PatchGap
Chrome · IndexedDB

CVE-2026-15107

UAF in IndexedDB
Medium chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactUse after free in IndexedDB
DescriptionUse after free in IndexedDB
ComponentIndexedDB
Bug ClassUAF
Tracker503553615
Fix commitf507e6c6334f (chromium/src) +121/-6
CISA KEVNot listed
Creditedzh1x1an1221 of Ant Group Tianqiong Security Lab
Disclosed2026-07-08

Changed Functions

FunctionChangeNotes
if
third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.cc
 modified
for
third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db.js
 modified

Files Changed

  • third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.cc
  • third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.h
  • third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db-expected.txt
  • third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db.js

Patch

view commit
From f507e6c6334f3791b4b0e808343ceb0e95832273 Mon Sep 17 00:00:00 2001
From: Steve Becker <stevebe@microsoft.com>
Date: Fri, 26 Jun 2026 11:18:49 -0700
Subject: [PATCH] InspectorIndexedDBAgent must not use v8_session_ after disposal

`v8_session_` is a `raw_ptr` member of `InspectorIndexedDBAgent`. To
prevent use after frees, this fix updates
`InspectorIndexedDBAgent::Dispose()` to set `v8_session_` to `nullptr`.
The change then adds null checks before each use of `v8_session_`.
`nullptr`.

This fix follows the same pattern as `InspectorDOMAgent`:

https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/inspector/inspector_dom_agent.cc;drc=284b36ac2742525000db2ca28f448f6cc8584f40;l=3416

The change adds a test that repros 100% on ASAN builds.

Bug: 503553615
Change-Id: Ifa540fb83556710d197ed4b3c942ab61c37de35b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8007837
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Commit-Queue: Steve Becker <stevebe@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1653288}
---

diff --git a/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.cc b/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.cc
index 060b36f4..440c31c 100644
--- a/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.cc
+++ b/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.cc
@@ -104,6 +104,8 @@
 
 const char kIndexedDBObjectGroup[] = "indexeddb";
 const char kNoDocumentError[] = "No document for given frame found";
+const char kSessionDetachedDuringOperation[] =
+    "DevTools session detached during operation.";
 const char kOriginMismatchError[] =
     "Requested security origin does not match the target's origin.";
 
@@ -682,8 +684,8 @@
   void Invoke(ExecutionContext*, Event* event) override {
     InspectorIndexedDBAgent* agent = agent_.Get();
     if (!agent) {
-      request_callback_->sendFailure(protocol::Response::ServerError(
-          "DevTools session detached during operation."));
+      request_callback_->sendFailure(
+          protocol::Response::ServerError(kSessionDetachedDuringOperation));
       return;
     }
 
@@ -739,6 +741,11 @@
     }
 
     v8_inspector::V8InspectorSession* v8_session = agent->v8_session();
+    if (!v8_session) {
+      request_callback_->sendFailure(
+          protocol::Response::ServerError(kSessionDetachedDuringOperation));
+      return;
+    }
     ScriptState::Scope scope(script_state_);
     v8::Local<v8::Context> context = script_state_->GetContext();
     v8_inspector::StringView object_group =
@@ -883,6 +890,20 @@
 
 InspectorIndexedDBAgent::~InspectorIndexedDBAgent() = default;
 
+void InspectorIndexedDBAgent::Dispose() {
+  ReleaseObjectGroup();
+  v8_session_ = nullptr;
+  InspectorBaseAgent<protocol::IndexedDB::Metainfo>::Dispose();
+}
+
+void InspectorIndexedDBAgent::ReleaseObjectGroup() {
+  if (!v8_session_) {
+    return;
+  }
+  v8_session_->releaseObjectGroup(
+      ToV8InspectorStringView(kIndexedDBObjectGroup));
+}
+
 void InspectorIndexedDBAgent::Restore() {
   if (enabled_.Get()) {
     enable();
@@ -891,8 +912,7 @@
 
 void InspectorIndexedDBAgent::DidCommitLoadForLocalFrame(LocalFrame* frame) {
   if (frame == inspected_frames_->Root()) {
-    v8_session_->releaseObjectGroup(
-        ToV8InspectorStringView(kIndexedDBObjectGroup));
+    ReleaseObjectGroup();
   }
 }
 
@@ -903,8 +923,7 @@
 
 protocol::Response InspectorIndexedDBAgent::disable() {
   enabled_.Clear();
-  v8_session_->releaseObjectGroup(
-      ToV8InspectorStringView(kIndexedDBObjectGroup));
+  ReleaseObjectGroup();
   return protocol::Response::Success();
 }
 
diff --git a/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.h b/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.h
index dd3f49a9..edef1825 100644
--- a/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.h
+++ b/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.h
@@ -57,6 +57,7 @@
 
   v8_inspector::V8InspectorSession* v8_session() { return v8_session_; }
 
+  void Dispose() override;
   void Restore() override;
   void DidCommitLoadForLocalFrame(LocalFrame*) override;
 
@@ -115,10 +116,13 @@
       std::unique_ptr<DeleteDatabaseCallback>) override;
 
  private:
+  void ReleaseObjectGroup();
+
   // This is null while inspecting workers.
   Member<InspectedFrames> inspected_frames_;
   // This is null while inspecting frames.
   Member<WorkerGlobalScope> worker_global_scope_;
+  // This is null after `InspectorIndexedDBAgent` is disposed.
   raw_ptr<v8_inspector::V8InspectorSession, DanglingUntriaged> v8_session_;
   InspectorAgentState::Boolean enabled_;
 };
diff --git a/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db-expected.txt b/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db-expected.txt
new file mode 100644
index 0000000..6e8509a
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db-expected.txt
@@ -0,0 +1,4 @@
+Race IndexedDB requestData() with navigation using a large dataset.
+Round 0 completed without a crash.
+Round 1 completed without a crash.
+
diff --git a/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db.js b/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db.js
new file mode 100644
index 0000000..f52afef
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db.js
@@ -0,0 +1,88 @@
+(async function(/** @type {import('test_runner').TestRunner} */ testRunner) {
+  const {page, session, dp} = await testRunner.startBlank(
+      'Race IndexedDB requestData() with navigation using a large dataset.');
+
+  const rounds = 2;
+  const valueCount = 64;
+  const valueSize = 8192;
+  const securityOrigin = await session.evaluate('location.origin');
+
+  await dp.Page.enable();
+  await dp.Runtime.enable();
+  await dp.IndexedDB.enable();
+
+  // Repeat the test multiple times to trigger the race.
+  for (let round = 0; round < rounds; ++round) {
+    const dbName = `RaceDB_${round}`;
+
+    // Navigate to an empty page to set up IndexedDB.
+    await dp.Page.navigate(
+        {url: securityOrigin + '/inspector-protocol/resources/empty.html'});
+    await dp.Page.onceLoadEventFired();
+
+    // Create a larger IndexedDB with KBs data to make requestData() take longer.
+    await session.evaluateAsync(`(async () => {
+      const dbName = ${JSON.stringify(dbName)};
+      const storeName = 'TestObjectStore';
+      const payload = 'X'.repeat(${valueSize});
+      await new Promise((resolve, reject) => {
+        const request = indexedDB.deleteDatabase(dbName);
+        request.onsuccess = () => resolve();
+        request.onerror = () => resolve();
+        request.onblocked = () => reject(String(request.error || 'delete blocked'));
+      });
+      await new Promise((resolve, reject) => {
+        const request = indexedDB.open(dbName, 1);
+        request.onupgradeneeded = event => {
+          const db = event.target.result;
+          const store = db.createObjectStore(storeName, {keyPath: 'id'});
+          for (let i = 0; i < ${valueCount}; ++i) {
+            store.put({id: i, label: 'row-' + i, value: payload + i});
+          }
+        };
+        request.onsuccess = () => {
+          request.result.close();
+          resolve();
+        };
+        request.onerror = () => reject(String(request.error || 'open failed'));
+      });
+      return 'done';
+    })()`);
+
+    // Start an async IndexedDB read.
+    dp.IndexedDB.requestData({
+      securityOrigin: securityOrigin,
+      databaseName: dbName,
+      objectStoreName: 'TestObjectStore',
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db-expected.txt b/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db-expected.txt
new file mode 100644
index 0000000..6e8509a
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db-expected.txt
@@ -0,0 +1,4 @@
+Race IndexedDB requestData() with navigation using a large dataset.
+Round 0 completed without a crash.
+Round 1 completed without a crash.
+
diff --git a/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db.js b/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db.js
new file mode 100644
index 0000000..f52afef
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/inspector-protocol/storage/indexed-db-request-data-race-with-navigation-large-db.js
@@ -0,0 +1,88 @@
+(async function(/** @type {import('test_runner').TestRunner} */ testRunner) {
+  const {page, session, dp} = await testRunner.startBlank(
+      'Race IndexedDB requestData() with navigation using a large dataset.');
+
+  const rounds = 2;
+  const valueCount = 64;
+  const valueSize = 8192;
+  const securityOrigin = await session.evaluate('location.origin');
+
+  await dp.Page.enable();
+  await dp.Runtime.enable();
+  await dp.IndexedDB.enable();
+
+  // Repeat the test multiple times to trigger the race.
+  for (let round = 0; round < rounds; ++round) {
+    const dbName = `RaceDB_${round}`;
+
+    // Navigate to an empty page to set up IndexedDB.
+    await dp.Page.navigate(
+        {url: securityOrigin + '/inspector-protocol/resources/empty.html'});
+    await dp.Page.onceLoadEventFired();
+
+    // Create a larger IndexedDB with KBs data to make requestData() take longer.
+    await session.evaluateAsync(`(async () => {
+      const dbName = ${JSON.stringify(dbName)};
+      const storeName = 'TestObjectStore';
+      const payload = 'X'.repeat(${valueSize});
+      await new Promise((resolve, reject) => {
+        const request = indexedDB.deleteDatabase(dbName);
+        request.onsuccess = () => resolve();
+        request.onerror = () => resolve();
+        request.onblocked = () => reject(String(request.error || 'delete blocked'));
+      });
+      await new Promise((resolve, reject) => {
+        const request = indexedDB.open(dbName, 1);
+        request.onupgradeneeded = event => {
+          const db = event.target.result;
+          const store = db.createObjectStore(storeName, {keyPath: 'id'});
+          for (let i = 0; i < ${valueCount}; ++i) {
+            store.put({id: i, label: 'row-' + i, value: payload + i});
+          }
+        };
+        request.onsuccess = () => {
+          request.result.close();
+          resolve();
+        };
+        request.onerror = () => reject(String(request.error || 'open failed'));
+      });
+      return 'done';
+    })()`);
+
+    // Start an async IndexedDB read.
+    dp.IndexedDB.requestData({
+      securityOrigin: securityOrigin,
+      databaseName: dbName,
+      objectStoreName: 'TestObjectStore',
+      skipCount: 0,
+      pageSize: valueCount,
+    });
+
+    // Navigate immediately to race against the pending requestData() callback.
+    dp.Page.navigate(
+        {url: 'data:text/html,<body>navigated<iframe></iframe></body>'});
+
+    // Allow time for teardown to execute while the requestData() callback may still fire.
+    await new Promise(resolve => setTimeout(resolve, 500));
+
+    testRunner.log(`Round ${round} completed without a crash.`);
+  }
+
+  // Clean up the databases.
+  await dp.Page.navigate(
+      {url: securityOrigin + '/inspector-protocol/resources/empty.html'});
+  await dp.Page.onceLoadEventFired();
+  await session.evaluateAsync(`(async () => {
+    for (let round = 0; round < ${rounds}; ++round) {
+      await new Promise(resolve => {
+        const request = indexedDB.deleteDatabase('RaceDB_' + round);
+        request.onsuccess = () => resolve();
+        request.onerror = () => resolve();
+        request.onblocked = () => resolve();
+      });
+    }
+    return 'done';
+  })()`);
+
+  testRunner.completeTest();
+})
Loading diff…

Original Bug Report

reported by zh...@gmail.com

Security: heap-use-after-free in blink::(anonymous namespace)::OpenCursorCallback::Invoke

Steps to reproduce the problem

  1. Compile asan chromium on any system:
git checkout f4425098eb1734f3419fdc5376c80a8b4e324b35
gn gen out/asan-0416 --args="is_component_build=true is_debug=false is_asan=true symbol_level=2 dcheck_always_on=false treat_warnings_as_errors=false"
  1. Ensure that poc.html and aaa.html are in the same directory, and that http-server has been started.
./out/asan-0416/Chromium.app/Contents/MacOS/Chromium --no-sandbox --user-data-dir=/tmp/userdata/t1 --enable-unsafe-webgpu --js-flags=--expose-gc --enable-logging --v=1 --use-fake-device-for-media-stream --remote-debugging-port=9239 --remote-allow-origins='*' http://127.0.0.1/poc.html

Problem Description

RCA and BISECT coming soon!

Summary

Security: heap-use-after-free in blink::(anonymous namespace)::OpenCursorCallback::Invoke

Custom Questions

Crash state:

=================================================================
==69446==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100008a9c0 at pc 0x0001719fe7a8 bp 0x00016fc30ed0 sp 0x00016fc30ec8
READ of size 8 at 0x61100008a9c0 thread T0
==69446==WARNING: invalid path to external symbolizer!
==69446==WARNING: Failed to use and restart external symbolizer!
    #0 0x0001719fe7a4 in blink::(anonymous namespace)::OpenCursorCallback::Invoke(blink::ExecutionContext*, blink::Event*)+0x12cc (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1dca7a4)
    #1 0x0001512a8690 in blink::EventTarget::FireEventListeners(blink::Event&, blink::EventTargetData*, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember<blink::RegisteredEventListener, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 1u>)+0x1074 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_core.dylib:arm64+0xebc690)
    #2 0x0001512a6a2c in blink::EventTarget::FireEventListeners(blink::Event&)+0x378 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_core.dylib:arm64+0xebaa2c)
    #3 0x000171954058 in blink::IDBEventDispatcher::Dispatch(blink::Event&, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember<blink::EventTarget, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 0u>&)+0x4c4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d20058)
    #4 0x0001719a9500 in blink::IDBRequest::DispatchEventInternal(blink::Event&)+0x6cc (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d75500)
    #5 0x0001719a25e4 in blink::IDBRequest::SendResult(blink::IDBAny*)+0x37c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d6e5e4)
    #6 0x0001719a21d8 in blink::IDBRequest::SendResultCursorInternal(blink::IDBCursor*, std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBValue, std::__Cr::default_delete<blink::IDBValue>>)+0x164 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d6e1d8)
    #7 0x0001719a8850 in blink::IDBRequest::SendResultAdvanceCursor(std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBValue, std::__Cr::default_delete<blink::IDBValue>>)+0x14c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d74850)
    #8 0x0001719b6cb4 in blink::IDBRequestQueueItem::SendResult()+0x61c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d82cb4)
    #9 0x0001719c0af8 in blink::IDBTransaction::OnResultReady()+0x28c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d8caf8)
    #10 0x0001719aa6f4 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::IDBTransaction::*&&)(), cppgc::internal::BasicPersistent<blink::IDBTransaction, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&>, base::internal::BindState<true, true, false, void (blink::IDBTransaction::*)(), cppgc::internal::BasicPersistent<blink::IDBTransaction, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x11c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d766f4)
    #11 0x0001719b5b7c in blink::IDBRequestQueueItem::OnResultReady()+0x190 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d81b7c)
    #12 0x0001719c0734 in blink::IDBTransaction::EnqueueResult(std::__Cr::unique_ptr<blink::IDBRequestQueueItem, std::__Cr::default_delete<blink::IDBRequestQueueItem>>)+0x20c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d8c734)
    #13 0x0001719a4304 in blink::IDBRequest::HandleResponseAdvanceCursor(std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBValue, std::__Cr::default_delete<blink::IDBValue>>)+0x3c4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d70304)
    #14 0x00017193fbcc in base::internal::Invoker<base::internal::FunctorTraits<void (blink::IDBRequest::*&&)(std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBValue, std::__Cr::default_delete<blink::IDBValue>>), cppgc::internal::BasicPersistent<blink::IDBRequest, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>&&, std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>&&, std::__Cr::unique_ptr<blink::IDBValue, std::__Cr::default_delete<blink::IDBValue>>&&>, base::internal::BindState<true, true, false, void (blink::IDBRequest::*)(std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBValue, std::__Cr::default_delete<blink::IDBValue>>), cppgc::internal::BasicPersistent<blink::IDBRequest, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBKey, std::__Cr::default_delete<blink::IDBKey>>, std::__Cr::unique_ptr<blink::IDBValue, std::__Cr::default_delete<blink::IDBValue>>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x160 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d0bbcc)
    #15 0x000102bbd694 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x360 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x201694)
    #16 0x000102c34c5c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x8f8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x278c5c)
    #17 0x000102c33fac in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x277fac)
    #18 0x000102a5e438 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+0x224 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0xa2438)
    #19 0x000102c35fdc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x338 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x279fdc)
    #20 0x000102b28ce4 in base::RunLoop::Run(base::Location const&)+0x430 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x16cce4)
    #21 0x00013d4bd0cc in content::RendererMain(content::MainFunctionParams)+0x8ac (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3c250cc)
    #22 0x00013d7009f8 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*)+0x42c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e689f8)
    #23 0x00013d702b64 in content::ContentMainRunnerImpl::Run()+0x53c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e6ab64)
    #24 0x00013d6fe4c0 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x854 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e664c0)
    #25 0x00013d6fe9b0 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e669b0)
    #26 0x000118f3b898 in ChromeMain+0x494 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libchrome_dll.dylib:arm64+0xb898)
    #27 0x0001001ccb90 in main+0x250 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7796.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer):arm64+0x100000b90)
    #28 0x000189903da0 in start+0x1b4c (/usr/lib/dyld:arm64e+0x1fda0)

0x61100008a9c0 is located 0 bytes inside of 224-byte region [0x61100008a9c0,0x61100008aaa0)
freed by thread T0 here:
    #0 0x000100dd59f4 in __sanitizer_finish_switch_fiber+0xa0c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libclang_rt.asan_osx_dynamic.dylib:arm64+0x659f4)
    #1 0x00015242e5f0 in blink::DevToolsSession::Detach()+0x6b8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_core.dylib:arm64+0x20425f0)
    #2 0x00015243a4a4 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::DevToolsSession::*&&)(), cppgc::internal::BasicPersistent<blink::DevToolsSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&>, base::internal::BindState<true, true, false, void (blink::DevToolsSession::*)(), cppgc::internal::BasicPersistent<blink::DevToolsSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x120 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_core.dylib:arm64+0x204e4a4)
    #3 0x0001008bb5f8 in mojo::InterfaceEndpointClient::NotifyError(std::__Cr::optional<mojo::DisconnectReason> const&)+0x3bc (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libmojo_public_cpp_bindings.dylib:arm64+0x2b5f8)
    #4 0x0001073fcff8 in IPC::ChannelAssociatedGroupController::NotifyEndpointOfError(IPC::ChannelAssociatedGroupController::Endpoint*, bool)+0x3dc (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libipc.dylib:arm64+0x20ff8)
    #5 0x0001073fdd34 in IPC::ChannelAssociatedGroupController::NotifyEndpointOfErrorOnEndpointThread(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>)+0x1d4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libipc.dylib:arm64+0x21d34)
    #6 0x0001073fdfe0 in void base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>), IPC::ChannelAssociatedGroupController*&&, unsigned int&&, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>), scoped_refptr<IPC::ChannelAssociatedGroupController>, unsigned int, base::internal::UnretainedWrapper<IPC::ChannelAssociatedGroupController::Endpoint, base::unretained_traits::MayDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<void (IPC::ChannelAssociatedGroupController::*)(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>), std::__Cr::tuple<scoped_refptr<IPC::ChannelAssociatedGroupController>, unsigned int, base::internal::UnretainedWrapper<IPC::ChannelAssociatedGroupController::Endpoint, base::unretained_traits::MayDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul, 1ul, 2ul>(void (IPC::ChannelAssociatedGroupController::*&&)(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>), std::__Cr::tuple<scoped_refptr<IPC::ChannelAssociatedGroupController>, unsigned int, base::internal::UnretainedWrapper<IPC::ChannelAssociatedGroupController::Endpoint, base::unretained_traits::MayDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul, 2ul>)+0x1e4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libipc.dylib:arm64+0x21fe0)
    #7 0x000102bbd694 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x360 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x201694)
    #8 0x000102c34c5c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x8f8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x278c5c)
    #9 0x000102c33fac in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x277fac)
    #10 0x000102a5e438 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+0x224 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0xa2438)
    #11 0x000102c35fdc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x338 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x279fdc)
    #12 0x000102b28ce4 in base::RunLoop::Run(base::Location const&)+0x430 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x16cce4)
    #13 0x00013d4bd0cc in content::RendererMain(content::MainFunctionParams)+0x8ac (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3c250cc)
    #14 0x00013d7009f8 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*)+0x42c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e689f8)
    #15 0x00013d702b64 in content::ContentMainRunnerImpl::Run()+0x53c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e6ab64)
    #16 0x00013d6fe4c0 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x854 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e664c0)
    #17 0x00013d6fe9b0 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e669b0)
    #18 0x000118f3b898 in ChromeMain+0x494 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libchrome_dll.dylib:arm64+0xb898)
    #19 0x0001001ccb90 in main+0x250 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7796.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer):arm64+0x100000b90)
    #20 0x000189903da0 in start+0x1b4c (/usr/lib/dyld:arm64e+0x1fda0)

previously allocated by thread T0 here:
    #0 0x000100dd55fc in __sanitizer_finish_switch_fiber+0x614 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libclang_rt.asan_osx_dynamic.dylib:arm64+0x655fc)
    #1 0x000161258128 in v8_inspector::V8InspectorSessionImpl::create(v8_inspector::V8InspectorImpl*, int, int, v8_inspector::V8Inspector::ManagedChannel*, v8_inspector::StringView, v8_inspector::V8Inspector::ClientTrustLevel, std::__Cr::shared_ptr<v8_inspector::V8DebuggerBarrier>)+0xd8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libv8.dylib:arm64+0x2828128)
    #2 0x000161249e28 in v8_inspector::V8InspectorImpl::connectImpl(int, v8_inspector::V8Inspector::ManagedChannel*, v8_inspector::StringView, v8_inspector::V8Inspector::ClientTrustLevel, v8_inspector::V8Inspector::SessionPauseState)+0x368 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libv8.dylib:arm64+0x2819e28)
    #3 0x00016124a314 in v8_inspector::V8InspectorImpl::connectShared(int, v8_inspector::V8Inspector::ManagedChannel*, v8_inspector::StringView, v8_inspector::V8Inspector::ClientTrustLevel, v8_inspector::V8Inspector::SessionPauseState)+0x60 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libv8.dylib:arm64+0x281a314)
    #4 0x00015242f4c8 in blink::DevToolsSession::ConnectToV8(v8_inspector::V8Inspector*, int)+0x168 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_core.dylib:arm64+0x20434c8)
    #5 0x00015529bdf4 in blink::WebDevToolsAgentImpl::AttachSession(blink::DevToolsSession*, bool)+0x328 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_core.dylib:arm64+0x4eafdf4)
    #6 0x00015242d5ec in blink::DevToolsSession::DevToolsSession(blink::DevToolsAgent*, mojo::PendingAssociatedRemote<blink::mojom::blink::DevToolsSessionHost>, mojo::PendingAssociatedReceiver<blink::mojom::blink::DevToolsSession>, mojo::PendingReceiver<blink::mojom::blink::DevToolsSession>, mojo::StructPtr<blink::mojom::blink::DevToolsSessionState>, blink::String const&, bool, bool, blink::String const&, bool, scoped_refptr<base::SequencedTaskRunner>)+0xdd0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_core.dylib:arm64+0x20415ec)
    #7 0x000152429bb8 in blink::DevToolsSession* cppgc::MakeGarbageCollectedTrait<blink::DevToolsSession>::Call<blink::DevToolsAgent*, mojo::PendingAssociatedRemote<blink::mojom::blink::DevToolsSessionHost>, mojo::PendingAssociatedReceiver<blink::mojom::blink::DevToolsSession>, mojo::PendingReceiver<blink::mojom::blink::DevToolsSession>, mojo::StructPtr<blink::mojom::blink::DevToolsSessionState>, blink::String const&, bool&, bool&, blink::String const&, bool&, scoped_refptr<base::SingleThreadTaskRunner>>(cppgc::AllocationHandle&, blink::DevToolsAgent*&&, mojo::PendingAssociatedRemote<blink::mojom::blink::DevToolsSessionHost>&&, mojo::PendingAssociatedReceiver<blink::mojom::blink::DevToolsSession>&&, mojo::PendingReceiver<blink::mojom::blink::DevToolsSession>&&, mojo::StructPtr<blink::mojom::blink::DevToolsSessionState>&&, blink::String const&, bool&, bool&, blink::String const&, bool&, scoped_refptr<base::SingleThreadTaskRunner>&&)+0x230 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_core.dylib:arm64+0x203dbb8)
    #8 0x00015241d42c in blink::DevToolsAgent::AttachDevToolsSessionImpl(mojo::PendingAssociatedRemote<blink::mojom::blink::DevToolsSessionHost>, mojo::PendingAssociatedReceiver<blink::mojom::blink::DevToolsSession>, mojo::PendingReceiver<blink::mojom::blink::DevToolsSession>, mojo::StructPtr<blink::mojom::blink::DevToolsSessionState>, blink::String const&, bool, bool, blink::String const&, bool)+0x2e4 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_core.dylib:arm64+0x203142c)
    #9 0x00015241e028 in blink::DevToolsAgent::AttachDevToolsSession(mojo::PendingAssociatedRemote<blink::mojom::blink::DevToolsSessionHost>, mojo::PendingAssociatedReceiver<blink::mojom::blink::DevToolsSession>, mojo::PendingReceiver<blink::mojom::blink::DevToolsSession>, mojo::StructPtr<blink::mojom::blink::DevToolsSessionState>, blink::String const&, bool, bool, blink::String const&, bool)+0x264 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_core.dylib:arm64+0x2032028)
    #10 0x00015b5cc3b4 in blink::mojom::blink::DevToolsAgentStubDispatch::Accept(blink::mojom::blink::DevToolsAgent*, mojo::Message*)+0x584 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_platform.dylib:arm64+0x18703b4)
    #11 0x0001008b5d80 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*)+0x8fc (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libmojo_public_cpp_bindings.dylib:arm64+0x25d80)
    #12 0x0001008cbfb8 in mojo::MessageDispatcher::Accept(mojo::Message*)+0x2f0 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libmojo_public_cpp_bindings.dylib:arm64+0x3bfb8)
    #13 0x0001008baf64 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*)+0x148 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libmojo_public_cpp_bindings.dylib:arm64+0x2af64)
    #14 0x000107415ff8 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification)+0x3e8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libipc.dylib:arm64+0x39ff8)
    #15 0x000107418070 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*)+0x1b8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libipc.dylib:arm64+0x3c070)
    #16 0x000102bbd694 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x360 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x201694)
    #17 0x000102c34c5c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x8f8 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x278c5c)
    #18 0x000102c33fac in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x277fac)
    #19 0x000102a5e438 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+0x224 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0xa2438)
    #20 0x000102c35fdc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x338 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x279fdc)
    #21 0x000102b28ce4 in base::RunLoop::Run(base::Location const&)+0x430 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libbase.dylib:arm64+0x16cce4)
    #22 0x00013d4bd0cc in content::RendererMain(content::MainFunctionParams)+0x8ac (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3c250cc)
    #23 0x00013d7009f8 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*)+0x42c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e689f8)
    #24 0x00013d702b64 in content::ContentMainRunnerImpl::Run()+0x53c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e6ab64)
    #25 0x00013d6fe4c0 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x854 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e664c0)
    #26 0x00013d6fe9b0 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libcontent.dylib:arm64+0x3e669b0)
    #27 0x000118f3b898 in ChromeMain+0x494 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libchrome_dll.dylib:arm64+0xb898)
    #28 0x0001001ccb90 in main+0x250 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7796.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer):arm64+0x100000b90)
    #29 0x000189903da0 in start+0x1b4c (/usr/lib/dyld:arm64e+0x1fda0)

SUMMARY: AddressSanitizer: heap-use-after-free (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1dca7a4) in blink::(anonymous namespace)::OpenCursorCallback::Invoke(blink::ExecutionContext*, blink::Event*)+0x12cc
Shadow bytes around the buggy address:
  0x61100008a700: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x61100008a780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x61100008a800: fd fd fd fd fd fd fd fd fa fa fa fa fa fa f7 fa
  0x61100008a880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x61100008a900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x61100008a980: fa fa fa fa fa fa f7 fa[fd]fd fd fd fd fd fd fd
  0x61100008aa00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x61100008aa80: fd fd fd fd fa fa fa fa fa fa fa fa fa fa f7 fa
  0x61100008ab00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x61100008ab80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x61100008ac00: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==69446==ADDITIONAL INFO

==69446==Note: Please include this section with the ASan report.
Task trace:
    #0 0x00017193a974 in blink::IDBCursor::CachedContinue(blink::IDBRequest*)+0x310 (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libblink_modules.dylib:arm64+0x1d06974)
    #1 0x0001009cb4a8 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int)+0x22c (/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/libmojo_public_system_cpp.dylib:arm64+0x1b4a8)

Command line: `/Users/zh1x1an1221/xcode-chromium/src/out/asan-0416/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/149.0.7796.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer) --type=renderer --user-data-dir=/tmp/userdata/t1aa32aaaaaa --enable-isolated-web-apps-in-renderer --no-sandbox --enable-experimental-web-platform-features --enable-unsafe-webgpu --remote-debugging-port=9239 --js-flags=--stress-incremental-marking --expose-gc --enable-gpu-benchmarking --enable-blink-features=MojoJS,MojoJSTest --lang=zh-CN --touch-selection-strategy=direction --num-raster-threads=4 --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1775847678698958 --launch-time-ticks=585242732315 --shared-files --metrics-shmem-handle=1752395122,r,13630321469341624404,17251760233756597070,2097152 --field-trial-handle=1718379636,r,9171407457661891635,2055795407484892959,262144 --variations-seed-version --pseudonymization-salt-handle=1935764596,r,3348106321432600058,15529697183007150337,4 --trace-process-track-uuid=3190708998493415531`

MiraclePtr Status: MANUAL ANALYSIS REQUIRED
A pointer to the same region was extracted from a raw_ptr<T> object prior to this crash.
To determine the protection status, enable extraction warnings and check whether the raw_ptr<T> object can be destroyed or overwritten between the extraction and use.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==69446==END OF ADDITIONAL INFO

==69446==ABORTING

Additional Data

Category: Security
Chrome Channel: Not sure
Regression: N/A \

View on issue tracker
Links in the report
On This Page