Chrome · Aura
CVE-2025-8882
UAF in Aura
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc
Patch
From 52f3b7419bc8892f011643006a1a075b5a7a9c82 Mon Sep 17 00:00:00 2001
From: Gastón Rodríguez <gastonr@microsoft.com>
Date: Thu, 07 Aug 2025 09:23:45 -0700
Subject: [PATCH] Reset DragDrop window observator to avoid UAF
CL:6779234 introduced a scoped observation to avoid calling the window
after it had been freed when a drag and drop was ongoing. This fix
introduced another UAF in a similar scenario; when the
ScopedObservation is being deleted it attempts to access the window to
remove itself as an observer. If the window has been deleted, then a
UAF happens. This CL calls Reset on the ScopedObserver when the window
is destroyed to avoid this call after the fact.
Steps to repro:
1. Open the HTML linked in the crbug in an ASAN build.
2. Click the button that says "Open new tab with draggable element"
3. On the new tab, drag the red square and hold the drag for a second.
The window should close, and you should see the UAF stack trace on the
console. After this patch, this problem is gone.
Bug: 435623339, 432497641
Change-Id: Ie0d54d6c07834cbc305e126156e7e23d92283c01
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6821521
Reviewed-by: David Bienvenu <davidbienvenu@chromium.org>
Commit-Queue: Gaston Rodriguez <gastonr@microsoft.com>
Reviewed-by: Dana Fried <dfried@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1498283}
---
diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc
index 069db7a6..bcfe5de 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_win.cc
@@ -37,6 +37,7 @@
// aura::WindowObserver:
void OnWindowDestroying(aura::Window* window) override {
source_window_alive_ = false;
+ scoped_observation_.Reset();
}
bool source_window_alive() { return source_window_alive_; }
Loading diff…
Original Bug Report
reported by pu...@gmail.com
"heap-use-after-free in std::Cr::vector<base::internal::CheckedObserverAdapter,std::Cr::allocator<base::internal::CheckedObserverAdapter> >::end
REPRODUCTION CASE enable the #side-by-side flag
- Open Poc.html
- Drag and Drop picture in new window split screen feature
VERSION Chrome Version: Beta Operating System: Windows
FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: browser Crash State: see asan file
CREDIT INFORMATION Reporter credit:Puf
[8732:13700:0801/164547.139:ERROR:google_apis\gcm\engine\registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
=================================================================
==8732==ERROR: AddressSanitizer: heap-use-after-free on address 0x12d8fae6bd30 at pc 0x7ff98ddd515a bp 0x00fdea7f7280 sp 0x00fdea7f72c8
READ of size 8 at 0x12d8fae6bd30 thread T0
#0 0x7ff98ddd5159 in std::__Cr::vector<base::internal::CheckedObserverAdapter,std::__Cr::allocator<base::internal::CheckedObserverAdapter> >::end C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:358
#1 0x7ff98ddd5159 in std::__Cr::ranges::__end::__fn::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__ranges\access.h:132
#2 0x7ff98ddd5159 in std::__Cr::ranges::__find_if::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\ranges_find_if.h:58
#3 0x7ff98ddd5159 in base::ObserverList<class aura::WindowObserver, 1, 1, class base::internal::CheckedObserverAdapter>::RemoveObserver(class aura::WindowObserver const *) C:\b\s\w\ir\cache\builder\src\base\observer_list.h:329:21
#4 0x7ff98550879c in base::ScopedObservationTraits<aura::Window,aura::WindowObserver>::RemoveObserver C:\b\s\w\ir\cache\builder\src\base\scoped_observation_traits.h:74
#5 0x7ff98550879c in base::ScopedObservation<aura::Window,aura::WindowObserver>::Reset C:\b\s\w\ir\cache\builder\src\base\scoped_observation.h:115
#6 0x7ff98550879c in base::ScopedObservation<class aura::Window, class aura::WindowObserver>::~ScopedObservation<class aura::Window, class aura::WindowObserver>(void) C:\b\s\w\ir\cache\builder\src\base\scoped_observation.h:101:26
#7 0x7ff985507c7b in views::`anonymous namespace'::SourceWindowObserver::~SourceWindowObserver C:\b\s\w\ir\cache\builder\src\ui\views\widget\desktop_aura\desktop_drag_drop_client_win.cc:30
#8 0x7ff985507c7b in views::DesktopDragDropClientWin::StartDragAndDrop(class std::__Cr::unique_ptr<class ui::OSExchangeData, struct std::__Cr::default_delete<class ui::OSExchangeData>>, class aura::Window *, class aura::Window *, class gfx::Point const &, int, enum ui::mojom::DragEventSource) C:\b\s\w\ir\cache\builder\src\ui\views\widget\desktop_aura\desktop_drag_drop_client_win.cc:140:1
#9 0x7ff97ed49296 in content::WebContentsViewAura::StartDragging(struct content::DropData const &, class url::Origin const &, enum blink::DragOperationsMask, class gfx::ImageSkia const &, class gfx::Vector2d const &, class gfx::Rect const &, class blink::mojom::DragEventSourceInfo const &, class content::RenderWidgetHostImpl *) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_view_aura.cc:1167:15
#10 0x7ff97e6749a9 in content::RenderWidgetHostImpl::StartDragging(class mojo::StructPtr<class blink::mojom::DragData>, class url::Origin const &, enum blink::DragOperationsMask, class SkBitmap const &, class gfx::Vector2d const &, class gfx::Rect const &, class mojo::StructPtr<class blink::mojom::DragEventSourceInfo>) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_widget_host_impl.cc:2938:9
#11 0x7ff97e499833 in content::RenderFrameHostImpl::StartDragging(class mojo::StructPtr<class blink::mojom::DragData>, enum blink::DragOperationsMask, class SkBitmap const &, class gfx::Vector2d const &, class gfx::Rect const &, class mojo::StructPtr<class blink::mojom::DragEventSourceInfo>) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:10902:26
#12 0x7ff977a050fb in blink::mojom::LocalFrameHostStubDispatch::Accept(class blink::mojom::LocalFrameHost *, class mojo::Message *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\public\mojom\frame\frame.mojom.cc:11256:13
#13 0x7ff986cbf7ff in mojo::InterfaceEndpointClient::HandleValidatedMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:1059:54
#14 0x7ff986cbc4e9 in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:48:24
#15 0x7ff986cc5aee in mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:731:20
#16 0x7ff98a4afd50 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1202:24
#17 0x7ff98a4b22b8 in base::internal::DecayedFunctorTraits<void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
#18 0x7ff98a4b22b8 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
#19 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
#20 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
#21 0x7ff986f71523 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
#22 0x7ff986f71523 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34
#23 0x7ff986f448e9 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:104
#24 0x7ff986f448e9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
#25 0x7ff986f4378f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
#26 0x7ff986de2500 in base::MessagePumpForUI::DoRunLoop(void) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_win.cc:260:67
#27 0x7ff986ddfec8 in base::MessagePumpWin::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_win.cc:87:3
#28 0x7ff986f46621 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
#29 0x7ff986fe312e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
#30 0x7ff97d0c50ad in content::BrowserMainLoop::RunMainMessageLoop(void) C:\b\s\w\ir\cache\builder\src\content\browser\browser_main_loop.cc:1109:18
#31 0x7ff97d0ccd29 in content::BrowserMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\browser\browser_main_runner_impl.cc:156:15
#32 0x7ff97d0bb8cc in content::BrowserMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\browser\browser_main.cc:32:28
#33 0x7ff98363c042 in content::RunBrowserProcessMain(struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:701:10
#34 0x7ff98363f197 in content::ContentMainRunnerImpl::RunBrowser(struct content::MainFunctionParams, bool) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1275:10
#35 0x7ff98363e99e in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1127:12
#36 0x7ff983632878 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:361:36
#37 0x7ff98363343d in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:374:10
#38 0x7ff9740e2b0b in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
#39 0x7ff7182e479b in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
#40 0x7ff7182e200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20
#41 0x7ff71879ef7b in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
#42 0x7ff71879ef7b in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#43 0x7ffa4f55e8d6 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
#44 0x7ffa50ddc34b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18003c34b)
0x12d8fae6bd30 is located 432 bytes inside of 544-byte region [0x12d8fae6bb80,0x12d8fae6bda0)
freed by thread T0 here:
#0 0x7ff9d3e7c584 (C:\Users\Puf\Desktop\win32-release_x64_asan-win32-release_x64-1495507\clang_rt.asan_dynamic-x86_64.dll+0x18005c584)
#1 0x7ff98dde6bf0 in aura::Window::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\ui\aura\window.h:193
#2 0x7ff97e64bd90 in content::RenderWidgetHostImpl::Destroy(bool) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_widget_host_impl.cc:2458:12
#3 0x7ff97e6527da in content::RenderWidgetHostImpl::ShutdownAndDestroyWidget(bool) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_widget_host_impl.cc:836:3
#4 0x7ff97e63275d in content::RenderViewHostImpl::~RenderViewHostImpl(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_view_host_impl.cc:380:16
#5 0x7ff97e63e0af in content::RenderViewHostImpl::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_view_host_impl.h:371
#6 0x7ff97e423c5a in base::RefCounted<content::RenderViewHostImpl,base::DefaultRefCountedTraits<content::RenderViewHostImpl> >::DeleteInternal C:\b\s\w\ir\cache\builder\src\base\memory\ref_counted.h:375
#7 0x7ff97e423c5a in base::DefaultRefCountedTraits<content::RenderViewHostImpl>::Destruct C:\b\s\w\ir\cache\builder\src\base\memory\ref_counted.h:341
#8 0x7ff97e423c5a in base::RefCounted<content::RenderViewHostImpl,base::DefaultRefCountedTraits<content::RenderViewHostImpl> >::Release C:\b\s\w\ir\cache\builder\src\base\memory\ref_counted.h:364
#9 0x7ff97e423c5a in scoped_refptr<content::RenderViewHostImpl>::Release C:\b\s\w\ir\cache\builder\src\base\memory\scoped_refptr.h:392
#10 0x7ff97e423c5a in scoped_refptr<content::RenderViewHostImpl>::~scoped_refptr C:\b\s\w\ir\cache\builder\src\base\memory\scoped_refptr.h:280
#11 0x7ff97e423c5a in scoped_refptr<content::RenderViewHostImpl>::reset C:\b\s\w\ir\cache\builder\src\base\memory\scoped_refptr.h:311
#12 0x7ff97e423c5a in content::RenderFrameHostImpl::~RenderFrameHostImpl(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:2847:21
#13 0x7ff97e4f1e9f in content::RenderFrameHostImpl::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:2619:45
#14 0x7ff97e55249e in std::__Cr::default_delete<content::RenderFrameHostImpl>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:77
#15 0x7ff97e55249e in std::__Cr::unique_ptr<content::RenderFrameHostImpl,std::__Cr::default_delete<content::RenderFrameHostImpl> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:290
#16 0x7ff97e55249e in std::__Cr::unique_ptr<content::RenderFrameHostImpl,std::__Cr::default_delete<content::RenderFrameHostImpl> >::~unique_ptr C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:259
#17 0x7ff97e55249e in content::RenderFrameHostManager::~RenderFrameHostManager(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:666:3
#18 0x7ff97e0f0055 in content::FrameTreeNode::~FrameTreeNode(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\frame_tree_node.cc:324:1
#19 0x7ff97e0d86ce in content::FrameTree::~FrameTree(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\frame_tree.cc:231:1
#20 0x7ff97ec346ac in content::WebContentsImpl::~WebContentsImpl(void) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.cc:1567:1
#21 0x7ff97ecdb0ef in content::WebContentsImpl::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.h:1447
#22 0x7ff983857712 in std::__Cr::default_delete<content::WebContents>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:77
#23 0x7ff983857712 in std::__Cr::unique_ptr<content::WebContents,std::__Cr::default_delete<content::WebContents> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:290
#24 0x7ff983857712 in std::__Cr::unique_ptr<content::WebContents,std::__Cr::default_delete<content::WebContents> >::~unique_ptr C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:259
#25 0x7ff983857712 in tabs::TabModel::~TabModel(void) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\tabs\tab_model.cc:97:1
#26 0x7ff9838672f2 in std::__Cr::default_delete<tabs::TabModel>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:77
#27 0x7ff9838672f2 in std::__Cr::unique_ptr<tabs::TabModel,std::__Cr::default_delete<tabs::TabModel> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:290
#28 0x7ff9838672f2 in TabStripModel::SendDetachWebContentsNotifications(struct TabStripModel::DetachNotifications *) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\tabs\tab_strip_model.cc:856:15
#29 0x7ff9838829fb in TabStripModel::CloseTabs(class base::span<class content::WebContents *const, -1, class content::WebContents *const *>, unsigned int) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\tabs\tab_strip_model.cc:3352:5
#30 0x7ff98388445b in TabStripModel::CloseWebContentsAt(int, unsigned int) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\tabs\tab_strip_model.cc:1148:3
#31 0x7ff99d904345 in chrome::CloseWebContents(class Browser *, class content::WebContents *, bool) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\browser_tabstrip.cc:123:31
#32 0x7ff97ecb358e in content::WebContentsImpl::Close(void) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.cc:9348:16
#33 0x7ff97e46e2f3 in content::RenderFrameHostImpl::ClosePageIgnoringUnloadEvents(enum content::RenderFrameHostImpl::ClosePageSource, class base::RepeatingCallback<(void)>) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:7421:14
#34 0x7ff97e46df2f in content::RenderFrameHostImpl::RequestClose(void) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:7285:3
#35 0x7ff977a2a638 in blink::mojom::LocalMainFrameHostStubDispatch::Accept(class blink::mojom::LocalMainFrameHost *, class mojo::Message *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\public\mojom\frame\frame.mojom.cc:23843:13
#36 0x7ff986cbf7ff in mojo::InterfaceEndpointClient::HandleValidatedMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:1059:54
#37 0x7ff986cbc4e9 in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:48:24
#38 0x7ff986cc5aee in mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:731:20
#39 0x7ff98a4afd50 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1202:24
#40 0x7ff98a4b22b8 in base::internal::DecayedFunctorTraits<void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
#41 0x7ff98a4b22b8 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
#42 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
#43 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
#44 0x7ff986f71523 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
#45 0x7ff986f71523 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34
previously allocated by thread T0 here:
#0 0x7ff9d3e7b99d (C:\Users\Puf\Desktop\win32-release_x64_asan-win32-release_x64-1495507\clang_rt.asan_dynamic-x86_64.dll+0x18005b99d)
#1 0x7ff97e68f82a in content::RenderWidgetHostViewAura::CreateAuraWindow(enum aura::client::WindowType) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_widget_host_view_aura.cc:2660:13
#2 0x7ff97e68f214 in content::RenderWidgetHostViewAura::InitAsChild(class aura::Window *) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_widget_host_view_aura.cc:320:3
#3 0x7ff97ed468f0 in content::WebContentsViewAura::CreateViewForWidget(class content::RenderWidgetHost *) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_view_aura.cc:1021:9
#4 0x7ff97ecc39b0 in content::WebContentsImpl::CreateRenderWidgetHostViewForRenderManager(class content::RenderViewHost *) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.cc:10437:16
#5 0x7ff97ecc41f1 in content::WebContentsImpl::CreateRenderViewForRenderManager(class content::RenderViewHost *, class std::__Cr::optional<class blink::MultiToken<class base::TokenType<class blink::LocalFrameTokenTypeMarker>, class base::TokenType<class blink::RemoteFrameTokenTypeMarker>>> const &, class content::RenderFrameProxyHost *, class std::__Cr::optional<class base::UnguessableToken> const &) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.cc:10463:5
#6 0x7ff97e582edd in content::RenderFrameHostManager::InitRenderView(class content::SiteInstanceGroup *, class content::RenderViewHostImpl *, class content::RenderFrameProxyHost *, class std::__Cr::optional<class base::UnguessableToken> const &) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:4666:29
#7 0x7ff97e57084e in content::RenderFrameHostManager::ReinitializeMainRenderFrame(class content::RenderFrameHostImpl *, class std::__Cr::optional<class base::UnguessableToken> const &) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:4909:8
#8 0x7ff97e569550 in content::RenderFrameHostManager::GetFrameHostForNavigation(class content::NavigationRequest *, class content::BrowsingContextGroupSwap *, struct content::ProcessAllocationContext const &, class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> *) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:2085:10
#9 0x7ff97e566510 in content::RenderFrameHostManager::DidCreateNavigationRequest(class content::NavigationRequest *) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_manager.cc:1557:21
#10 0x7ff97e0f43f9 in content::FrameTreeNode::TakeNavigationRequest(class std::__Cr::unique_ptr<class content::NavigationRequest, struct std::__Cr::default_delete<class content::NavigationRequest>>) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\frame_tree_node.cc:626:21
#11 0x7ff97e3da06b in content::Navigator::Navigate(class std::__Cr::unique_ptr<class content::NavigationRequest, struct std::__Cr::default_delete<class content::NavigationRequest>>, enum content::ReloadType) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\navigator.cc:945:20
#12 0x7ff97e2b0eb4 in content::NavigationControllerImpl::NavigateWithoutEntry(struct content::NavigationController::LoadURLParams const &, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\navigation_controller_impl.cc:3937:21
#13 0x7ff97e2af1a7 in content::NavigationControllerImpl::LoadURLWithParams(struct content::NavigationController::LoadURLParams const &) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\navigation_controller_impl.cc:1461:10
#14 0x7ff99d91015b in `anonymous namespace'::LoadURLInContents C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\browser_navigator.cc:455:43
#15 0x7ff99d90b3be in Navigate(struct NavigateParams *) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\browser_navigator.cc:883:27
#16 0x7ff99d989805 in Browser::OpenURLFromTab(class content::WebContents *, struct content::OpenURLParams const &, class base::OnceCallback<(class content::NavigationHandle &)>) C:\b\s\w\ir\cache\builder\src\chrome\browser\ui\browser.cc:2053:7
#17 0x7ff97ec7af0d in content::WebContentsImpl::OpenURL(struct content::OpenURLParams const &, class base::OnceCallback<(class content::NavigationHandle &)>) C:\b\s\w\ir\cache\builder\src\content\browser\web_contents\web_contents_impl.cc:6336:42
#18 0x7ff97e3db99e in content::Navigator::RequestOpenURL(class content::RenderFrameHostImpl *, class GURL const &, class base::TokenType<class blink::LocalFrameTokenTypeMarker> const *, int, class std::__Cr::optional<class url::Origin> const &, class std::__Cr::optional<class GURL> const &, class scoped_refptr<class network::ResourceRequestBody> const &, class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::Referrer const &, enum WindowOpenDisposition, bool, bool, enum blink::mojom::TriggeringEventInfo, class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, class scoped_refptr<class network::SharedURLLoaderFactory>, class std::__Cr::optional<struct blink::Impression> const &, bool) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\navigator.cc:1062:14
#19 0x7ff97e488967 in content::RenderFrameHostImpl::OpenURL(class mojo::StructPtr<class blink::mojom::OpenURLParams>) C:\b\s\w\ir\cache\builder\src\content\browser\renderer_host\render_frame_host_impl.cc:9601:32
#20 0x7ff9784edcf1 in content::mojom::FrameHostStubDispatch::Accept(class content::mojom::FrameHost *, class mojo::Message *) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\content\common\frame.mojom.cc:6226:13
#21 0x7ff986cbf7ff in mojo::InterfaceEndpointClient::HandleValidatedMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:1059:54
#22 0x7ff986cbc4e9 in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:48:24
#23 0x7ff986cc5aee in mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:731:20
#24 0x7ff98a4afd50 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1202:24
#25 0x7ff98a4b22b8 in base::internal::DecayedFunctorTraits<void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
#26 0x7ff98a4b22b8 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
#27 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
#28 0x7ff98a4b22b8 in base::internal::Invoker<base::internal::FunctorTraits<void (ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::(anonymous namespace)::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::(anonymous namespace)::ScopedUrgentMessageNotification>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
#29 0x7ff986f71523 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
#30 0x7ff986f71523 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207:34
#31 0x7ff986f448e9 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:104
#32 0x7ff986f448e9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:358 in std::__Cr::vector<base::internal::CheckedObserverAdapter,std::__Cr::allocator<base::internal::CheckedObserverAdapter> >::end
Shadow bytes around the buggy address:
0x12d8fae6ba80: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
0x12d8fae6bb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
0x12d8fae6bb80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x12d8fae6bc00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x12d8fae6bc80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x12d8fae6bd00: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd
0x12d8fae6bd80: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
0x12d8fae6be00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
0x12d8fae6be80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x12d8fae6bf00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x12d8fae6bf80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==8732==ADDITIONAL INFO
==8732==Note: Please include this section with the ASan report.
Task trace:
#0 0x7ff98a4a0edf in IPC::ChannelAssociatedGroupController::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1141:13
#1 0x7ff987488418 in mojo::SimpleWatcher::Context::Notify(unsigned int, struct MojoHandleSignalsState, unsigned int) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc:102:13
Command line: `chrome.exe --no-sandbox --flag-switches-begin --enable-features=SideBySide --flag-switches-end --file-url-path-alias="/gen=C:\Users\Puf\Desktop\win32-release_x64_asan-win32-release_x64-1495507\gen"`
MiraclePtr Status: MANUAL ANALYSIS REQUIRED
A pointer to the same region was extracted from a raw_ptr<T> object prior to this crash.
To determine the protection status, enable extraction warnings and check whether the raw_ptr<T> object can be destroyed or overwritten between the extraction and use.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.
==8732==END OF ADDITIONAL INFO
==8732==ABORTING
References
On This Page