=================================================================
==74578==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000031a38 at pc 0x00012177e800 bp 0x00016fdfdcf0 sp 0x00016fdfdce8
READ of size 8 at 0x602000031a38 thread T0
==74578==WARNING: invalid path to external symbolizer!
==74578==WARNING: Failed to use and restart external symbolizer!
    #0 0x00012177e7fc in language_detection::LanguageDetectionModel::NotifyModelLoaded()+0x5a4 (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c167fc)
    #1 0x00012177f7f0 in void base::internal::DecayedFunctorTraits<void (language_detection::LanguageDetectionModel::*)(std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::WeakPtr<language_detection::LanguageDetectionModel>&&>::Invoke<void (language_detection::LanguageDetectionModel::*)(std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::WeakPtr<language_detection::LanguageDetectionModel> const&, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>>(void (language_detection::LanguageDetectionModel::*)(std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::WeakPtr<language_detection::LanguageDetectionModel> const&, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>&&)+0x16c (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c177f0)
    #2 0x00012177f5c4 in base::internal::Invoker<base::internal::FunctorTraits<void (language_detection::LanguageDetectionModel::*&&)(std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::WeakPtr<language_detection::LanguageDetectionModel>&&>, base::internal::BindState<true, true, false, void (language_detection::LanguageDetectionModel::*)(std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::WeakPtr<language_detection::LanguageDetectionModel>>, void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>&&)+0x120 (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c175c4)
    #3 0x00012177ff38 in base::internal::ThenHelper<base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>>::CreateTrampoline()::'lambda'(base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)::operator()(base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>) const+0x1d0 (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c17f38)
    #4 0x00012177fb90 in base::internal::Invoker<base::internal::FunctorTraits<base::internal::ThenHelper<base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>>::CreateTrampoline()::'lambda'(base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)&&, base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>&&, base::OnceCallback<void ()>&&>, base::internal::BindState<false, false, false, base::internal::ThenHelper<base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>>::CreateTrampoline()::'lambda'(base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>>, void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>&&)+0x19c (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c17b90)
    #5 0x000121780768 in void base::internal::ReplyAdapter<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>>(base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, std::__Cr::unique_ptr<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>, std::__Cr::default_delete<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>>>*)+0x1b8 (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c18768)
    #6 0x000121780d90 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, std::__Cr::unique_ptr<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>, std::__Cr::default_delete<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>>>*), base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>&&, std::__Cr::unique_ptr<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>, std::__Cr::default_delete<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>>>*>, base::internal::BindState<false, true, false, void (*)(base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, std::__Cr::unique_ptr<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>, std::__Cr::default_delete<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>>>*), base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::internal::OwnedWrapper<std::__Cr::unique_ptr<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>, std::__Cr::default_delete<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>>>, std::__Cr::default_delete<std::__Cr::unique_ptr<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>, std::__Cr::default_delete<std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>>>>>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x12c (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c18d90)
    #7 0x0001024a7cbc in base::internal::PostTaskAndReplyRelay::RunReply(base::internal::PostTaskAndReplyRelay)+0x13c (/Users/lime/Workdir/chromium-audit/src/out/debug/libbase.dylib:arm64+0x23fcbc)
    #8 0x0001024a7a88 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunOnce(base::internal::BindStateBase*)+0x110 (/Users/lime/Workdir/chromium-audit/src/out/debug/libbase.dylib:arm64+0x23fa88)
    #9 0x000102423e6c in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x34c (/Users/lime/Workdir/chromium-audit/src/out/debug/libbase.dylib:arm64+0x1bbe6c)
    #10 0x000102491b38 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x864 (/Users/lime/Workdir/chromium-audit/src/out/debug/libbase.dylib:arm64+0x229b38)
    #11 0x000102490e1c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/lime/Workdir/chromium-audit/src/out/debug/libbase.dylib:arm64+0x228e1c)
    #12 0x0001022f6918 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*)+0x1b0 (/Users/lime/Workdir/chromium-audit/src/out/debug/libbase.dylib:arm64+0x8e918)
    #13 0x000102493094 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x36c (/Users/lime/Workdir/chromium-audit/src/out/debug/libbase.dylib:arm64+0x22b094)
    #14 0x0001023a90ec in base::RunLoop::Run(base::Location const&)+0x434 (/Users/lime/Workdir/chromium-audit/src/out/debug/libbase.dylib:arm64+0x1410ec)
    #15 0x00013a7fa90c in content::RendererMain(content::MainFunctionParams)+0x708 (/Users/lime/Workdir/chromium-audit/src/out/debug/libcontent.dylib:arm64+0x325690c)
    #16 0x00013a9fef3c in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*)+0x3ec (/Users/lime/Workdir/chromium-audit/src/out/debug/libcontent.dylib:arm64+0x345af3c)
    #17 0x00013aa00ca0 in content::ContentMainRunnerImpl::Run()+0x454 (/Users/lime/Workdir/chromium-audit/src/out/debug/libcontent.dylib:arm64+0x345cca0)
    #18 0x00013a9fcc1c in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x5c8 (/Users/lime/Workdir/chromium-audit/src/out/debug/libcontent.dylib:arm64+0x3458c1c)
    #19 0x00013a9fd52c in content::ContentMain(content::ContentMainParams)+0x190 (/Users/lime/Workdir/chromium-audit/src/out/debug/libcontent.dylib:arm64+0x345952c)
    #20 0x000117b73424 in ChromeMain+0x360 (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0xb424)
    #21 0x000100000ce4 in main+0x254 (/Users/lime/Workdir/chromium-audit/src/out/debug/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/132.0.6811.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer):arm64+0x100000ce4)
    #22 0x000187028270  (<unknown module>)

0x602000031a38 is located 8 bytes inside of 16-byte region [0x602000031a30,0x602000031a40)
freed by thread T0 here:
    #0 0x000100b21efc in __sanitizer_finish_switch_fiber+0xa2c (/Users/lime/Workdir/chromium-audit/src/out/debug/libclang_rt.asan_osx_dynamic.dylib:arm64+0x61efc)
    #1 0x000157b6cfa8 in base::OnceCallback<void (language_detection::LanguageDetectionModel&)>* std::__Cr::vector<base::OnceCallback<void (language_detection::LanguageDetectionModel&)>, std::__Cr::allocator<base::OnceCallback<void (language_detection::LanguageDetectionModel&)>>>::__emplace_back_slow_path<base::OnceCallback<void (language_detection::LanguageDetectionModel&)>>(base::OnceCallback<void (language_detection::LanguageDetectionModel&)>&&)+0x18c (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_platform.dylib:arm64+0x21dcfa8)
    #2 0x000157b6c120 in language_detection::LanguageDetectionModel::AddOnModelLoadedCallback(base::OnceCallback<void (language_detection::LanguageDetectionModel&)>)+0x244 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_platform.dylib:arm64+0x21dc120)
    #3 0x000155fab880 in blink::DetectLanguage(WTF::String const&, base::OnceCallback<void (base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>)>)+0x20c (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_platform.dylib:arm64+0x61b880)
    #4 0x000163716f34 in blink::LanguageDetector::detect(blink::ScriptState*, WTF::String const&, blink::ExceptionState&)+0x310 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_modules.dylib:arm64+0x2096f34)
    #5 0x00016215ba9c in blink::(anonymous namespace)::v8_language_detector::DetectOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&)+0x57c (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_modules.dylib:arm64+0xadba9c)
    #6 0x7e8447e0f7d4  (<unknown module>)
    #7 0x7e8447e0d620  (<unknown module>)
    #8 0x7e8447e0b224  (<unknown module>)
    #9 0x7e8447e0ae70  (<unknown module>)
    #10 0x00015af15024 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&)+0x1230 (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x651024)
    #11 0x00015af13d3c in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*)+0x140 (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x64fd3c)
    #12 0x00015b9bd614 in v8::internal::Object::GetPropertyWithAccessor(v8::internal::LookupIterator*)+0x990 (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x10f9614)
    #13 0x00015b9bb530 in v8::internal::Object::GetProperty(v8::internal::LookupIterator*, bool)+0x1cc (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x10f7530)
    #14 0x00015aab18ac in v8::internal::JSReceiver::GetProperty(v8::internal::Isolate*, v8::internal::Handle<v8::internal::JSReceiver>, v8::internal::Handle<v8::internal::Name>)+0x2a8 (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x1ed8ac)
    #15 0x00015b9daee4 in v8::internal::JSPromise::Resolve(v8::internal::Handle<v8::internal::JSPromise>, v8::internal::Handle<v8::internal::Object>)+0x424 (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x1116ee4)
    #16 0x00015ab45030 in v8::Promise::Resolver::Resolve(v8::Local<v8::Context>, v8::Local<v8::Value>)+0x3c4 (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x281030)
    #17 0x00014bbd8fa0 in blink::ScriptPromiseResolverBase::ResolveOrRejectImmediately()+0x6ac (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0xc0fa0)
    #18 0x00014bbd81f8 in blink::ScriptPromiseResolverBase::NotifyResolveOrReject()+0x164 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0xc01f8)
    #19 0x000162a036d4 in void blink::ScriptPromiseResolverBase::ResolveOrReject<blink::IDLSequence<blink::LanguageDetectionResult>, blink::HeapVector<cppgc::internal::BasicMember<blink::LanguageDetectionResult, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 0u>>(blink::HeapVector<cppgc::internal::BasicMember<blink::LanguageDetectionResult, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 0u>)+0x468 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_modules.dylib:arm64+0x13836d4)
    #20 0x000162a00f34 in void blink::ScriptPromiseResolver<blink::IDLSequence<blink::LanguageDetectionResult>>::Resolve<blink::HeapVector<cppgc::internal::BasicMember<blink::LanguageDetectionResult, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 0u>>(blink::HeapVector<cppgc::internal::BasicMember<blink::LanguageDetectionResult, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 0u>)+0x114 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_modules.dylib:arm64+0x1380f34)
    #21 0x000162a00cdc in blink::AILanguageDetector::OnDetectComplete(blink::ScriptPromiseResolver<blink::IDLSequence<blink::LanguageDetectionResult>>*, base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>)+0x1e4 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_modules.dylib:arm64+0x1380cdc)
    #22 0x000162a0120c in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(blink::ScriptPromiseResolver<blink::IDLSequence<blink::LanguageDetectionResult>>*, base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>), cppgc::internal::BasicPersistent<blink::ScriptPromiseResolver<blink::IDLSequence<blink::LanguageDetectionResult>>, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&>, base::internal::BindState<false, true, false, void (*)(blink::ScriptPromiseResolver<blink::IDLSequence<blink::LanguageDetectionResult>>*, base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>), cppgc::internal::BasicPersistent<blink::ScriptPromiseResolver<blink::IDLSequence<blink::LanguageDetectionResult>>, cppgc::internal::StrongPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>>, void (base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>)>::RunOnce(base::internal::BindStateBase*, base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>&&)+0x120 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_modules.dylib:arm64+0x138120c)
    #23 0x000155fabeac in (anonymous namespace)::DetectLanguageWithModel(WTF::String const&, base::OnceCallback<void (base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>)>, language_detection::LanguageDetectionModel&)+0x528 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_platform.dylib:arm64+0x61beac)
    #24 0x000155fac604 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(WTF::String const&, base::OnceCallback<void (base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>)>, language_detection::LanguageDetectionModel&), WTF::String&&, base::OnceCallback<void (base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>)>&&>, base::internal::BindState<false, true, false, void (*)(WTF::String const&, base::OnceCallback<void (base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>)>, language_detection::LanguageDetectionModel&), WTF::String, base::OnceCallback<void (base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>)>>, void (language_detection::LanguageDetectionModel&)>::RunOnce(base::internal::BindStateBase*, language_detection::LanguageDetectionModel&)+0x128 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_platform.dylib:arm64+0x61c604)
    #25 0x00012177e584 in language_detection::LanguageDetectionModel::NotifyModelLoaded()+0x32c (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c16584)
    #26 0x00012177f7f0 in void base::internal::DecayedFunctorTraits<void (language_detection::LanguageDetectionModel::*)(std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::WeakPtr<language_detection::LanguageDetectionModel>&&>::Invoke<void (language_detection::LanguageDetectionModel::*)(std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::WeakPtr<language_detection::LanguageDetectionModel> const&, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>>(void (language_detection::LanguageDetectionModel::*)(std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::WeakPtr<language_detection::LanguageDetectionModel> const&, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>&&)+0x16c (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c177f0)
    #27 0x00012177f5c4 in base::internal::Invoker<base::internal::FunctorTraits<void (language_detection::LanguageDetectionModel::*&&)(std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::WeakPtr<language_detection::LanguageDetectionModel>&&>, base::internal::BindState<true, true, false, void (language_detection::LanguageDetectionModel::*)(std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::WeakPtr<language_detection::LanguageDetectionModel>>, void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>&&)+0x120 (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c175c4)
    #28 0x00012177ff38 in base::internal::ThenHelper<base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>>::CreateTrampoline()::'lambda'(base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)::operator()(base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>) const+0x1d0 (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c17f38)
    #29 0x00012177fb90 in base::internal::Invoker<base::internal::FunctorTraits<base::internal::ThenHelper<base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>>::CreateTrampoline()::'lambda'(base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)&&, base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>&&, base::OnceCallback<void ()>&&>, base::internal::BindState<false, false, false, base::internal::ThenHelper<base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>>::CreateTrampoline()::'lambda'(base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>), base::OnceCallback<void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>, base::OnceCallback<void ()>>, void (std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional<std::__Cr::unique_ptr<tflite::task::text::nlclassifier::NLClassifier, std::__Cr::default_delete<tflite::task::text::nlclassifier::NLClassifier>>>&&)+0x19c (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c17b90)

previously allocated by thread T0 here:
    #0 0x000100b21af4 in __sanitizer_finish_switch_fiber+0x624 (/Users/lime/Workdir/chromium-audit/src/out/debug/libclang_rt.asan_osx_dynamic.dylib:arm64+0x61af4)
    #1 0x000157b6cecc in base::OnceCallback<void (language_detection::LanguageDetectionModel&)>* std::__Cr::vector<base::OnceCallback<void (language_detection::LanguageDetectionModel&)>, std::__Cr::allocator<base::OnceCallback<void (language_detection::LanguageDetectionModel&)>>>::__emplace_back_slow_path<base::OnceCallback<void (language_detection::LanguageDetectionModel&)>>(base::OnceCallback<void (language_detection::LanguageDetectionModel&)>&&)+0xb0 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_platform.dylib:arm64+0x21dcecc)
    #2 0x000157b6c120 in language_detection::LanguageDetectionModel::AddOnModelLoadedCallback(base::OnceCallback<void (language_detection::LanguageDetectionModel&)>)+0x244 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_platform.dylib:arm64+0x21dc120)
    #3 0x000155fab880 in blink::DetectLanguage(WTF::String const&, base::OnceCallback<void (base::expected<WTF::Vector<language_detection::Prediction, 0u, WTF::PartitionAllocator>, blink::DetectLanguageError>)>)+0x20c (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_platform.dylib:arm64+0x61b880)
    #4 0x000163716f34 in blink::LanguageDetector::detect(blink::ScriptState*, WTF::String const&, blink::ExceptionState&)+0x310 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_modules.dylib:arm64+0x2096f34)
    #5 0x00016215ba9c in blink::(anonymous namespace)::v8_language_detector::DetectOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&)+0x57c (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_modules.dylib:arm64+0xadba9c)
    #6 0x7e8447e0f7d4  (<unknown module>)
    #7 0x7e8447e0d620  (<unknown module>)
    #8 0x7e8447f236b4  (<unknown module>)
    #9 0x7e8447e3ca9c  (<unknown module>)
    #10 0x7e8447e0b0f0  (<unknown module>)
    #11 0x00015af14bc0 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&)+0xdcc (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x650bc0)
    #12 0x00015af17764 in v8::internal::(anonymous namespace)::InvokeWithTryCatch(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&)+0x118 (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x653764)
    #13 0x00015af17af0 in v8::internal::Execution::TryRunMicrotasks(v8::internal::Isolate*, v8::internal::MicrotaskQueue*)+0x38 (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x653af0)
    #14 0x00015afa82b4 in v8::internal::MicrotaskQueue::RunMicrotasks(v8::internal::Isolate*)+0x3b4 (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x6e42b4)
    #15 0x00015afa7e58 in v8::internal::MicrotaskQueue::PerformCheckpointInternal(v8::Isolate*)+0x118 (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x6e3e58)
    #16 0x00015ab5f74c in v8::MicrotasksScope::~MicrotasksScope()+0x13c (/Users/lime/Workdir/chromium-audit/src/out/debug/libv8.dylib:arm64+0x29b74c)
    #17 0x00014bc951b4 in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local<v8::Script>, v8::Local<v8::Data>, blink::ExecutionContext*)+0x600 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x17d1b4)
    #18 0x00014bc963c0 in blink::V8ScriptRunner::CompileAndRunScript(blink::ScriptState*, blink::ClassicScript*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption)+0x8d0 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x17e3c0)
    #19 0x00014e860b28 in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption)+0x1a0 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x2d48b28)
    #20 0x00014e8b1b68 in blink::Script::RunScriptOnScriptState(blink::ScriptState*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption)+0x1b4 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x2d99b68)
    #21 0x00014e8b1e78 in blink::Script::RunScript(blink::LocalDOMWindow*, blink::ExecuteScriptPolicy, blink::V8ScriptRunner::RethrowErrorsOption)+0x140 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x2d99e78)
    #22 0x00014e8b103c in blink::PendingScript::ExecuteScriptBlockInternal(blink::Script*, blink::ScriptElementBase*, bool, bool, bool, base::TimeTicks, bool)+0x414 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x2d9903c)
    #23 0x00014e8aff70 in blink::PendingScript::ExecuteScriptBlock()+0x560 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x2d97f70)
    #24 0x00014e8b646c in blink::ScriptLoader::PrepareScript(blink::ScriptLoader::ParserBlockingInlineOption, WTF::TextPosition const&)+0x20e8 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x2d9e46c)
    #25 0x00014e871f04 in blink::HTMLParserScriptRunner::ProcessScriptElementInternal(blink::Element*, WTF::TextPosition const&)+0x410 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x2d59f04)
    #26 0x00014e871838 in blink::HTMLParserScriptRunner::ProcessScriptElement(blink::Element*, WTF::TextPosition const&)+0xac (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x2d59838)
    #27 0x00014f1eb590 in blink::HTMLDocumentParser::RunScriptsForPausedTreeBuilder()+0x1a4 (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x36d3590)
    #28 0x00014f1e7f3c in blink::HTMLDocumentParser::PumpTokenizer()+0x71c (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x36cff3c)
    #29 0x00014f1e66a8 in blink::HTMLDocumentParser::PumpTokenizerIfPossible()+0x34c (/Users/lime/Workdir/chromium-audit/src/out/debug/libblink_core.dylib:arm64+0x36ce6a8)

SUMMARY: AddressSanitizer: heap-use-after-free (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c167fc) in language_detection::LanguageDetectionModel::NotifyModelLoaded()+0x5a4
Shadow bytes around the buggy address:
  0x602000031780: f7 fa fd fd f7 fa fd fa f7 fa fd fd f7 fa fd fd
  0x602000031800: f7 fa fd fd f7 fa fd fd f7 fa fd fd f7 fa fd fd
  0x602000031880: f7 fa fd fa f7 fa fd fa f7 fa 00 00 f7 fa fd fa
  0x602000031900: f7 fa 01 fa f7 fa 00 fa f7 fa fd fa f7 fa fd fa
  0x602000031980: f7 fa fd fa f7 fa fd fa f7 fa fd fa f7 fa fd fa
=>0x602000031a00: f7 fa fd fa f7 fa fd[fd]f7 fa fd fa f7 fa fd fd
  0x602000031a80: f7 fa 00 00 f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa
  0x602000031b00: f7 fa fd fa f7 fa fd fa f7 fa fd fd f7 fa fd fd
  0x602000031b80: f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa
  0x602000031c00: f7 fa 00 fa f7 fa 00 fa f7 fa 00 fa f7 fa 00 00
  0x602000031c80: f7 fa 00 fa f7 fa 00 fa f7 fa fd fa f7 fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==74578==ADDITIONAL INFO

==74578==Note: Please include this section with the ASan report.
Task trace:
    #0 0x00012177d804 in language_detection::LanguageDetectionModel::UpdateWithFileAsync(base::File, base::OnceCallback<void ()>)+0x130 (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c15804)
    #1 0x00012177d804 in language_detection::LanguageDetectionModel::UpdateWithFileAsync(base::File, base::OnceCallback<void ()>)+0x130 (/Users/lime/Workdir/chromium-audit/src/out/debug/libchrome_dll.dylib:arm64+0x9c15804)
    #2 0x0001004b45e4 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int)+0x248 (/Users/lime/Workdir/chromium-audit/src/out/debug/libmojo_public_system_cpp.dylib:arm64+0x185e4)


Command line: `/Users/lime/Workdir/chromium-audit/src/out/debug/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/132.0.6811.0/Helpers/Chromium Helper (Renderer).app/Contents/MacOS/Chromium Helper (Renderer) --type=renderer --string-annotations --lang=zh-CN --num-raster-threads=4 --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1731733666992285 --launch-time-ticks=156623900249 --shared-files --metrics-shmem-handle=1752395122,r,7315363505195099744,18258166829320624368,2097152 --field-trial-handle=1718379636,r,1444061329249182583,12214843644271275164,262144 --enable-features=EnableAISummarizationAPI,LanguageDetectionAPI,PdfXfaSupport,ui-debug-tools --variations-seed-version --seatbelt-client=132`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==74578==END OF ADDITIONAL INFO
==74578==ABORTING
Received signal 6
 [0x0001025b670c]
 [0x000102572634]
 [0x0001025b626c]
 [0x0001873e0184]
 [0x0001873aaf70]
 [0x0001872b7908]
 [0x000100b38140]
 [0x000100b37660]
 [0x000100b1ac88]
 [0x000100b19f40]
 [0x000100b1b468]
 [0x00012177e800]
 [0x00012177f7f4]
 [0x00012177f5c8]
 [0x00012177ff3c]
 [0x00012177fb94]
 [0x00012178076c]
 [0x000121780d94]
 [0x0001024a7cc0]
 [0x0001024a7a8c]
 [0x000102423e70]
 [0x000102491b3c]
 [0x000102490e20]
 [0x0001022f691c]
 [0x000102493098]
 [0x0001023a90f0]
 [0x00013a7fa910]
 [0x00013a9fef40]
 [0x00013aa00ca4]
 [0x00013a9fcc20]
 [0x00013a9fd530]
 [0x000117b73428]
 [0x000100000ce8]
 [0x000187028274]
[end of stack trace]