CVE-2026-5286

High chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

High

Severity

—

CVSS

Exploited ITW

Fixed

Fix Status

ImpactUse after free in Dawn

DescriptionUse after free in Dawn

ComponentDawn

Bug ClassUAF

Tracker493900619

Fix commit6742999c0f40 (dawn) +90/-110

CISA KEVNot listed

Creditedsweetchip

Disclosed2026-03-31

Changed Functions

Function	Change	Notes
`if` src/dawn/native/AsyncTask.cpp	modified
`for` src/dawn/native/AsyncTask.cpp	modified

Files Changed

src/dawn/native/AsyncTask.cpp

Patch

view commit

From 6742999c0f402758e439277ac9d6787acd14d022 Mon Sep 17 00:00:00 2001
From: Lokbondo Kung <lokokung@google.com>
Date: Wed, 25 Mar 2026 15:47:12 -0700
Subject: [PATCH] [dawn][native] Updates AsyncTasks to remove need of WaitableEvent.

- Previously, the WaitableEvent and how it was being handled caused a
  UAF as per the bug below. This change simplifies the logic in the
  AsyncTasks to remove the WaitableEvent entirely, and get rid of the
  need of the intermediate WaitableTask struct that we used to pair
  the AsyncTask to it's manager. Since we know that the task's
  manager must be the one that created it, we can track that
  information at construction and use it directly later on.
- This change also updates the AsyncTask to use MutexCondVarProtected
  for synchronization.

Bug: 493900619
Change-Id: I45da53638727ac86d60e9ffd317ad342fced3174
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/299315
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Commit-Queue: Loko Kung <lokokung@google.com>
---

diff --git a/src/dawn/native/AsyncTask.cpp b/src/dawn/native/AsyncTask.cpp
index 177dceb..272b33e 100644
--- a/src/dawn/native/AsyncTask.cpp
+++ b/src/dawn/native/AsyncTask.cpp
@@ -33,62 +33,72 @@
 
 namespace dawn::native {
 
-AsyncTask::AsyncTask(std::function<void()> task) : mTask(task) {}
+AsyncTask::State::State(AsyncTaskFunction task) : task(task) {
+    DAWN_ASSERT(task);
+}
+
+AsyncTask::AsyncTask(AsyncTaskManager* taskManager, AsyncTaskFunction task)
+    : mTaskManager(taskManager), mState(task) {
+    DAWN_ASSERT(mTaskManager);
+}
+
+bool AsyncTask::IsCompleted() const {
+    return mState.Use([](auto state) { return state->state == AsyncTaskState::Completed; });
+}
 
 void AsyncTask::Wait() {
-    std::unique_ptr<dawn::platform::WaitableEvent> waitableEvent;
-    {
-        std::scoped_lock<std::mutex> lock(mMutex);
-        waitableEvent = std::move(mWaitableEvent);
-    }
-
-    if (waitableEvent) {
-        waitableEvent->Wait();
-    }
+    mState.Use<NotifyType::None>([](auto state) {
+        state.Wait([](auto& x) { return x.state == AsyncTaskState::Completed; });
+    });
 }
 
 void AsyncTask::AddCompletionCallback(AsyncTaskCompletionCallback completionCallback) {
-    std::scoped_lock<std::mutex> lock(mMutex);
+    bool completeCallbackNow = false;
+    mState.Use<NotifyType::None>([&](auto state) {
+        if (state->state == AsyncTaskState::Completed) {
+            completeCallbackNow = true;
+            return;
+        }
+        state->completionCallbacks.push_back(completionCallback);
+    });
 
-    // If this task has already completed, call the completion callback immediately.
-    if (mState == AsyncTaskState::Completed) {
+    // Call callbacks without holding the lock if the task was already complete.
+    if (completeCallbackNow) {
         completionCallback();
-        return;
     }
-
-    mCompletionCallbacks.push_back(completionCallback);
 }
 
 void AsyncTask::Run() {
-    {
-        AsyncTaskState prevState = mState.exchange(AsyncTaskState::Running);
-        DAWN_ASSERT(prevState == AsyncTaskState::Pending);
-    }
+    // To ensure we only run the task once, we synchronize it with the lock, move it out when it
+    // exists, and call it without holding the lock.
+    AsyncTaskFunction task = nullptr;
+    mState.Use<NotifyType::None>([&task](auto state) {
+        task = std::move(state->task);
+        state->task = nullptr;
+    });
+    DAWN_ASSERT(task);
+    task();
 
-    mTask();
-
-    // AsyncTask may have a much longer life time than the task itself.
-    // Reset it to release any references that were captured.
-    mTask = nullptr;
-
-    // Grab the completion callbacks while locked but call them outside the lock.
+    // Update the state, notify all waiting threads, and grab the completion callbacks to call them
+    // outside the lock scope.
     std::vector<AsyncTaskCompletionCallback> completionCallbacks;
-    {
-        std::scoped_lock<std::mutex> lock(mMutex);
-        AsyncTaskState prevState = mState.exchange(AsyncTaskState::Completed);
-        DAWN_ASSERT(prevState == AsyncTaskState::Running);
-        completionCallbacks = std::move(mCompletionCallbacks);
-        mCompletionCallbacks.clear();
-        mWaitableEvent = nullptr;
-    }
+    mState.Use<NotifyType::All>([&completionCallbacks](auto state) {
+        state->state = AsyncTaskState::Completed;
 
+        completionCallbacks = std::move(state->completionCallbacks);
+        state->completionCallbacks.clear();
+    });
     for (auto completionCallback : completionCallbacks) {
         completionCallback();
     }
+
+    // Update the state of the task manager.
+    mTaskManager->mTasks.Use([this](auto tasks) { tasks->erase(this); });
 }
 
-ErrorGeneratingAsyncTask::ErrorGeneratingAsyncTask(std::function<MaybeError()> task)
-    : AsyncTask([this, task] {
+ErrorGeneratingAsyncTask::ErrorGeneratingAsyncTask(AsyncTaskManager* taskManager,
+                                                   std::function<MaybeError()> task)
+    : AsyncTask(taskManager, [this, task] {
           // Wrap the task which returns a MaybeError in a void function and store the error in a
           // member.
           MaybeError taskResult = task();
@@ -98,12 +108,12 @@
       }) {}
 
 bool ErrorGeneratingAsyncTask::IsSuccess() const {
-    DAWN_ASSERT(GetState() == AsyncTaskState::Completed);
+    DAWN_ASSERT(IsCompleted());
     return mErrorData == nullptr;
 }
 
 bool ErrorGeneratingAsyncTask::IsError() const {
-    DAWN_ASSERT(GetState() == AsyncTaskState::Completed);
+    DAWN_ASSERT(IsCompleted());
     return mErrorData != nullptr;
 }
 
@@ -112,7 +122,7 @@
 }
 
 std::unique_ptr<ErrorData> ErrorGeneratingAsyncTask::AcquireError() {
-    DAWN_ASSERT(GetState() == AsyncTaskState::Completed);
+    DAWN_ASSERT(IsCompleted());
     return std::move(mErrorData);
 }
 
@@ -125,56 +135,31 @@
 }
 
 void AsyncTaskManager::PostConstructedTask(Ref<AsyncTask> asyncTask) {
-    // We insert new waitableTask objects into mPendingTasks in main thread (PostTask()),
-    // and we may remove waitableTask objects from mPendingTasks in either main thread
-    // (WaitAllPendingTasks()) or sub-thread (TaskCompleted), so mPendingTasks should be
-    // protected by a mutex.
-    // Hold the mutex until the task is fully posted otherwise it could complete and be deleted
-    // from mPending tasks before it is fully initialized.
-    mPendingTasks.Use(
-        [&asyncTask, taskManager = this, taskPool = mWorkerTaskPool](auto pendingTasks) {
-            // If these allocations becomes expensive, we can slab-allocate tasks.
-            auto iter = pendingTasks->emplace(std::make_unique<WaitableTask>());
-
-            // Should never be inserting the same value twice.
-            DAWN_ASSERT(iter.second);
-
-            WaitableTask* waitableTask = iter.first->get();
-            waitableTask->taskManager = taskManager;
-            waitableTask->asyncTask = asyncTask;
-
-            // Hold the task's mutex while writing to mWaitableEvent. The task could run and try to
-            // modify the waitable event while this write is happening.
-            std::scoped_lock<std::mutex> lock(asyncTask->mMutex);
-            asyncTask->mWaitableEvent = taskPool->PostWorkerTask(RunTask, waitableTask);
-        });
-}
-
-void AsyncTaskManager::HandleTaskCompletion(WaitableTask* task) {
-    DAWN_ASSERT(task);
-    DAWN_ASSERT(task->asyncTask->GetState() == AsyncTaskState::Completed);
-
-    mPendingTasks.Use([&task](auto pendingTasks) { return pendingTasks->erase(task); });
+    // Insert the new task and send it off to the workpool to have it completed.
+    mTasks.Use([&asyncTask](auto tasks) { tasks->emplace(asyncTask); });
+    mWorkerTaskPool->PostWorkerTask(RunTask, asyncTask.Get());
 }
 
 void AsyncTaskManager::WaitAllPendingTasks() {

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/src/dawn/tests/unittests/AsyncTaskTests.cpp b/src/dawn/tests/unittests/AsyncTaskTests.cpp
index a19803a..d0dc43d 100644
--- a/src/dawn/tests/unittests/AsyncTaskTests.cpp
+++ b/src/dawn/tests/unittests/AsyncTaskTests.cpp
@@ -118,12 +118,12 @@
     auto task = taskManager.PostTask<AsyncTask>(
         [&mutex]() { std::scoped_lock<std::mutex> taskLock(mutex); });
 
-    ASSERT_NE(task->GetState(), AsyncTaskState::Completed);
+    ASSERT_FALSE(task->IsCompleted());
 
     // Allow the task to complete
     lock.unlock();
     task->Wait();
-    ASSERT_EQ(task->GetState(), AsyncTaskState::Completed);
+    ASSERT_TRUE(task->IsCompleted());
 }
 
 // Test coverage of the completion callbacks for tasks

Loading diff…

Original Bug Report

reported by sw...@gmail.com

Dawn: Heap Use-After-Free in AsyncTaskManager::RunTask via premature WaitableEvent nullification

Report description

Dawn: Heap Use-After-Free in AsyncTaskManager::RunTask via premature WaitableEvent nullification

Bug location

Where do you want to report your vulnerability?

Chrome VRP – Report security issues affecting the Chrome browser. See program rules

The problem

Please describe the technical details of the vulnerability

Summary

A race condition in src/dawn/native/AsyncTask.cpp causes a heap-use-after-free in the GPU process. AsyncTask::Run() sets mWaitableEvent = nullptr before RunTask() finishes, so WaitAllPendingTasks() frees the WaitableTask while the worker thread still accesses it. The freed raw_ptr<AsyncTaskManager> taskManager at offset 8 becomes a dangling this pointer for HandleTaskCompletion(), which can be exploited to hijack control flow in the GPU process if the 16-byte slot is reclaimed.

Tested on: Chromium 147.0.7727.0 (Dawn 85424799f6)
Still alive on remote HEAD: Dawn 4a3266331c (2026-03-19) — vulnerable code unchanged at AsyncTask.cpp

Root Cause

src/dawn/native/AsyncTask.cpp:

void AsyncTask::Run() {
    {
        AsyncTaskState prevState = mState.exchange(AsyncTaskState::Running);
        DAWN_ASSERT(prevState == AsyncTaskState::Pending);
    }

    mTask();
    mTask = nullptr;

    std::vector<AsyncTaskCompletionCallback> completionCallbacks;
    {
        std::scoped_lock<std::mutex> lock(mMutex);
        AsyncTaskState prevState = mState.exchange(AsyncTaskState::Completed);
        DAWN_ASSERT(prevState == AsyncTaskState::Running);
        completionCallbacks = std::move(mCompletionCallbacks);
        mCompletionCallbacks.clear();
        mWaitableEvent = nullptr;                   // ← BUG: premature nullification
    }

    for (auto completionCallback : completionCallbacks) {
        completionCallback();
    }
}

void AsyncTaskManager::RunTask(void* task) {
    WaitableTask* waitableTask = static_cast<WaitableTask*>(task);
    waitableTask->asyncTask->Run();                  // Run() nullifies mWaitableEvent
    waitableTask->taskManager->HandleTaskCompletion(waitableTask);  // ← UAF here
}

void AsyncTask::Wait() {
    std::unique_ptr<dawn::platform::WaitableEvent> waitableEvent;
    {
        std::scoped_lock<std::mutex> lock(mMutex);
        waitableEvent = std::move(mWaitableEvent);   // nullptr after Run() → no wait
    }

    if (waitableEvent) {
        waitableEvent->Wait();
    }
    // Returns immediately when mWaitableEvent is nullptr
}

void AsyncTaskManager::WaitAllPendingTasks() {
    PendingTasksSet allPendingTasks;
    mPendingTasks.Use(
        [&allPendingTasks](auto pendingTasks) { allPendingTasks.swap(*pendingTasks); });

    for (auto& task : allPendingTasks) {
        task->asyncTask->Wait();                     // Returns early
    }
    // allPendingTasks destroyed → unique_ptr<WaitableTask> freed
    // while worker thread still holds raw pointer in RunTask()
}

Reproduction Steps

Environment

Hardware: Apple MacBook Pro, M4 Pro chip, 48GB RAM
OS: macOS
Build: ASAN Chromium (arm64)
Backend: Metal (default on macOS)
Important: The PoC relies on requestAnimationFrame driving the event loop at full frame rate. Page rendering must be active and smooth in GUI (non-headless) mode for the race to trigger. The bug exists in platform-independent code (AsyncTask.cpp) and is theoretically triggerable on all backends, but this PoC has only been confirmed on macOS Metal due to its specific thread scheduling characteristics.

Steps

# 1. Serve PoC
python3 -m http.server 8080 &

# 2. Option A - Run ASAN Chromium
ASAN_OPTIONS="detect_leaks=0:halt_on_error=1:abort_on_error=1:detect_odr_violation=0:print_stacktrace=1" \
/path/to/Chromium.app/Contents/MacOS/Chromium \
  --disable-gpu-sandbox \
  --no-sandbox \
  --no-first-run \
  --noerrdialogs \
  --disable-crashpad \
  --user-data-dir=/tmp/dawn-race-$$ \
  http://127.0.0.1:8080/poc_v7_throughput.html

# 2. Option B - Run ASAN Chromium
ASAN_OPTIONS="detect_leaks=0:halt_on_error=1:abort_on_error=1:detect_odr_violation=0:print_stacktrace=1" \
/path/to/Chromium.app/Contents/MacOS/Chromium \
  --disable-gpu-sandbox \
  --no-sandbox \
  --no-first-run \
  --noerrdialogs \
  --disable-crashpad \
  --user-data-dir=/tmp/dawn-race-$$ \
  http://127.0.0.1:8080/poc_v5_reliable.html

The ASAN crash typically occurs between 6 seconds and 1 minute after the page loads. If no crash occurs within 90 seconds, terminate Chromium and restart with a fresh --user-data-dir (e.g. /tmp/dawn-race-$$ with a new PID). Reliability: 3/5 crashes at 90s timeout across repeated test runs.

Expected ASAN output

AGX: exceeded compiled variants footprint limit
[72172:1275402:0319/005211.912691:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
[72172:1275402:0319/005236.091116:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
=================================================================
==72180==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020005cad58 at pc 0x00034b11a490 bp 0x0001751aa870 sp 0x0001751aa868
READ of size 8 at 0x6020005cad58 thread T19
==72180==WARNING: invalid path to external symbolizer!
==72180==WARNING: Failed to use and restart external symbolizer!
    #0 0x00034b11a48c in dawn::native::AsyncTaskManager::RunTask(void*)+0xb0 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x122248c)
    #1 0x0003625f1b40 in gpu::webgpu::(anonymous namespace)::AsyncWorkerTaskPool::RunWorkerTask(void (*)(void*), void*, gl::ProgressReporter*, scoped_refptr<gpu::webgpu::(anonymous namespace)::AsyncWaitableEventImpl>)+0x140 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x186f9b40)
    #2 0x0003625f22f0 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(void (*)(void*), void*, gl::ProgressReporter*, scoped_refptr<gpu::webgpu::(anonymous namespace)::AsyncWaitableEventImpl>), void (*&&)(void*), void*&&, base::raw_ptr<gl::ProgressReporter, (partition_alloc::internal::RawPtrTraits)0>&&, scoped_refptr<gpu::webgpu::(anonymous namespace)::AsyncWaitableEventImpl>&&>, base::internal::BindState<false, true, false, void (*)(void (*)(void*), void*, gl::ProgressReporter*, scoped_refptr<gpu::webgpu::(anonymous namespace)::AsyncWaitableEventImpl>), base::internal::UnretainedWrapper<void (void*), base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<void, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<gl::ProgressReporter, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, scoped_refptr<gpu::webgpu::(anonymous namespace)::AsyncWaitableEventImpl>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x22c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x186fa2f0)
    #3 0x00035c402a34 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1250aa34)
    #4 0x00035c48ad04 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0x1f0 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12592d04)
    #5 0x00035c48af50 in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)+0xec (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12592f50)
    #6 0x00035c48988c in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType)+0x3fc (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1259188c)
    #7 0x00035c488c54 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource)+0x548 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12590c54)
    #8 0x00035c4c53a0 in base::internal::WorkerThread::RunWorker()+0x834 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cd3a0)
    #9 0x00035c4c4858 in base::internal::WorkerThread::RunPooledWorker()+0xac (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cc858)
    #10 0x00035c4c4210 in base::internal::WorkerThread::ThreadMain()+0x1e0 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cc210)
    #11 0x00035c53835c in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1264035c)
    #12 0x000102a7d870 in __sanitizer_weak_hook_memcmp+0x36750 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Helpers/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x51870)
    #13 0x00018251fc04 in _pthread_start+0x84 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x6c04)
    #14 0x00018251aba4 in thread_start+0x4 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x1ba4)

0x6020005cad58 is located 8 bytes inside of 16-byte region [0x6020005cad50,0x6020005cad60)
freed by thread T0 here:
    #0 0x000102a81074 in __asan_memmove+0x308c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Helpers/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x55074)
    #1 0x000349f998f8 in absl::container_internal::IterateOverFullSlots(absl::container_internal::CommonFields const&, unsigned long, absl::FunctionRef<void (absl::container_internal::ctrl_t const*, void*)>)+0x190 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0xa18f8)
    #2 0x00034b11ccbc in absl::container_internal::raw_hash_set<absl::container_internal::FlatHashSetPolicy<std::__Cr::unique_ptr<dawn::native::AsyncTaskManager::WaitableTask, std::__Cr::default_delete<dawn::native::AsyncTaskManager::WaitableTask>>>>::destructor_impl()+0x208 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1224cbc)
    #3 0x00034b119494 in dawn::native::AsyncTaskManager::WaitAllPendingTasks()+0x168 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1221494)
    #4 0x00034b1e72a4 in dawn::native::DeviceBase::Destroy(dawn::native::DestroyReason)+0x22c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12ef2a4)
    #5 0x00034b0bd59c in dawn::native::NativeDeviceDestroy(WGPUDeviceImpl*)+0xc8 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x11c559c)
    #6 0x0003626b7358 in dawn::wire::server::Server::DoDeviceDestroy(WGPUDeviceImpl*)+0x40 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x187bf358)
    #7 0x0003626d6cc8 in dawn::wire::server::Server::HandleCommands(char const volatile*, unsigned long)+0x209c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x187decc8)
    #8 0x00036270a728 in gpu::webgpu::(anonymous namespace)::DawnWireServer::HandleCommands(char const volatile*, unsigned long)+0x154 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x18812728)
    #9 0x00036270ab2c in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::HandleDawnCommands(unsigned int, void const volatile*)+0x2e8 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x18812b2c)
    #10 0x000362700ac8 in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::DoCommands(unsigned int, void const volatile*, int, int*)+0x200 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x18808ac8)
    #11 0x000351d8af30 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*)+0x4bc (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7e92f30)
    #12 0x000362616764 in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&)+0x450 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1871e764)
    #13 0x0003626158e4 in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*)+0x468 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1871d8e4)
    #14 0x0003626341ec in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*)+0x290 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1873c1ec)
    #15 0x00036263fe8c in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&)+0x144 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x18747e8c)
    #16 0x00036263fca4 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*)+0x118 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x18747ca4)
    #17 0x000351dc3d80 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>)+0x1c8 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7ecbd80)
    #18 0x000351d9e860 in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>)+0x634 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7ea6860)
    #19 0x000351d9cef8 in gpu::Scheduler::RunNextTask()+0x27c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7ea4ef8)
    #20 0x000351da0294 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(), gpu::Scheduler*>, base::internal::BindState<true, true, false, void (gpu::Scheduler::*)(), base::internal::UnretainedWrapper<gpu::Scheduler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x184 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7ea8294)
    #21 0x00035c402a34 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1250aa34)
    #22 0x00035c46a9e8 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x88c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125729e8)
    #23 0x00035c469da0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12571da0)
    #24 0x00035c58b61c in base::MessagePumpCFRunLoopBase::RunWork()+0x1c8 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1269361c)
    #25 0x00035c57cc9c in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12684c9c)
    #26 0x00035c589a48 in base::MessagePumpCFRunLoopBase::RunWorkSource(void*)+0xe4 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12691a48)
    #27 0x0001825bea04 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__+0x18 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5fa04)
    #28 0x0001825be998 in __CFRunLoopDoSource0+0xa8 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5f998)
    #29 0x0001825be704 in __CFRunLoopDoSources0+0xe4 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5f704)

previously allocated by thread T0 here:
    #0 0x000102a80f84 in __asan_memmove+0x2f9c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Helpers/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x54f84)
    #1 0x0003729e04dc in operator new(unsigned long)+0x18 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x28ae84dc)
    #2 0x00034b1199f8 in dawn::native::AsyncTaskManager::PostConstructedTask(dawn::Ref<dawn::native::AsyncTask>)+0x100 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12219f8)
    #3 0x00034b1de844 in dawn::Ref<dawn::native::AsyncTask> dawn::native::AsyncTaskManager::PostTask<dawn::native::AsyncTask, dawn::native::CreatePipelineAsyncEvent<dawn::native::ComputePipelineBase, WGPUCreateComputePipelineAsyncCallbackInfo>::InitializeAsync()::'lambda'()>(dawn::native::CreatePipelineAsyncEvent<dawn::native::ComputePipelineBase, WGPUCreateComputePipelineAsyncCallbackInfo>::InitializeAsync()::'lambda'()&&)+0x178 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12e6844)
    #4 0x00034b1de600 in dawn::native::CreatePipelineAsyncEvent<dawn::native::ComputePipelineBase, WGPUCreateComputePipelineAsyncCallbackInfo>::InitializeAsync()+0x1fc (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12e6600)
    #5 0x00034b1f20c0 in dawn::native::DeviceBase::APICreateComputePipelineAsync(dawn::native::ComputePipelineDescriptor const*, WGPUCreateComputePipelineAsyncCallbackInfo const&)+0x7c0 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12fa0c0)
    #6 0x00034b0bc5b0 in dawn::native::NativeDeviceCreateComputePipelineAsync(WGPUDeviceImpl*, WGPUComputePipelineDescriptor const*, WGPUCreateComputePipelineAsyncCallbackInfo)+0xe0 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x11c45b0)
    #7 0x0003626c37dc in dawn::wire::server::Server::DoDeviceCreateComputePipelineAsync(dawn::wire::server::Known<WGPUDeviceImpl*>, dawn::wire::ObjectHandle, WGPUFuture, dawn::wire::ObjectHandle, WGPUComputePipelineDescriptor const*)+0x2a8 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x187cb7dc)
    #8 0x0003626cf204 in dawn::wire::server::Server::HandleDeviceCreateComputePipelineAsync(dawn::wire::DeserializeBuffer*)+0x238 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x187d7204)
    #9 0x0003626d5434 in dawn::wire::server::Server::HandleCommands(char const volatile*, unsigned long)+0x808 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x187dd434)
    #10 0x00036270a728 in gpu::webgpu::(anonymous namespace)::DawnWireServer::HandleCommands(char const volatile*, unsigned long)+0x154 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x18812728)
    #11 0x00036270ab2c in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::HandleDawnCommands(unsigned int, void const volatile*)+0x2e8 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x18812b2c)
    #12 0x000362700ac8 in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::DoCommands(unsigned int, void const volatile*, int, int*)+0x200 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x18808ac8)
    #13 0x000351d8af30 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*)+0x4bc (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7e92f30)
    #14 0x000362616764 in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&)+0x450 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1871e764)
    #15 0x0003626158e4 in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*)+0x468 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1871d8e4)
    #16 0x0003626341ec in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*)+0x290 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1873c1ec)
    #17 0x00036263fe8c in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&)+0x144 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x18747e8c)
    #18 0x00036263fca4 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*)+0x118 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x18747ca4)
    #19 0x000351dc3d80 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>)+0x1c8 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7ecbd80)
    #20 0x000351d9e860 in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>)+0x634 (/Users/sweetchip/Deskto
                                                                                                                                                     p/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7ea6860)
    #21 0x000351d9cef8 in gpu::Scheduler::RunNextTask()+0x27c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7ea4ef8)
    #22 0x000351da0294 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(), gpu::Scheduler*>, base::internal::BindState<true, true, false, void (gpu::Scheduler::*)(), base::internal::UnretainedWrapper<gpu::Scheduler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x184 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7ea8294)
    #23 0x00035c402a34 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1250aa34)
    #24 0x00035c46a9e8 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x88c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125729e8)
    #25 0x00035c469da0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12571da0)
    #26 0x00035c58b61c in base::MessagePumpCFRunLoopBase::RunWork()+0x1c8 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1269361c)
    #27 0x00035c57cc9c in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12684c9c)
    #28 0x00035c589a48 in base::MessagePumpCFRunLoopBase::RunWorkSource(void*)+0xe4 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12691a48)
    #29 0x0001825bea04 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__+0x18 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5fa04)

Thread T19 created by T13 here:
    #0 0x000102a7795c in __sanitizer_weak_hook_memcmp+0x3083c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Helpers/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4b95c)
    #1 0x00035c5378fc in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType)+0x26c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1263f8fc)
    #2 0x00035c4c31d8 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*)+0x27c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cb1d8)
    #3 0x00035c490488 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush()+0x244 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12598488)
    #4 0x00035c4901e4 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor()+0x44 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125981e4)
    #5 0x00035c49808c in base::internal::ThreadGroupImpl::WorkerDelegate::GetWork(base::internal::WorkerThread*)+0x2c4 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125a008c)
    #6 0x00035c4c5264 in base::internal::WorkerThread::RunWorker()+0x6f8 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cd264)
    #7 0x00035c4c4858 in base::internal::WorkerThread::RunPooledWorker()+0xac (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cc858)
    #8 0x00035c4c4210 in base::internal::WorkerThread::ThreadMain()+0x1e0 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cc210)
    #9 0x00035c53835c in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1264035c)
    #10 0x000102a7d870 in __sanitizer_weak_hook_memcmp+0x36750 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Helpers/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x51870)
    #11 0x00018251fc04 in _pthread_start+0x84 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x6c04)
    #12 0x00018251aba4 in thread_start+0x4 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x1ba4)

Thread T13 created by T8 here:
    #0 0x000102a7795c in __sanitizer_weak_hook_memcmp+0x3083c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Helpers/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4b95c)
    #1 0x00035c5378fc in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType)+0x26c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1263f8fc)
    #2 0x00035c4c31d8 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*)+0x27c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cb1d8)
    #3 0x00035c490488 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush()+0x244 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12598488)
    #4 0x00035c4901e4 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor()+0x44 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125981e4)
    #5 0x00035c49808c in base::internal::ThreadGroupImpl::WorkerDelegate::GetWork(base::internal::WorkerThread*)+0x2c4 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125a008c)
    #6 0x00035c4c5264 in base::internal::WorkerThread::RunWorker()+0x6f8 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cd264)
    #7 0x00035c4c4858 in base::internal::WorkerThread::RunPooledWorker()+0xac (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cc858)
    #8 0x00035c4c4210 in base::internal::WorkerThread::ThreadMain()+0x1e0 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cc210)
    #9 0x00035c53835c in base::(anonymous namespace)::ThreadFunc(void*)+0x154 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1264035c)
    #10 0x000102a7d870 in __sanitizer_weak_hook_memcmp+0x36750 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Helpers/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x51870)
    #11 0x00018251fc04 in _pthread_start+0x84 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x6c04)
    #12 0x00018251aba4 in thread_start+0x4 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x1ba4)

Thread T8 created by T0 here:
    #0 0x000102a7795c in __sanitizer_weak_hook_memcmp+0x3083c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Helpers/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x4b95c)
    #1 0x00035c5378fc in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType)+0x26c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1263f8fc)
    #2 0x00035c4c31d8 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*)+0x27c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125cb1d8)
    #3 0x00035c490488 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush()+0x244 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x12598488)
    #4 0x00035c4901e4 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor()+0x44 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125981e4)
    #5 0x00035c4963a4 in base::internal::ThreadGroupImpl::Start(unsigned long, unsigned long, base::TimeDelta, scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*, base::internal::ThreadGroup::WorkerEnvironment, bool, std::__Cr::optional<base::TimeDelta>)+0x3a8 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1259e3a4)
    #6 0x00035c4b7630 in base::internal::ThreadPoolImpl::Start(base::ThreadPoolInstance::InitParams const&, base::WorkerThreadObserver*)+0x107c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125bf630)
    #7 0x00035c4c20f8 in base::ThreadPoolInstance::StartWithDefaultParams()+0x144 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x125ca0f8)
    #8 0x000365b270e8 in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>, bool)+0x338 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1bc2f0e8)
    #9 0x00036575e70c in content::GpuMain(content::MainFunctionParams)+0x710 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x1b86670c)
    #10 0x000358ae4298 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*)+0x420 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0xebec298)
    #11 0x000358ae6418 in content::ContentMainRunnerImpl::Run()+0x53c (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0xebee418)
    #12 0x000358ae1f88 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x858 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0xebe9f88)
    #13 0x000358ae2478 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0xebea478)
    #14 0x000349efdcb4 in ChromeMain+0x490 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x5cb4)
    #15 0x0001026f8c94 in main+0x254 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Helpers/Chromium Helper.app/Contents/MacOS/Chromium Helper:arm64+0x100000c94)
    #16 0x000182155d50 in start+0x1c0c (/usr/lib/dyld:arm64e+0x8d50)

SUMMARY: AddressSanitizer: heap-use-after-free (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x122248c) in dawn::native::AsyncTaskManager::RunTask(void*)+0xb0
Shadow bytes around the buggy address:
  0x6020005caa80: f7 fa fa fa f7 fa fd fa f7 fa fd fa f7 fa fd fd
  0x6020005cab00: f7 fa fd fa f7 fa fd fd f7 fa fd fd f7 fa fd fd
  0x6020005cab80: f7 fa fd fa f7 fa fa fa f7 fa fa fa f7 fa fd fd
  0x6020005cac00: f7 fa fd fa f7 fa fd fd f7 fa fd fd f7 fa fa fa
  0x6020005cac80: f7 fa fd fd f7 fa 00 00 f7 fa fd fd f7 fa fd fd
=>0x6020005cad00: f7 fa fd fd f7 fa fd fa f7 fa fd[fd]f7 fa fa fa
  0x6020005cad80: f7 fa fd fa f7 fa fd fd f7 fa fd fa f7 fa fa fa
  0x6020005cae00: f7 fa fd fd f7 fa 00 00 f7 fa fd fd f7 fa fd fd
  0x6020005cae80: f7 fa fa fa f7 fa fa fa f7 fa fd fa f7 fa fa fa
  0x6020005caf00: f7 fa fd fd f7 fa fd fd f7 fa fd fd f7 fa fd fd
  0x6020005caf80: f7 fa fa fa f7 fa fd fd f7 fa fd fa f7 fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==72180==ADDITIONAL INFO

==72180==Note: Please include this section with the ASan report.
Task trace:
    #0 0x0003625f1260 in gpu::webgpu::(anonymous namespace)::AsyncWorkerTaskPool::PostWorkerTask(void (*)(void*), void*)+0x1e4 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x186f9260)
    #1 0x000351d9d0a0 in gpu::Scheduler::RunNextTask()+0x424 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7ea50a0)
    #2 0x000351d9d0a0 in gpu::Scheduler::RunNextTask()+0x424 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7ea50a0)
    #3 0x000351d9d0a0 in gpu::Scheduler::RunNextTask()+0x424 (/Users/sweetchip/Desktop/bug_finder/browser_artifact/mac-release-arm64_asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7727.0/Chromium Framework:arm64+0x7ea50a0)
......


MiraclePtr Status: MANUAL ANALYSIS REQUIRED
This crash occurred inside a callback where a raw_ptr<T> pointing to the same region was bound to one of the arguments.
The "use" and "free" threads don't match. This crash is likely to have been caused by a race condition that is mislabeled as a use-after-free. Make sure that the "free" is sequenced after the "use" (e.g. both are on the same sequence, or the "free" is in a task posted after the "use"). Otherwise, the crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==72180==END OF ADDITIONAL INFO

==72180==ABORTING
[72172:1275285:0319/005256.254904:ERROR:content/browser/gpu/gpu_process_host.cc:999] GPU process exited unexpectedly: exit_code=256

Impact analysis

Impact

The worker thread reads the freed taskManager pointer (offset 8 of 16-byte WaitableTask) and uses it as this for HandleTaskCompletion(), which acquires a mutex and performs a hash set erase at the attacker-influenced address — enabling potential control flow hijack in the GPU process. MiraclePtr may be ineffective because the use and free occur on different threads.

The cause

What version of Chrome have you found the security issue in?

147.0.7727.0

Yes, it is related to a crash.

Choose the type of vulnerability

Memory Corruption (in a sandboxed process)

How would you like to be publicly acknowledged for your report?

sweetchip

View on issue tracker

Links in the report

References

Vendor advisory Fix commit Bug tracker NVD

On This Page