CVE-2025-5063

High patch-now ✔︎ verified CVSS 8.8 chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

High

Severity

8.8

CVSS

Exploited ITW

Fixed

Fix Status

ImpactUse after free in Compositing

DescriptionUse after free in Compositing

ComponentCompositing

Sub-componentVt/cc

Bug ClassUAF

Action tierpatch-now — corruption primitive, web-reachable in default config (confirmed) — upheld by independent review by AI
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.

Independent review by AIConfirmed
Reviewer notes: Attributes 'the vector' to a removed comment; it comes from the commit message. Says the advisory gives no specific severity, but it lists High (CVSS 8.8). Exact freed object (iterator vs. backing storage) is not shown by the diff.
A second, independent AI reviewer (not a human) re-derived this analysis from the fixing commit and the vendor advisory, looking for errors.

Tracker411573532

Fix commit02ddca5de087 (chromium/src) +4/-1

CWECWE-416 (Use-after-free)

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA KEVNot listed

CreditedAnonymous

Reported2025-04-18 (per vendor advisory)

Fix landed2025-05-14 (public git)

Disclosed2025-05-27

Patch gap13 days — fix public in source before the advisory

Background

`LayerTreeHost`: the compositor (cc) object on the renderer that owns layer-tree state and coordinates lifecycle updates, defined in cc/trees/layer_tree_host.cc.
View transition callbacks: callbacks stored in the view_transition_callbacks_ container that are invoked when the compositor produces the rects/results a pending view-transition request was waiting on.
Re-entrancy: the situation where invoking a callback runs script that calls back into the same object, here starting new view transitions and adding entries to view_transition_callbacks_ while it is being iterated/erased.
`PostTask`: posting work to the MainThreadTaskRunner so it runs after the current stack unwinds, breaking synchronous re-entrancy.

Root Cause Analysis

In the view-transition callback dispatch code in cc/trees/layer_tree_host.cc, the method looked up an entry it in view_transition_callbacks_, and if found executed the callback synchronously with std::move(it->second).Run(rects) before calling view_transition_callbacks_.erase(it). The synchronous callback can run script that starts additional view transitions, which adds more requests and re-enters the compositor to modify view_transition_callbacks_ while the outer call still holds the iterator it. That mutation can invalidate it (and free the backing storage the removed comment calls “the vector”), so the subsequent erase(it) operates on a stale/dangling iterator — a use-after-free.

The fix replaces the synchronous Run with task_runner_provider_->MainThreadTaskRunner()->PostTask(FROM_HERE, base::BindOnce(std::move(it->second), rects)), so the callback (and any re-entrant modification it causes) runs only after the current stack unwinds; the erase(it) then executes immediately on a still-valid iterator, restoring the invariant that the container is not mutated while it is live.

Key insight

The single core mistake was invoking a stored view-transition callback synchronously while still holding an iterator into view_transition_callbacks_, letting the callback re-enter and mutate that container; the fix defers the callback via PostTask so the container is erased with a valid iterator before any re-entrant modification can occur.

Attack Path

Register a view-transition request Page script triggers a view transition so that a callback is stored in view_transition_callbacks_ awaiting compositor rects.
Callback fires synchronously The compositor reaches the dispatch method, finds it, and runs std::move(it->second).Run(rects) inline while it still refers into the container.
Re-enter and mutate the container The callback runs script that starts more view transitions, adding requests and re-entering to modify view_transition_callbacks_, invalidating it and freeing its backing storage.
Dangling erase Control returns to the outer frame and view_transition_callbacks_.erase(it) uses the now-dangling iterator, producing the use-after-free the advisory reports. Escalation to a controlled read/write or code execution is (inferred).

Impact Assessment

An attacker running script in a renderer can drive a use-after-free in the compositor (cc) by re-entering view-transition dispatch, matching the advisory’s “Use after free in Compositing.” The precondition is only the ability to run script that starts view transitions on a page. The vendor advisory rates this high severity and does not report in-the-wild exploitation; NVD scores it CVSS 8.8. Any progression from the use-after-free to a read/write primitive or remote code execution is (inferred) rather than demonstrated by the patch.

Files Changed

cc/trees/layer_tree_host.cc

Audit Directions

Synchronous callbacks over live iterators/containers
Audit code that invokes a stored callback while holding an iterator into (or intending to later mutate) the owning container, and confirm the callback cannot re-enter and modify that container before the mutation completes.
Re-entrancy via script-driven lifecycle
Look for compositor/lifecycle paths in cc and Blink where running a callback can synchronously execute page script that re-enters the same subsystem, and prefer posting a task to unwind the stack.
Erase-after-invoke ordering
Review patterns that run then erase (Run(...); erase(it);) and verify the erase target cannot be invalidated by side effects of the run step.

Patch

view commit

From 02ddca5de087c833fede8c46fb971acdc42a7e91 Mon Sep 17 00:00:00 2001
From: Vladimir Levin <vmpstr@chromium.org>
Date: Wed, 14 May 2025 06:52:57 -0700
Subject: [PATCH] vt/cc: Post a callback task instead of a synchronous call

The callback can end up calling more script to start view transitions
which can add more requests, and re-enter into modifying the vector.

So, instead, unwind the task to post the task.

R=khushalsagar@chromium.org

Bug: 411573532
Change-Id: I80880e9e3ecf41c346910fb5cb6f44609ee5ef17
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6542846
Commit-Queue: Vladimir Levin <vmpstr@chromium.org>
Reviewed-by: Khushal Sagar <khushalsagar@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1460048}
---

diff --git a/cc/trees/layer_tree_host.cc b/cc/trees/layer_tree_host.cc
index 8487d71b..7fdc79d 100644
--- a/cc/trees/layer_tree_host.cc
+++ b/cc/trees/layer_tree_host.cc
@@ -536,7 +536,10 @@
   if (it == view_transition_callbacks_.end()) {
     return;
   }
-  std::move(it->second).Run(rects);
+  // The callback can cause more requests to be added and run the lifecycle, so
+  // unwind the stack before calling it.
+  task_runner_provider_->MainThreadTaskRunner()->PostTask(
+      FROM_HERE, base::BindOnce(std::move(it->second), rects));
   view_transition_callbacks_.erase(it);
 }

Loading diff…

Original Bug Report

reported by m....@gmail.com

heap-use-after-free in cc::LayerTreeHost::NotifyTransitionRequestsFinished

Security Bug

Important: Please do not change the component of this bug manually.

Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/faq.md

Please see the following link for instructions on filing security bugs: https://www.chromium.org/Home/chromium-security/reporting-security-bugs

Reports may be eligible for reward payments under the Chrome VRP: https://g.co/chrome/vrp

NOTE: Security bugs are normally made public once a fix has been widely deployed.

VULNERABILITY DETAILS

Reproduction Steps

python -m http.server 8000
Run: chrome --headless --no-sandbox --user-data-dir=test --enable-logging=stderr http://localhost:8000/poc.html?url=http://localhost:8000/poc.html
Press the Escape key to trigger the bug

About `headless`

The headless flag is added for easier reproduction—without it, a print dialog would pop up, but the vulnerability will still trigger no matter which button the user clicks in the print page.

Root Cause Analysis (RCA)

In the NotifyTransitionRequestsFinished function, the iterator of view_transition_callbacks_ is first obtained
Then, in [1] the code calls the callback function, which causes the iterator to become invalid
Using the iterator leads to a UAF

https://source.chromium.org/chromium/chromium/src/+/main:cc/trees/layer_tree_host.cc;drc=d5e762e022c4d40d97ee0dc70521b161d72a06b1;l=538
void LayerTreeHost::NotifyTransitionRequestsFinished(
    const uint32_t sequence_id,
    const viz::ViewTransitionElementResourceRects& rects) {
  DCHECK(IsMainThread());
  // TODO(vmpstr): This might also be a good spot to expire long standing
  // requests if they were not finished.
  auto it = view_transition_callbacks_.find(sequence_id);
  if (it == view_transition_callbacks_.end()) {
    return;
  }
  std::move(it->second).Run(rects);       <<[1]>>
  view_transition_callbacks_.erase(it);
}

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: [tab]

ASAN

=================================================================
==16784==ERROR: AddressSanitizer: heap-use-after-free on address 0x11b78c231e70 at pc 0x7ffe820f176e bp 0x00aad99fb780 sp 0x00aad99fb7c8
READ of size 4 at 0x11b78c231e70 thread T0
    #0 0x7ffe820f176d in std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >::operator= C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__utility\pair.h:236
    #1 0x7ffe820f176d in std::__Cr::__move_impl<std::__Cr::_ClassicAlgPolicy>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\move.h:46
    #2 0x7ffe820f176d in std::__Cr::__copy_move_unwrap_iters C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\copy_move_common.h:94
    #3 0x7ffe820f176d in std::__Cr::__move C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\move.h:122
    #4 0x7ffe820f176d in std::__Cr::move C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\move.h:132
    #5 0x7ffe820f176d in std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > >::erase C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:1175
    #6 0x7ffe820f176d in base::internal::flat_tree<unsigned int, struct base::internal::GetFirst, struct std::__Cr::less<void>, class std::__Cr::vector<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>, class std::__Cr::allocator<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>>>>::erase(class std::__Cr::__wrap_iter<struct std::__Cr::pair<unsigned int, class base::OnceCallback<void __cdecl(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>> *>) C:\b\s\w\ir\cache\builder\src\base\containers\flat_tree.h:862:16
    #7 0x7ffe820f132b in cc::LayerTreeHost::NotifyTransitionRequestsFinished(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:539:30
    #8 0x7ffe820b45e9 in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #9 0x7ffe820b45e9 in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #10 0x7ffe820b45e9 in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain>,unsigned int,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #11 0x7ffe820b45e9 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain> &&, unsigned int &&, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain>, unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #12 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #13 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #14 0x7ffe7cde9a29 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #15 0x7ffe7cde9a29 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #16 0x7ffe7cde88cf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #17 0x7ffe7cf49427 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #18 0x7ffe7cdeb751 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
    #19 0x7ffe7ce8643e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #20 0x7ffe9278f8fb in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:369:16
    #21 0x7ffe79901686 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:781:14
    #22 0x7ffe799039d1 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1155:10
    #23 0x7ffe798f7ab3 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359:36
    #24 0x7ffe798f866d in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:372:10
    #25 0x7ffe6a1116bb in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
    #26 0x7ff6e68147bb in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
    #27 0x7ff6e6812021 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20
    #28 0x7ff6e6cc55fb in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #29 0x7ff6e6cc55fb in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #30 0x7fff890ae8d6  (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
    #31 0x7fff8b1dbf6b  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x1800bbf6b)

0x11b78c231e70 is located 16 bytes inside of 32-byte region [0x11b78c231e60,0x11b78c231e80)
freed by thread T0 here:
    #0 0x7fff3e30b244  (E:\chrome_asan\asan-win32-release_x64-1448748\clang_rt.asan_dynamic-x86_64.dll+0x18005b244)
    #1 0x7ffe82107583 in std::__Cr::__libcpp_operator_delete C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:46
    #2 0x7ffe82107583 in std::__Cr::__libcpp_deallocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:86
    #3 0x7ffe82107583 in std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > >::deallocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocator.h:120
    #4 0x7ffe82107583 in std::__Cr::allocator_traits<std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > >::deallocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocator_traits.h:289
    #5 0x7ffe82107583 in std::__Cr::__split_buffer<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > &>::~__split_buffer C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__split_buffer:337
    #6 0x7ffe82107583 in std::__Cr::vector<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>, class std::__Cr::allocator<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>>>::emplace<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>(class std::__Cr::__wrap_iter<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>> const *>, unsigned int &&, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)> &&) C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:1263:3
    #7 0x7ffe820f7902 in base::internal::flat_tree<unsigned int,base::internal::GetFirst,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::unsafe_emplace C:\b\s\w\ir\cache\builder\src\base\containers\flat_tree.h:1103
    #8 0x7ffe820f7902 in base::flat_map<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::operator[] C:\b\s\w\ir\cache\builder\src\base\containers\flat_map.h:294
    #9 0x7ffe820f7902 in cc::LayerTreeHost::AddViewTransitionRequest(class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:975:5
    #10 0x7ffe8b6a36b4 in blink::PaintArtifactCompositor::Update(class blink::PaintArtifact const &, struct blink::PaintArtifactCompositor::ViewportProperties const &, class blink::HeapVector<class cppgc::internal::BasicMember<class blink::TransformPaintPropertyNode const, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 32> const &, class WTF::Vector<class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>, 0, class WTF::PartitionAllocator>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\graphics\compositing\paint_artifact_compositor.cc:980:11
    #11 0x7ffe899cc848 in blink::LocalFrameView::PushPaintArtifactToCompositor(bool) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3016:31
    #12 0x7ffe899c8877 in blink::LocalFrameView::RunPaintLifecyclePhase(enum blink::PaintBenchmarkMode) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2683:5
    #13 0x7ffe899c6e6b in blink::LocalFrameView::UpdateLifecyclePhasesInternal(enum blink::DocumentLifecycle::LifecycleState) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2378:3
    #14 0x7ffe899c29cf in blink::LocalFrameView::UpdateLifecyclePhases(enum blink::DocumentLifecycle::LifecycleState, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2163:3
    #15 0x7ffe899c210e in blink::LocalFrameView::UpdateAllLifecyclePhases(enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:1887:54
    #16 0x7ffe878671f4 in blink::PageAnimator::UpdateAllLifecyclePhases(class blink::LocalFrame &, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\page_animator.cc:397:9
    #17 0x7ffe8987caf5 in blink::WebFrameWidgetImpl::UpdateLifecycle(enum blink::WebLifecycleUpdate, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\web_frame_widget_impl.cc:1764:14
    #18 0x7ffe8b359f6d in blink::WidgetBase::UpdateVisualState(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\widget\widget_base.cc:1054:12
    #19 0x7ffe820ef283 in cc::LayerTreeHost::RequestMainFrameUpdate(bool) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:402:12
    #20 0x7ffe820c0359 in cc::ProxyMain::BeginMainFrame(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>) C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:297:21
    #21 0x7ffe820b64be in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #22 0x7ffe820b64be in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #23 0x7ffe820b64be in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #24 0x7ffe820b64be in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain> &&, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain>, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #25 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #26 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #27 0x7ffe7cde9a29 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #28 0x7ffe7cde9a29 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #29 0x7ffe7cde88cf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #30 0x7ffe7cf49427 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #31 0x7ffe7cdeb7c8 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:626:12
    #32 0x7ffe7ce8643e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #33 0x7ffe93241ceb in printing::PrintRenderFrameHelper::RequestPrintPreview(enum printing::PrintRenderFrameHelper::PrintPreviewRequestType, bool) C:\b\s\w\ir\cache\builder\src\components\printing\renderer\print_render_frame_helper.cc:2694:12
    #34 0x7ffe93240d49 in printing::PrintRenderFrameHelper::ScriptedPrint(bool) C:\b\s\w\ir\cache\builder\src\components\printing\renderer\print_render_frame_helper.cc:1229:5
    #35 0x7ffe928c9795 in content::RenderFrameImpl::ScriptedPrint(void) C:\b\s\w\ir\cache\builder\src\content\renderer\render_frame_impl.cc:2104:14
    #36 0x7ffe895a09d1 in blink::ChromeClientImpl::PrintDelegate(class blink::LocalFrame *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\chrome_client_impl.cc:777:24
    #37 0x7ffe87f39d6d in blink::ChromeClient::Print(class blink::LocalFrame *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\chrome_client.cc:282:3
    #38 0x7ffe8a127890 in blink::EditorCommand::Execute(class WTF::String const &, class blink::Event *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\commands\editor_command.cc:2161:10
    #39 0x7ffe8d9aa9e2 in blink::Document::execCommand(class WTF::String const &, bool, class blink::V8UnionStringOrTrustedHTML const *, class blink::ExceptionState &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\commands\document_exec_command.cc:149:25
    #40 0x7ffe8da0a4db in blink::`anonymous namespace'::v8_document::ExecCommandOperationCallback C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\modules\v8\v8_document.cc:6933:39
    #41 0x7ffe93ad1b44 in Builtins_CallApiCallbackGeneric (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99c1b44)
    #42 0x7ffe93acfd34 in Builtins_InterpreterEntryTrampoline (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bfd34)
    #43 0x7ffe93acfd34 in Builtins_InterpreterEntryTrampoline (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bfd34)
    #44 0x7ffe93acd29b in Builtins_JSEntryTrampoline (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bd29b)
    #45 0x7ffe93accdfe in Builtins_JSEntry (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bcdfe)
    #46 0x7ffe6f5eefbe in v8::internal::GeneratedCode<unsigned long long,unsigned long long,unsigned long long,unsigned long long,unsigned long long,long long,unsigned long long **>::Call C:\b\s\w\ir\cache\builder\src\v8\src\execution\simulator.h:212
    #47 0x7ffe6f5eefbe in v8::internal::`anonymous namespace'::Invoke C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:440:22
    #48 0x7ffe6f5ed68d in v8::internal::Execution::Call(class v8::internal::Isolate *, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::base::Vector<class v8::internal::DirectHandle<class v8::internal::Object> const>) C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:530:10
    #49 0x7ffe6f009468 in v8::Function::Call(class v8::Isolate *, class v8::Local<class v8::Context>, class v8::Local<class v8::Value>, int, class v8::Local<class v8::Value> *const) C:\b\s\w\ir\cache\builder\src\v8\src\api\api.cc:5427:7
    #50 0x7ffe8aeb6c68 in blink::V8ScriptRunner::CallFunction(class v8::Local<class v8::Function>, class blink::ExecutionContext *, class v8::Local<class v8::Value>, int, class v8::Local<class v8::Value> *const, class v8::Isolate *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\v8_script_runner.cc:886:48
    #51 0x7ffe8ce54106 in blink::bindings::CallbackInvokeHelper<blink::CallbackFunctionBase,0,1>::CallInternal C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\callback_invoke_helper.cc:142
    #52 0x7ffe8ce54106 in blink::bindings::CallbackInvokeHelper<class blink::CallbackFunctionWithTaskAttributionBase, 0, 1>::Call(int, class v8::Local<class v8::Value> *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\callback_invoke_helper.cc:157:10
    #53 0x7ffe8ce5cf3c in blink::V8ViewTransitionCallback::Invoke(class blink::bindings::V8ValueOrScriptWrappableAdapter) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\core\v8\v8_view_transition_callback.cc:57:13
    #54 0x7ffe8a492c00 in blink::DOMViewTransition::InvokeDOMChangeCallback(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\view_transition\dom_view_transition.cc:234:31
    #55 0x7ffe8a4802c9 in blink::ViewTransition::ProcessCurrentState(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\view_transition\view_transition.cc:528:27
    #56 0x7ffe8a48ae5f in base::internal::DecayedFunctorTraits<void (ViewTransition::*)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::ViewTransition *>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #57 0x7ffe8a48ae5f in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ViewTransition::*&&)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::ViewTransition *>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #58 0x7ffe8a48ae5f in base::internal::Invoker<base::internal::FunctorTraits<void (ViewTransition::*&&)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::ViewTransition *>,base::internal::BindState<1,1,0,void (ViewTransition::*)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::internal::BasicUnwrappingCrossThreadHandle<blink::ViewTransition,blink::internal::WeakCrossThreadHandleWeaknessPolicy> >,void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #59 0x7ffe8a48ae5f in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl blink::ViewTransition::*&&)(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class blink::ViewTransition *>, struct base::internal::BindState<1, 1, 0, void (__cdecl blink::ViewTransition::*)(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class blink::internal::BasicUnwrappingCrossThreadHandle<class blink::ViewTransition, struct blink::internal::WeakCrossThreadHandleWeaknessPolicy>>, (class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>::RunOnce(class base::internal::BindStateBase *, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #60 0x7ffe820f1300 in base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #61 0x7ffe820f1300 in cc::LayerTreeHost::NotifyTransitionRequestsFinished(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:538:25
    #62 0x7ffe820b45e9 in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #63 0x7ffe820b45e9 in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #64 0x7ffe820b45e9 in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain>,unsigned int,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #65 0x7ffe820b45e9 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain> &&, unsigned int &&, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain>, unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #66 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #67 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34

previously allocated by thread T0 here:
    #0 0x7fff3e30a65d  (E:\chrome_asan\asan-win32-release_x64-1448748\clang_rt.asan_dynamic-x86_64.dll+0x18005a65d)
    #1 0x7ffe821073f4 in std::__Cr::__libcpp_operator_new C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:37
    #2 0x7ffe821073f4 in std::__Cr::__libcpp_allocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:64
    #3 0x7ffe821073f4 in std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > >::allocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocator.h:105
    #4 0x7ffe821073f4 in std::__Cr::__allocate_at_least C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocate_at_least.h:41
    #5 0x7ffe821073f4 in std::__Cr::__split_buffer<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > &>::__split_buffer C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__split_buffer:325
    #6 0x7ffe821073f4 in std::__Cr::vector<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>, class std::__Cr::allocator<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>>>::emplace<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>(class std::__Cr::__wrap_iter<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>> const *>, unsigned int &&, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)> &&) C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:1260:49
    #7 0x7ffe820f7902 in base::internal::flat_tree<unsigned int,base::internal::GetFirst,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::unsafe_emplace C:\b\s\w\ir\cache\builder\src\base\containers\flat_tree.h:1103
    #8 0x7ffe820f7902 in base::flat_map<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::operator[] C:\b\s\w\ir\cache\builder\src\base\containers\flat_map.h:294
    #9 0x7ffe820f7902 in cc::LayerTreeHost::AddViewTransitionRequest(class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:975:5
    #10 0x7ffe8b6a36b4 in blink::PaintArtifactCompositor::Update(class blink::PaintArtifact const &, struct blink::PaintArtifactCompositor::ViewportProperties const &, class blink::HeapVector<class cppgc::internal::BasicMember<class blink::TransformPaintPropertyNode const, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 32> const &, class WTF::Vector<class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>, 0, class WTF::PartitionAllocator>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\graphics\compositing\paint_artifact_compositor.cc:980:11
    #11 0x7ffe899cc848 in blink::LocalFrameView::PushPaintArtifactToCompositor(bool) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3016:31
    #12 0x7ffe899c8877 in blink::LocalFrameView::RunPaintLifecyclePhase(enum blink::PaintBenchmarkMode) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2683:5
    #13 0x7ffe899c6e6b in blink::LocalFrameView::UpdateLifecyclePhasesInternal(enum blink::DocumentLifecycle::LifecycleState) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2378:3
    #14 0x7ffe899c29cf in blink::LocalFrameView::UpdateLifecyclePhases(enum blink::DocumentLifecycle::LifecycleState, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2163:3
    #15 0x7ffe899c210e in blink::LocalFrameView::UpdateAllLifecyclePhases(enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:1887:54
    #16 0x7ffe878671f4 in blink::PageAnimator::UpdateAllLifecyclePhases(class blink::LocalFrame &, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\page_animator.cc:397:9
    #17 0x7ffe8987caf5 in blink::WebFrameWidgetImpl::UpdateLifecycle(enum blink::WebLifecycleUpdate, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\web_frame_widget_impl.cc:1764:14
    #18 0x7ffe8b359f6d in blink::WidgetBase::UpdateVisualState(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\widget\widget_base.cc:1054:12
    #19 0x7ffe820ef283 in cc::LayerTreeHost::RequestMainFrameUpdate(bool) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:402:12
    #20 0x7ffe820c0359 in cc::ProxyMain::BeginMainFrame(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>) C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:297:21
    #21 0x7ffe820b64be in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #22 0x7ffe820b64be in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #23 0x7ffe820b64be in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #24 0x7ffe820b64be in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain> &&, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain>, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #25 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #26 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #27 0x7ffe7cde9a29 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #28 0x7ffe7cde9a29 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #29 0x7ffe7cde88cf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #30 0x7ffe7cf49427 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #31 0x7ffe7cdeb751 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
    #32 0x7ffe7ce8643e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #33 0x7ffe9278f8fb in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:369:16
    #34 0x7ffe79901686 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:781:14
    #35 0x7ffe799039d1 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1155:10
    #36 0x7ffe798f7ab3 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359:36
    #37 0x7ffe798f866d in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:372:10
    #38 0x7ffe6a1116bb in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
    #39 0x7ff6e68147bb in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
    #40 0x7ff6e6812021 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20
    #41 0x7ff6e6cc55fb in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #42 0x7ff6e6cc55fb in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #43 0x7fff890ae8d6  (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
    #44 0x7fff8b1dbf6b  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x1800bbf6b)

SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__utility\pair.h:236 in std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >::operator=
Shadow bytes around the buggy address:
  0x11b78c231b80: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c231c00: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
  0x11b78c231c80: fd fd fd fa f7 fa fd fd fd fd f7 fa fd fd fd fd
  0x11b78c231d00: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c231d80: fd fd f7 fa fd fd fd fd f7 fa 00 00 00 fa f7 fa
=>0x11b78c231e00: 00 00 00 fa f7 fa 00 00 00 00 f7 fa fd fd[fd]fd
  0x11b78c231e80: f7 fa fd fd fd fa f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c231f00: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fa f7 fa
  0x11b78c231f80: 00 00 00 00 f7 fa fd fd fd fd f7 fa fd fd fd fd
  0x11b78c232000: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c232080: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==16784==ADDITIONAL INFO

==16784==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7ffe820ac7c7 in cc::ProxyImpl::NotifyTransitionRequestFinished(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:643:7
    #1 0x7ffe7d330a58 in mojo::SimpleWatcher::Context::Notify(unsigned int, struct MojoHandleSignalsState, unsigned int) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc:102:13



MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==16784==END OF ADDITIONAL INFO
==16784==ABORTINGs

CREDIT INFORMATION Reporter credit: [f4@dnpushme]

View on issue tracker

Uploaded PoC files

Links in the report

References

Vendor advisory Fix commit Bug tracker NVD

On This Page