Chrome · Aura › UI>Browser>TopChrome>TabStrip
CVE-2025-8882
UAF in Aura (UI>Browser>TopChrome>TabStrip)
Overview
Medium
Severity
8.8
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- Aura / desktop drag-and-drop
DesktopDragDropClientWindrives an OS drag-and-drop loop for aviewswindow on Windows, and observes the sourceaura::Windowso it can react when that window goes away mid-drag.- `aura::WindowObserver`
- an interface whose
OnWindowDestroyingcallback fires while an observedaura::Windowis being torn down. - `base::ScopedObservation` (`scoped_observation_`)
- an RAII helper that records “this observer is observing that window” and, on destruction or
Reset(), calls back into the window to remove itself from the window’s observer list. - Use-after-free (UAF)
- accessing an object after its memory has been freed; here, touching the destroyed
aura::Windowwhen the scoped observation tears down.
Root Cause Analysis
A prior change (CL:6779234) added a ScopedObservation so the drag-drop client would stop calling into the source window after it was freed, tracked via source_window_alive_. That fix, however, created a second UAF: the ScopedObservation itself holds a raw pointer to the observed aura::Window, and when the observation is later destroyed it dereferences that window to unregister itself from the window’s observer list. If the window was already destroyed during an ongoing drag, that later teardown accesses freed memory.
The fix makes OnWindowDestroying call scoped_observation_.Reset() at the moment the window is being destroyed, which severs the observation while the window (and its observer list) is still valid, so no later access to the freed window occurs. The invariant restored is that the scoped observation must be released no later than the destruction of the object it points at.
Key insight
The original mitigation only tracked liveness with a boolean but left the
ScopedObservation’s own back-reference to the window intact, so its later teardown dereferenced the freed window; the fix resets the observation inside OnWindowDestroying, eliminating the stale reference before the window is gone.Attack Path
- Start a drag from a page-controlled window
Per the commit’s repro, a page opens a new tab containing a draggable element and the user begins dragging it, entering
DesktopDragDropClientWin’s drag loop with an activescoped_observation_on the sourceaura::Window. - Destroy the source window mid-drag
While the drag is held, the tab/window closes, so the source
aura::Windowis torn down andOnWindowDestroyingfires, settingsource_window_alive_ = false(pre-patch: without also resetting the observation). - Trigger the stale teardown
When the
DesktopDragDropClientWin/scoped_observation_is subsequently destroyed, the observation tries to remove itself from the now-freed window, dereferencing freed memory and producing the UAF observed on the ASAN stack trace. - Exploit the freed access
Controlling allocation of the freed
aura::Windowregion could turn the stale access into a corruption primitive; this escalation is(inferred)and not demonstrated by the patch.
Impact Assessment
An attacker who can get a user to drag a page-supplied element and then cause the source window to close mid-drag can trigger a use-after-free on an
aura::Window in the browser process. The patch demonstrates a crash (ASAN report); any conversion to a controlled read/write or further escalation is (inferred). The advisory classifies this as a UAF / “Use after free in Aura” and does not report exploitation in the wild.Files Changed
ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc
Audit Directions
- Observer teardown after observed-object deathWherever a
ScopedObservation/observer holds a pointer to an object that can be destroyed independently, verify the observation isReset()in the destruction callback rather than relying on the observer’s own later destruction. - Boolean liveness flags masking stale pointersFlag mitigations that only add an
is_aliveboolean while leaving live back-references (likescoped_observation_) intact; the pointer, not the flag, is the UAF hazard. - Long-lived drag/modal loopsAudit drag-and-drop and other nested run loops where the source window can be destroyed while the loop still owns observers or callbacks into it.
Patch
From 52f3b7419bc8892f011643006a1a075b5a7a9c82 Mon Sep 17 00:00:00 2001
From: Gastón Rodríguez <gastonr@microsoft.com>
Date: Thu, 07 Aug 2025 09:23:45 -0700
Subject: [PATCH] Reset DragDrop window observator to avoid UAF
CL:6779234 introduced a scoped observation to avoid calling the window
after it had been freed when a drag and drop was ongoing. This fix
introduced another UAF in a similar scenario; when the
ScopedObservation is being deleted it attempts to access the window to
remove itself as an observer. If the window has been deleted, then a
UAF happens. This CL calls Reset on the ScopedObserver when the window
is destroyed to avoid this call after the fact.
Steps to repro:
1. Open the HTML linked in the crbug in an ASAN build.
2. Click the button that says "Open new tab with draggable element"
3. On the new tab, drag the red square and hold the drag for a second.
The window should close, and you should see the UAF stack trace on the
console. After this patch, this problem is gone.
Bug: 435623339, 432497641
Change-Id: Ie0d54d6c07834cbc305e126156e7e23d92283c01
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6821521
Reviewed-by: David Bienvenu <davidbienvenu@chromium.org>
Commit-Queue: Gaston Rodriguez <gastonr@microsoft.com>
Reviewed-by: Dana Fried <dfried@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1498283}
---
diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc
index 069db7a6..bcfe5de 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc
@@ -37,6 +37,7 @@
// aura::WindowObserver:
void OnWindowDestroying(aura::Window* window) override {
source_window_alive_ = false;
+ scoped_observation_.Reset();
}
bool source_window_alive() { return source_window_alive_; }
Loading diff…
Original Bug Report
reported by pu...@gmail.com
"heap-use-after-free in std::Cr::vector<base::internal::CheckedObserverAdapter,std::Cr::allocator<base::internal::CheckedObserverAdapter> >::end
REPRODUCTION CASE enable the #side-by-side flag
- Open Poc.html
- Drag and Drop picture in new window split screen feature
VERSION Chrome Version: Beta Operating System: Windows
FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: browser Crash State: see asan file
CREDIT INFORMATION Reporter credit:Puf
[8732:13700:0801/164547.139:ERROR:google_apis\gcm\engine\registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
=================================================================
==8732==ERROR: AddressSanitizer: heap-use-after-free on address 0x12d8fae6bd30 at pc 0x7ff98ddd515a bp 0x00fdea7f7280 sp 0x00fdea7f72c8
READ of size 8 at 0x12d8fae6bd30 thread T0
#0 0x7ff98ddd5159 in std::__Cr::vector<base::internal::CheckedObserverAdapter,std::__Cr::allocator<base::internal::CheckedObserverAdapter> >::end C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:358
#1 0x7ff98ddd5159 in std::__Cr::ranges::__end::__fn::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__ranges\access.h:132
#2 0x7ff98ddd5159 in std::__Cr::ranges::__find_if::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\ranges_find_if.h:58
#3 0x7ff98ddd5159 in base::ObserverList<class aura::WindowObserver, 1, 1, class base::internal::CheckedObserverAdapter>::RemoveObserver(class aura::WindowObserver const *) C:\b\s\w\ir\cache\builder\src\base\observer_list.h:329:21
#4 0x7ff98550879c in base::ScopedObservationTraits<aura::Window,aura::WindowObserver>::RemoveObserver C:\b\s\w\ir\cache\builder\src\base\scoped_observation_traits.h:74
#5 0x7ff98550879c in base::ScopedObservation<aura::Window,aura::WindowObserver>::Reset C:\b\s\w\ir\cache\builder\src\base\scoped_observation.h:115
#6 0x7ff98550879c in base::ScopedObservation<class aura::Window, class aura::WindowObserver>::~ScopedObservation<class aura::Window, class aura::WindowObserver>(void) C:\b\s\w\ir\cache\builder\src\base\scoped_observation.h:101:26
#7 0x7ff985507c7b in views::`anonymous namespace'::SourceWindowObserver::~SourceWindowObserver C:\b\s\w\ir\cache\builder\src\ui\views\widget\desktop_aura\desktop_drag_drop_client_win.cc:30
#8 0x7ff985507c7b in views::DesktopDragDropClientWin::StartDragAndDrop(class std::__Cr::unique_ptr<class ui::OSExchangeData, struct std::__Cr::default_delete<class ui::OSExchangeData>>, class aura::Window *, class aura::Window *, class gfx::Point const &, int, enum ui::mojom::DragEventSource) C:\b\s\w\ir\cache\builder\src\ui\views\widget\desktop_aura\desktop_drag_drop_client_win.cc:140:1
#9 0x7ff97ed49296 in content::WebContentsViewAura::StartDragging(struct content::DropData const &, class url::Origin const &, enum blink::DragOperationsMask, class gfx::ImageSkia const &, class gfx::Vector2d const &, class gfx::Rect const &, class blink::mojom::DragEventSourceInfo const &, class content::RenderWidgetHostImpl *) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_view_aura.cc:1167:15
#10 0x7ff97e6749a9 in content::RenderWidgetHostImpl::StartDragging(class mojo::StructPtr<class blink::mojom::DragData>, class url::Origin const &, enum blink::DragOperationsMask, class SkBitmap const &, class gfx::Vector2d const &, class gfx::Rect const &, class mojo::StructPtr<class blink::mojom::DragEventSourceInfo>) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_widget_host_impl.cc:2938:9
#11 0x7ff97e499833 in content::RenderFrameHostImpl::StartDragging(class mojo::StructPtr<class blink::mojom::DragData>, enum blink::DragOperationsMask, class SkBitmap const &, class gfx::Vector2d const &, class gfx::Rect const &, class mojo::StructPtr<class blink::mojom::DragEventSourceInfo>) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:10902:26
#12 0x7ff977a050fb in blink::mojom::LocalFrameHostStubDispatch::Accept(class blink::mojom::LocalFrameHost *, class mojo::Message *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\public\mojom\frame\frame.mojom.cc:11256:13
#13 0x7ff986cbf7ff in mojo::InterfaceEndpointClient::HandleValidatedMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:1059:54
#14 0x7ff986cbc4e9 in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:48:24
#15 0x7ff986cc5aee in mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:731:20
#16 0x7ff98a4afd50 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1202:24
#17 0x7ff98a4b22b8 in base::internal::DecayedFunctorTraits<void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
#18 0x7ff98a4b22b8 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
#19 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
#20 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
#21 0x7ff986f71523 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
#22 0x7ff986f71523 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34
#23 0x7ff986f448e9 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:104
#24 0x7ff986f448e9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
#25 0x7ff986f4378f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
#26 0x7ff986de2500 in base::MessagePumpForUI::DoRunLoop(void) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_win.cc:260:67
#27 0x7ff986ddfec8 in base::MessagePumpWin::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_win.cc:87:3
#28 0x7ff986f46621 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
#29 0x7ff986fe312e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
#30 0x7ff97d0c50ad in content::BrowserMainLoop::RunMainMessageLoop(void) C:\b\s\w\ir\cache\builder\src\content\browser\browser_main_loop.cc:1109:18
#31 0x7ff97d0ccd29 in content::BrowserMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\browser\browser_main_runner_impl.cc:156:15
#32 0x7ff97d0bb8cc in content::BrowserMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\browser\browser_main.cc:32:28
#33 0x7ff98363c042 in content::RunBrowserProcessMain(struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:701:10
#34 0x7ff98363f197 in content::ContentMainRunnerImpl::RunBrowser(struct content::MainFunctionParams, bool) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1275:10
#35 0x7ff98363e99e in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1127:12
#36 0x7ff983632878 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:361:36
#37 0x7ff98363343d in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:374:10
#38 0x7ff9740e2b0b in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
#39 0x7ff7182e479b in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
#40 0x7ff7182e200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20
#41 0x7ff71879ef7b in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
#42 0x7ff71879ef7b in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#43 0x7ffa4f55e8d6 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
#44 0x7ffa50ddc34b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18003c34b)
0x12d8fae6bd30 is located 432 bytes inside of 544-byte region [0x12d8fae6bb80,0x12d8fae6bda0)
freed by thread T0 here:
#0 0x7ff9d3e7c584 (C:\Users\Puf\Desktop\win32-release_x64_asan-win32-release_x64-1495507\clang_rt.asan_dynamic-x86_64.dll+0x18005c584)
#1 0x7ff98dde6bf0 in aura::Window::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\ui\aura\window.h:193
#2 0x7ff97e64bd90 in content::RenderWidgetHostImpl::Destroy(bool) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_widget_host_impl.cc:2458:12
#3 0x7ff97e6527da in content::RenderWidgetHostImpl::ShutdownAndDestroyWidget(bool) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_widget_host_impl.cc:836:3
#4 0x7ff97e63275d in content::RenderViewHostImpl::~RenderViewHostImpl(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_view_host_impl.cc:380:16
#5 0x7ff97e63e0af in content::RenderViewHostImpl::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_view_host_impl.h:371
#6 0x7ff97e423c5a in base::RefCounted<content::RenderViewHostImpl,base::DefaultRefCountedTraits<content::RenderViewHostImpl> >::DeleteInternal C:\b\s\w\ir\cache\builder\src\base\memory\ref_counted.h:375
#7 0x7ff97e423c5a in base::DefaultRefCountedTraits<content::RenderViewHostImpl>::Destruct C:\b\s\w\ir\cache\builder\src\base\memory\ref_counted.h:341
#8 0x7ff97e423c5a in base::RefCounted<content::RenderViewHostImpl,base::DefaultRefCountedTraits<content::RenderViewHostImpl> >::Release C:\b\s\w\ir\cache\builder\src\base\memory\ref_counted.h:364
#9 0x7ff97e423c5a in scoped_refptr<content::RenderViewHostImpl>::Release C:\b\s\w\ir\cache\builder\src\base\memory\scoped_refptr.h:392
#10 0x7ff97e423c5a in scoped_refptr<content::RenderViewHostImpl>::~scoped_refptr C:\b\s\w\ir\cache\builder\src\base\memory\scoped_refptr.h:280
#11 0x7ff97e423c5a in scoped_refptr<content::RenderViewHostImpl>::reset C:\b\s\w\ir\cache\builder\src\base\memory\scoped_refptr.h:311
#12 0x7ff97e423c5a in content::RenderFrameHostImpl::~RenderFrameHostImpl(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:2847:21
#13 0x7ff97e4f1e9f in content::RenderFrameHostImpl::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:2619:45
#14 0x7ff97e55249e in std::__Cr::default_delete<content::RenderFrameHostImpl>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:77
#15 0x7ff97e55249e in std::__Cr::unique_ptr<content::RenderFrameHostImpl,std::__Cr::default_delete<content::RenderFrameHostImpl> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:290
#16 0x7ff97e55249e in std::__Cr::unique_ptr<content::RenderFrameHostImpl,std::__Cr::default_delete<content::RenderFrameHostImpl> >::~unique_ptr C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:259
#17 0x7ff97e55249e in content::RenderFrameHostManager::~RenderFrameHostManager(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:666:3
#18 0x7ff97e0f0055 in content::FrameTreeNode::~FrameTreeNode(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\frame_tree_node.cc:324:1
#19 0x7ff97e0d86ce in content::FrameTree::~FrameTree(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\frame_tree.cc:231:1
#20 0x7ff97ec346ac in content::WebContentsImpl::~WebContentsImpl(void) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.cc:1567:1
#21 0x7ff97ecdb0ef in content::WebContentsImpl::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.h:1447
#22 0x7ff983857712 in std::__Cr::default_delete<content::WebContents>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:77
#23 0x7ff983857712 in std::__Cr::unique_ptr<content::WebContents,std::__Cr::default_delete<content::WebContents> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:290
#24 0x7ff983857712 in std::__Cr::unique_ptr<content::WebContents,std::__Cr::default_delete<content::WebContents> >::~unique_ptr C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:259
#25 0x7ff983857712 in tabs::TabModel::~TabModel(void) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\tabs\tab_model.cc:97:1
#26 0x7ff9838672f2 in std::__Cr::default_delete<tabs::TabModel>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:77
#27 0x7ff9838672f2 in std::__Cr::unique_ptr<tabs::TabModel,std::__Cr::default_delete<tabs::TabModel> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:290
#28 0x7ff9838672f2 in TabStripModel::SendDetachWebContentsNotifications(struct TabStripModel::DetachNotifications *) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\tabs\tab_strip_model.cc:856:15
#29 0x7ff9838829fb in TabStripModel::CloseTabs(class base::span<class content::WebContents *const, -1, class content::WebContents *const *>, unsigned int) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\tabs\tab_strip_model.cc:3352:5
#30 0x7ff98388445b in TabStripModel::CloseWebContentsAt(int, unsigned int) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\tabs\tab_strip_model.cc:1148:3
#31 0x7ff99d904345 in chrome::CloseWebContents(class Browser *, class content::WebContents *, bool) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\browser_tabstrip.cc:123:31
#32 0x7ff97ecb358e in content::WebContentsImpl::Close(void) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.cc:9348:16
#33 0x7ff97e46e2f3 in content::RenderFrameHostImpl::ClosePageIgnoringUnloadEvents(enum content::RenderFrameHostImpl::ClosePageSource, class base::RepeatingCallback<(void)>) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:7421:14
#34 0x7ff97e46df2f in content::RenderFrameHostImpl::RequestClose(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:7285:3
#35 0x7ff977a2a638 in blink::mojom::LocalMainFrameHostStubDispatch::Accept(class blink::mojom::LocalMainFrameHost *, class mojo::Message *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\public\mojom\frame\frame.mojom.cc:23843:13
#36 0x7ff986cbf7ff in mojo::InterfaceEndpointClient::HandleValidatedMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:1059:54
#37 0x7ff986cbc4e9 in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:48:24
#38 0x7ff986cc5aee in mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:731:20
#39 0x7ff98a4afd50 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1202:24
#40 0x7ff98a4b22b8 in base::internal::DecayedFunctorTraits<void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
#41 0x7ff98a4b22b8 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
#42 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
#43 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
#44 0x7ff986f71523 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
#45 0x7ff986f71523 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34
previously allocated by thread T0 here:
#0 0x7ff9d3e7b99d (C:\Users\Puf\Desktop\win32-release_x64_asan-win32-release_x64-1495507\clang_rt.asan_dynamic-x86_64.dll+0x18005b99d)
#1 0x7ff97e68f82a in content::RenderWidgetHostViewAura::CreateAuraWindow(enum aura::client::WindowType) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_widget_host_view_aura.cc:2660:13
#2 0x7ff97e68f214 in content::RenderWidgetHostViewAura::InitAsChild(class aura::Window *) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_widget_host_view_aura.cc:320:3
#3 0x7ff97ed468f0 in content::WebContentsViewAura::CreateViewForWidget(class content::RenderWidgetHost *) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_view_aura.cc:1021:9
#4 0x7ff97ecc39b0 in content::WebContentsImpl::CreateRenderWidgetHostViewForRenderManager(class content::RenderViewHost *) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.cc:10437:16
#5 0x7ff97ecc41f1 in content::WebContentsImpl::CreateRenderViewForRenderManager(class content::RenderViewHost *, class std::__Cr::optional<class blink::MultiToken<class base::TokenType<class blink::LocalFrameTokenTypeMarker>, class base::TokenType<class blink::RemoteFrameTokenTypeMarker>>> const &, class content::RenderFrameProxyHost *, class std::__Cr::optional<class base::UnguessableToken> const &) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.cc:10463:5
#6 0x7ff97e582edd in content::RenderFrameHostManager::InitRenderView(class content::SiteInstanceGroup *, class content::RenderViewHostImpl *, class content::RenderFrameProxyHost *, class std::__Cr::optional<class base::UnguessableToken> const &) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:4666:29
#7 0x7ff97e57084e in content::RenderFrameHostManager::ReinitializeMainRenderFrame(class content::RenderFrameHostImpl *, class std::__Cr::optional<class base::UnguessableToken> const &) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:4909:8
#8 0x7ff97e569550 in content::RenderFrameHostManager::GetFrameHostForNavigation(class content::NavigationRequest *, class content::BrowsingContextGroupSwap *, struct content::ProcessAllocationContext const &, class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> *) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:2085:10
#9 0x7ff97e566510 in content::RenderFrameHostManager::DidCreateNavigationRequest(class content::NavigationRequest *) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:1557:21
#10 0x7ff97e0f43f9 in content::FrameTreeNode::TakeNavigationRequest(class std::__Cr::unique_ptr<class content::NavigationRequest, struct std::__Cr::default_delete<class content::NavigationRequest>>) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\frame_tree_node.cc:626:21
#11 0x7ff97e3da06b in content::Navigator::Navigate(class std::__Cr::unique_ptr<class content::NavigationRequest, struct std::__Cr::default_delete<class content::NavigationRequest>>, enum content::ReloadType) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\navigator.cc:945:20
#12 0x7ff97e2b0eb4 in content::NavigationControllerImpl::NavigateWithoutEntry(struct content::NavigationController::LoadURLParams const &, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\navigation_controller_impl.cc:3937:21
#13 0x7ff97e2af1a7 in content::NavigationControllerImpl::LoadURLWithParams(struct content::NavigationController::LoadURLParams const &) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\navigation_controller_impl.cc:1461:10
#14 0x7ff99d91015b in `anonymous namespace'::LoadURLInContents C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\browser_navigator.cc:455:43
#15 0x7ff99d90b3be in Navigate(struct NavigateParams *) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\browser_navigator.cc:883:27
#16 0x7ff99d989805 in Browser::OpenURLFromTab(class content::WebContents *, struct content::OpenURLParams const &, class base::OnceCallback<(class content::NavigationHandle &)>) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\browser.cc:2053:7
#17 0x7ff97ec7af0d in content::WebContentsImpl::OpenURL(struct content::OpenURLParams const &, class base::OnceCallback<(class content::NavigationHandle &)>) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.cc:6336:42
#18 0x7ff97e3db99e in content::Navigator::RequestOpenURL(class content::RenderFrameHostImpl *, class GURL const &, class base::TokenType<class blink::LocalFrameTokenTypeMarker> const *, int, class std::__Cr::optional<class url::Origin> const &, class std::__Cr::optional<class GURL> const &, class scoped_refptr<class network::ResourceRequestBody> const &, class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::Referrer const &, enum WindowOpenDisposition, bool, bool, enum blink::mojom::TriggeringEventInfo, class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, class scoped_refptr<class network::SharedURLLoaderFactory>, class std::__Cr::optional<struct blink::Impression> const &, bool) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\navigator.cc:1062:14
#19 0x7ff97e488967 in content::RenderFrameHostImpl::OpenURL(class mojo::StructPtr<class blink::mojom::OpenURLParams>) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:9601:32
#20 0x7ff9784edcf1 in content::mojom::FrameHostStubDispatch::Accept(class content::mojom::FrameHost *, class mojo::Message *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\content\common\frame.mojom.cc:6226:13
#21 0x7ff986cbf7ff in mojo::InterfaceEndpointClient::HandleValidatedMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:1059:54
#22 0x7ff986cbc4e9 in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:48:24
#23 0x7ff986cc5aee in mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:731:20
#24 0x7ff98a4afd50 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1202:24
#25 0x7ff98a4b22b8 in base::internal::DecayedFunctorTraits<void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
#26 0x7ff98a4b22b8 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
#27 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
#28 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
#29 0x7ff986f71523 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
#30 0x7ff986f71523 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34
#31 0x7ff986f448e9 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:104
#32 0x7ff986f448e9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:358 in std::__Cr::vector<base::internal::CheckedObserverAdapter,std::__Cr::allocator<base::internal::CheckedObserverAdapter> >::end
Shadow bytes around the buggy address:
0x12d8fae6ba80: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
0x12d8fae6bb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
0x12d8fae6bb80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x12d8fae6bc00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x12d8fae6bc80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x12d8fae6bd00: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd
0x12d8fae6bd80: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
0x12d8fae6be00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
0x12d8fae6be80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x12d8fae6bf00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x12d8fae6bf80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==8732==ADDITIONAL INFO
==8732==Note: Please include this section with the ASan report.
Task trace:
#0 0x7ff98a4a0edf in IPC::ChannelAssociatedGroupController::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1141:13
#1 0x7ff987488418 in mojo::SimpleWatcher::Context::Notify(unsigned int, struct MojoHandleSignalsState, unsigned int) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc:102:13
Command line: `chrome.exe --no-sandbox --flag-switches-begin --enable-features=SideBySide --flag-switches-end --file-url-path-alias="/gen=C:\Users\Puf\Desktop\win32-release_x64_asan-win32-release_x64-1495507\gen"`
MiraclePtr Status: MANUAL ANALYSIS REQUIRED
A pointer to the same region was extracted from a raw_ptr<T> object prior to this crash.
To determine the protection status, enable extraction warnings and check whether the raw_ptr<T> object can be destroyed or overwritten between the extraction and use.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.
==8732==END OF ADDITIONAL INFO
==8732==ABORTING
References
On This Page