HeapObject>, v8::internal::DirectHandle<v8::internal::FunctionTemplateInfo>, v8::internal::DirectHandle<v8::internal::Object>, unsigned long*, int) ./../../v8/src/builtins/builtins-api.cc:104:16
    #35 0x5a2d8ea4c06f in v8::internal::Builtin_Impl_HandleApiConstruct(v8::internal::BuiltinArguments, v8::internal::Isolate*) ./../../v8/src/builtins/builtins-api.cc:135:3
    #36 0x5a2d92ff2fb5 in Builtins_CEntry_Return1_ArgvOnStack_BuiltinExit setup-isolate-deserialize.cc:0:0
    #37 0x5a2d92f48aa4 in Builtins_JSBuiltinsConstructStub setup-isolate-deserialize.cc:0:0
    #24 0x5a2de008dbc4  ([anon:v8]+0x8dbc4)
    #25 0x5a2de0085664  ([anon:v8]+0x85664)
    #40 0x5a2d92f4971b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc:0:0
    #41 0x5a2d92f4946a in Builtins_JSEntry setup-isolate-deserialize.cc:0:0
    #42 0x5a2d8ee48571 in Call ./../../v8/src/execution/simulator.h:212:12
    #43 0x5a2d8ee48571 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) ./../../v8/src/execution/execution.cc:440:22
    #44 0x5a2d8ee46f89 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) ./../../v8/src/execution/execution.cc:530:10

previously allocated by thread T26 (Semi-Realtime A) here:
    #0 0x5a2d88d3602d in operator new(unsigned long) _asan_rtl_:3
    #1 0x5a2da2effb92 in __libcpp_operator_new<unsigned long> ./../../third_party/libc++/src/include/__new/allocate.h:37:10
    #2 0x5a2da2effb92 in __libcpp_allocate<base::span<float, 18446744073709551615UL, float *> > ./../../third_party/libc++/src/include/__new/allocate.h:64:28
    #3 0x5a2da2effb92 in allocate ./../../third_party/libc++/src/include/__memory/allocator.h:105:14
    #4 0x5a2da2effb92 in __allocate_at_least<std::__Cr::allocator<base::span<float, 18446744073709551615UL, float *> > > ./../../third_party/libc++/src/include/__memory/allocate_at_least.h:41:19
    #5 0x5a2da2effb92 in __split_buffer ./../../third_party/libc++/src/include/__split_buffer:325:25
    #6 0x5a2da2effb92 in std::__Cr::vector<base::span<float, 18446744073709551615ul, float*>, std::__Cr::allocator<base::span<float, 18446744073709551615ul, float*>>>::reserve(unsigned long) ./../../third_party/libc++/src/include/__vector/vector.h:1110:49
    #7 0x5a2da2efe575 in media::AudioBus::BuildChannelData(int, base::span<float, 18446744073709551615ul, float*>) ./../../media/base/audio_bus.cc:325:17
    #8 0x5a2da2efddf6 in media::AudioBus::AudioBus(int, int) ./../../media/base/audio_bus.cc:84:3
    #9 0x5a2da2f0089e in media::AudioBus::Create(int, int) ./../../media/base/audio_bus.cc:133:31
    #10 0x5a2d8bc9b244 in media::AudioPushFifo::Push(media::AudioBus const&) ./../../media/base/audio_push_fifo.cc:43:20
    #11 0x5a2db1bb09eb in blink::WebAudioMediaStreamSource::ConsumeAudio(WTF::Vector<float const*, 0u, WTF::PartitionAllocator> const&, int) ./../../third_party/blink/renderer/platform/mediastream/webaudio_media_stream_source.cc:78:9
    #12 0x5a2db1bcf4d0 in blink::MediaStreamAudioDestinationHandler::ConsumeAudio(blink::AudioBus*, int) ./../../third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_handler.cc:219:28
    #13 0x5a2db1bced69 in blink::MediaStreamAudioDestinationHandler::Process(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/media_stream_audio_destination_handler.cc:89:3
    #14 0x5a2db1a86696 in blink::AudioHandler::ProcessIfNecessary(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/audio_handler.cc:325:7
    #15 0x5a2db1b788f3 in blink::DeferredTaskHandler::ProcessAutomaticPullNodes(unsigned int) ./../../third_party/blink/renderer/modules/webaudio/deferred_task_handler.cc:198:41
    #16 0x5a2db1c0d370 in blink::RealtimeAudioDestinationHandler::Render(blink::AudioBus*, unsigned int, blink::AudioIOPosition const&, blink::AudioCallbackMetric const&, base::TimeDelta, media::AudioGlitchInfo const&) ./../../third_party/blink/renderer/modules/webaudio/realtime_audio_destination_handler.cc:262:37
    #17 0x5a2db1c1bd0c in blink::AudioDestination::PullFromCallback(blink::AudioBus*, base::TimeDelta) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:672:14
    #18 0x5a2db1c154e0 in blink::AudioDestination::RequestRender(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks, bool) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:643:7
    #19 0x5a2db1c148ba in blink::AudioDestination::RequestRenderWait(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:559:8
    #20 0x5a2db1c1dcca in Invoke<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks> ./../../base/functional/bind_internal.h:731:12
    #21 0x5a2db1c1dcca in MakeItSo<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), std::__Cr::tuple<scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks> > ./../../base/functional/bind_internal.h:923:12
    #22 0x5a2db1c1dcca in RunImpl<void (AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, const media::AudioGlitchInfo &, base::TimeTicks), std::__Cr::tuple<scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks>, 0UL, 1UL, 2UL, 3UL, 4UL, 5UL, 6UL> ./../../base/functional/bind_internal.h:1060:14
    #23 0x5a2db1c1dcca in base::internal::Invoker<base::internal::FunctorTraits<void (blink::AudioDestination::*&&)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks), scoped_refptr<blink::AudioDestination>&&, unsigned int&&, unsigned int&&, base::TimeDelta&&, base::TimeTicks&&, media::AudioGlitchInfo&&, base::TimeTicks&&>, base::internal::BindState<true, true, false, void (blink::AudioDestination::*)(unsigned long, unsigned long, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, base::TimeTicks), scoped_refptr<blink::AudioDestination>, unsigned int, unsigned int, base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo, base::TimeTicks>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:973:12
    #24 0x5a2d9e3e8da6 in Run ./../../base/functional/callback.h:156:12
    #25 0x5a2d9e3e8da6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/task/common/task_annotator.cc:209:34
    #26 0x5a2d9e45a768 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:458:11)> ./../../base/task/common/task_annotator.h:106:5
    #27 0x5a2d9e45a768 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:456:23
    #28 0x5a2d9e45964c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #29 0x5a2d9e45b49a in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:0:0
    #30 0x5a2d9e2b4273 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:42:55
    #31 0x5a2d9e45c04b in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:629:12
    #32 0x5a2d9e36c9af in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:134:14
    #33 0x5a2d99da7576 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() ./../../third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:187:14
    #34 0x5a2d9e534b49 in base::(anonymous namespace)::ThreadFunc(void*) ./../../base/threading/platform_thread_posix.cc:103:13
    #35 0x5a2d88cf9b86 in asan_thread_start(void*) _asan_rtl_:28

Thread T26 (Semi-Realtime A) created by T0 (chrome) here:
    #0 0x5a2d88ce0381 in ___interceptor_pthread_create _asan_rtl_:3
    #1 0x5a2d9e534138 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) ./../../base/threading/platform_thread_posix.cc:151:13
    #2 0x5a2d9e4d8f1c in base::SimpleThread::StartAsync() ./../../base/threading/simple_thread.cc:55:13
    #3 0x5a2d99da4f7a in blink::NonMainThread::CreateThread(blink::ThreadCreationParams const&) ./../../third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:41:11
    #4 0x5a2dae30a5da in blink::WorkerBackingThread::WorkerBackingThread(blink::ThreadCreationParams const&) ./../../third_party/blink/renderer/core/workers/worker_backing_thread.cc:125:23
    #5 0x5a2db1c40850 in make_unique<blink::WorkerBackingThread, const blink::ThreadCreationParams &, 0> ./../../third_party/libc++/src/include/__memory/unique_ptr.h:754:30
    #6 0x5a2db1c40850 in blink::WorkletThreadHolder<blink::SemiRealtimeAudioWorkletThread>::EnsureInstance(blink::ThreadCreationParams const&) ./../../third_party/blink/renderer/core/workers/worklet_thread_holder.h:36:9
    #7 0x5a2db1c41a77 in EnsureSharedBackingThread ./../../third_party/blink/renderer/modules/webaudio/semi_realtime_audio_worklet_thread.cc:24:3
    #8 0x5a2db1c41a77 in blink::SemiRealtimeAudioWorkletThread::SemiRealtimeAudioWorkletThread(blink::WorkerReportingProxy&) ./../../third_party/blink/renderer/modules/webaudio/semi_realtime_audio_worklet_thread.cc:53:5
    #9 0x5a2db1b02498 in make_unique<blink::SemiRealtimeAudioWorkletThread, blink::WorkerReportingProxy &, 0> ./../../third_party/libc++/src/include/__memory/unique_ptr.h:754:30
    #10 0x5a2db1b02498 in CreateWorkletThreadWithConstraints ./../../third_party/blink/renderer/modules/webaudio/audio_worklet_messaging_proxy.cc:136:10
    #11 0x5a2db1b02498 in blink::AudioWorkletMessagingProxy::CreateWorkerThread() ./../../third_party/blink/renderer/modules/webaudio/audio_worklet_messaging_proxy.cc:117:10
    #12 0x5a2dae301725 in blink::ThreadedMessagingProxyBase::InitializeWorkerThread(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::optional<blink::WorkerBackingThreadStartupData> const&, std::__Cr::optional<base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const> const&, std::__Cr::unique_ptr<blink::WorkerDevToolsParams, std::__Cr::default_delete<blink::WorkerDevToolsParams>>) ./../../third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc:77:20
    #13 0x5a2db1b085c8 in blink::ThreadedWorkletMessagingProxy::Initialize(blink::WorkerClients*, blink::WorkletModuleResponsesMap*, std::__Cr::optional<blink::WorkerBackingThreadStartupData> const&, mojo::StructPtr<blink::mojom::blink::WorkletGlobalScopeCreationParams>) ./../../third_party/blink/renderer/core/workers/threaded_worklet_messaging_proxy.cc:161:3
    #14 0x5a2db1aff34d in blink::AudioWorklet::CreateGlobalScope() ./../../third_party/blink/renderer/modules/webaudio/audio_worklet.cc:81:10
    #15 0x5a2dae34ba0f in blink::Worklet::FetchAndInvokeScript(blink::KURL const&, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks*) ./../../third_party/blink/renderer/core/workers/worklet.cc:170:24
    #16 0x5a2dae34c9a9 in Invoke<void (Worklet::*)(const blink::KURL &, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks *), cppgc::internal::BasicPersistent<blink::Worklet, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, blink::KURL, blink::V8RequestCredentials::Enum, cppgc::internal::BasicPersistent<blink::WorkletPendingTasks, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> > ./../../base/functional/bind_internal.h:731:12
    #17 0x5a2dae34c9a9 in MakeItSo<void (Worklet::*)(const blink::KURL &, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks *), std::__Cr::tuple<cppgc::internal::BasicPersistent<blink::Worklet, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, blink::KURL, blink::V8RequestCredentials::Enum, cppgc::internal::BasicPersistent<blink::WorkletPendingTasks, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> > > ./../../base/functional/bind_internal.h:923:12
    #18 0x5a2dae34c9a9 in RunImpl<void (Worklet::*)(const blink::KURL &, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks *), std::__Cr::tuple<cppgc::internal::BasicPersistent<blink::Worklet, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, blink::KURL, blink::V8RequestCredentials::Enum, cppgc::internal::BasicPersistent<blink::WorkletPendingTasks, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> >, 0UL, 1UL, 2UL, 3UL> ./../../base/functional/bind_internal.h:1060:14
    #19 0x5a2dae34c9a9 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::Worklet::*&&)(blink::KURL const&, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks*), cppgc::internal::BasicPersistent<blink::Worklet, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, blink::KURL&&, blink::V8RequestCredentials::Enum&&, cppgc::internal::BasicPersistent<blink::WorkletPendingTasks, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&>, base::internal::BindState<true, true, false, void (blink::Worklet::*)(blink::KURL const&, blink::V8RequestCredentials::Enum, blink::WorkletPendingTasks*), cppgc::internal::BasicPersistent<blink::Worklet, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, blink::KURL, blink::V8RequestCredentials::Enum, cppgc::internal::BasicPersistent<blink::WorkletPendingTasks, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:973:12
    #20 0x5a2d9e3e8da6 in Run ./../../base/functional/callback.h:156:12
    #21 0x5a2d9e3e8da6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/task/common/task_annotator.cc:209:34
    #22 0x5a2d9e45a768 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:458:11)> ./../../base/task/common/task_annotator.h:106:5
    #23 0x5a2d9e45a768 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:456:23
    #24 0x5a2d9e45964c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #25 0x5a2d9e45b49a in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:0:0
    #26 0x5a2d9e2b4273 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:42:55
    #27 0x5a2d9e45c04b in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:629:12
    #28 0x5a2d9e36c9af in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:134:14
    #29 0x5a2db61dd704 in content::RendererMain(content::MainFunctionParams) ./../../content/renderer/renderer_main.cc:369:16
    #30 0x5a2d9b145945 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:781:14
    #31 0x5a2d9b148345 in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner_impl.cc:1155:10
    #32 0x5a2d9b14290b in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ./../../content/app/content_main.cc:359:36
    #33 0x5a2d9b142e2b in content::ContentMain(content::ContentMainParams) ./../../content/app/content_main.cc:372:10
    #34 0x5a2d88d3793f in ChromeMain ./../../chrome/app/chrome_main.cc:222:12
    #35 0x740afb82a1c9 in __libc_init_first ??:?
    #36 0x740afb82a28a in __libc_start_main ??:0:0
    #37 0x5a2d88c5c029 in _start ??:0:0

SUMMARY: AddressSanitizer: heap-use-after-free (/mnt/hdd/projects/fuzzframe/gen/browser/chrome/asan-linux-release-1444497/chrome+0x299bd752) (BuildId: 87a681a21b42e59d)
Shadow bytes around the buggy address:
  0x706aed7ea000: fd fd fd fd fa fa f7 fa fd fd fd fd fd fd fd fd
  0x706aed7ea080: fa fa f7 fa fd fd fd fd fd fd fd fd fa fa f7 fa
  0x706aed7ea100: fd fd fd fd fd fd fd fa fa fa f7 fa fd fd fd fd
  0x706aed7ea180: fd fd fd fd fa fa f7 fa 00 00 00 00 00 00 00 00
  0x706aed7ea200: fa fa f7 fa fd fd fd fd fd fd fd fa fa fa f7 fa
=>0x706aed7ea280: fd fd fd fd fd fd fd fd fa fa f7 fa fd fd[fd]fd
  0x706aed7ea300: fd fd fd fd fa fa f7 fa fd fd fd fd fd fd fd fd
  0x706aed7ea380: fa fa f7 fa fd fd fd fd fd fd fd fd fa fa f7 fa
  0x706aed7ea400: fd fd fd fd fd fd fd fa fa fa f7 fa fd fd fd fd
  0x706aed7ea480: fd fd fd fd fa fa f7 fa fd fd fd fd fd fd fd fd
  0x706aed7ea500: fa fa f7 fa fd fd fd fd fd fd fd fd fa fa f7 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==4065400==ADDITIONAL INFO

==4065400==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5a2db1c12bf6 in blink::AudioDestination::Render(base::TimeDelta, base::TimeTicks, media::AudioGlitchInfo const&, media::AudioBus*) ./../../third_party/blink/renderer/platform/audio/audio_destination.cc:176:34

Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=4063554 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/mnt/hdd/projects/fuzzframe/gen/profiles/axozvv_g --change-stack-guard-on-fork=enable --no-sandbox --autoplay-policy=no-user-gesture-required --enable-experimental-web-platform-features --enable-blink-test-features --file-url-path-alias=/gen=/mnt/hdd/projects/fuzzframe/gen/browser/chrome/asan-linux-release-1444497/gen --no-zygote --remote-debugging-port=0 --use-cmd-decoder=passthrough --use-fake-ui-for-media-stream --enable-gpu-benchmarking --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --time-ticks-at-unix-epoch=-1744620123386165 --launch-time-ticks=383119095541 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,4833047310778064916,10982801936508415139,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyIncludeJSCallStacksInCrashReports,DocumentPolicyNegotiation,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PartitionedPopins,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessHeaders,ThirdPartyStoragePartitioning --disable-features=PaintHolding --variations-seed-version --enable-logging --v=0`

MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==4065400==END OF ADDITIONAL INFO
==4065400==ABORTING

Reporter credit:

Reporter credit: Huang Xilin of Ant Group Light-Year Security Lab

Additional Data

Category: Security
Chrome Channel: Dev
Regression: N/A