================================================================= ==1472==ERROR: AddressSanitizer: heap-use-after-free on address 0x11fe92769910 at pc 0x7ffd6dc08248 bp 0x003a3b5fe960 sp 0x003a3b5fe9a8 READ of size 8 at 0x11fe92769910 thread T4 #0 0x7ffd6dc08247 in cc::GpuImageDecodeCache::DecodeImageIfNecessary C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2469 #1 0x7ffd6dbf699b in cc::GpuImageDecodeCache::DecodeImageAndGenerateDarkModeFilterIfNecessary C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2351 #2 0x7ffd6dc000e9 in cc::GpuImageDecodeCache::DecodeImageInTask C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1939 #3 0x7ffd6dc17e1c in cc::GpuImageDecodeTaskImpl::RunOnWorkerThread C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:616 #4 0x7ffd76f7bc26 in cc::ImageController::ProcessNextImageDecodeOnWorkerThread C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:309 #5 0x7ffd76f7d517 in base::internal::Invoker,base::internal::BindState<0,1,0,void (*)(cc::ImageController::WorkerState *),base::internal::UnretainedWrapper >,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:980 #6 0x7ffd682757a0 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:203 #7 0x7ffd713ecb2a in base::internal::TaskTracker::RunContinueOnShutdown C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:655 #8 0x7ffd713ec169 in base::internal::TaskTracker::RunTask C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:521 #9 0x7ffd713eb23e in base::internal::TaskTracker::RunAndPopNextTask C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\task_tracker.cc:416 #10 0x7ffd76730c24 in base::internal::WorkerThread::RunWorker C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:493 #11 0x7ffd7672fa2f in base::internal::WorkerThread::RunPooledWorker C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:379 #12 0x7ffd6819ce45 in base::`anonymous namespace'::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:131 #13 0x7ff73039533d in asan_thread_start C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:147 #14 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #15 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27) 0x11fe92769910 is located 656 bytes inside of 1232-byte region [0x11fe92769680,0x11fe92769b50) freed by thread T9 here: #0 0x7ff7303a181d in free C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win.cpp:82 #1 0x7ffd6dbf4d93 in cc::GpuImageDecodeCache::UnrefImageInternal C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2151 #2 0x7ffd6dbf4911 in cc::GpuImageDecodeCache::UnrefImage C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1441 #3 0x7ffd76f7ae15 in cc::ImageController::UnlockImageDecode C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:261 #4 0x7ffd723cb24d in std::__Cr::__destroy_at > >,0> C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\construct_at.h:67 #5 0x7ffd723c8d5b in cc::DecodedImageTracker::UnlockAllImages C:\b\s\w\ir\cache\builder\src\cc\tiles\decoded_image_tracker.cc:62 #6 0x7ffd6dc8362c in cc::LayerTreeHostImpl::SetVisible C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host_impl.cc:3822 #7 0x7ffd72306d4b in cc::ProxyImpl::SetVisibleOnImpl C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:274 #8 0x7ffd6dc3ea88 in base::internal::Invoker,base::internal::BindState<1,1,0,void (cc::ProxyImpl::*)(bool),base::internal::UnretainedWrapper,bool>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:980 #9 0x7ffd682757a0 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:203 #10 0x7ffd6c9bedcd in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:470 #11 0x7ffd6c9bdb79 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:332 #12 0x7ffd6ca025ce in base::MessagePumpDefault::Run C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:40 #13 0x7ffd6c9c0a9f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:640 #14 0x7ffd682cf96e in base::RunLoop::Run C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134 #15 0x7ffd65bc4ef9 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\scheduler\worker\non_main_thread_impl.cc:188 #16 0x7ffd6819ce45 in base::`anonymous namespace'::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:131 #17 0x7ff73039533d in asan_thread_start C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:147 #18 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #19 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27) previously allocated by thread T9 here: #0 0x7ff7303a191d in malloc C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win.cpp:98 #1 0x7ffd7f22286e in operator new D:\a\_work\1\s\src\vctools\crt\vcstartup\src\heap\new_scalar.cpp:36 #2 0x7ffd6dbef4dd in cc::GpuImageDecodeCache::CreateImageData C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2986 #3 0x7ffd6dbebef9 in cc::GpuImageDecodeCache::GetTaskForImageAndRefInternal C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1310 #4 0x7ffd6dbedb0e in cc::GpuImageDecodeCache::GetOutOfRasterDecodeTaskForImageAndRef C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:1280 #5 0x7ffd76f78332 in cc::ImageController::GenerateTasksForOrphanedRequests C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:382 #6 0x7ffd76f77c7b in cc::ImageController::SetImageDecodeCache C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:148 #7 0x7ffd72353ba4 in cc::TileManager::SetResources C:\b\s\w\ir\cache\builder\src\cc\tiles\tile_manager.cc:628 #8 0x7ffd6dc70151 in cc::LayerTreeHostImpl::CreateTileManagerResources C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host_impl.cc:3926 #9 0x7ffd6dc86ee9 in cc::LayerTreeHostImpl::InitializeFrameSink C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host_impl.cc:4217 #10 0x7ffd72305dbc in cc::ProxyImpl::InitializeLayerTreeFrameSinkOnImpl C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:193 #11 0x7ffd6dc3e4d1 in base::internal::Invoker),cc::ProxyImpl *,cc::LayerTreeFrameSink *&&,base::WeakPtr &&>,base::internal::BindState<1,1,0,void (cc::ProxyImpl::*)(cc::LayerTreeFrameSink *, base::WeakPtr),base::internal::UnretainedWrapper,base::internal::UnretainedWrapper,base::WeakPtr >,void ()>::RunImpl),std::__Cr::tuple,base::internal::UnretainedWrapper,base::WeakPtr >,0,1,2> C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1067 #12 0x7ffd682757a0 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:203 #13 0x7ffd6c9bedcd in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:470 #14 0x7ffd6c9bdb79 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:332 #15 0x7ffd6ca025ce in base::MessagePumpDefault::Run C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:40 #16 0x7ffd6c9c0a9f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:640 #17 0x7ffd682cf96e in base::RunLoop::Run C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134 #18 0x7ffd65bc4ef9 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\scheduler\worker\non_main_thread_impl.cc:188 #19 0x7ffd6819ce45 in base::`anonymous namespace'::ThreadFunc C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:131 #20 0x7ff73039533d in asan_thread_start C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:147 #21 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #22 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27) Thread T4 created by T0 here: #0 0x7ff730395252 in CreateThread C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:158 #1 0x7ffd6819be97 in base::`anonymous namespace'::CreateThreadInternal C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:196 #2 0x7ffd7672e258 in base::internal::WorkerThread::Start C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\worker_thread.cc:207 #3 0x7ffd713e2bf5 in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group.cc:93 #4 0x7ffd713e262d in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group.cc:84 #5 0x7ffd713ff8a2 in base::internal::ThreadGroupImpl::ScopedCommandsExecutor::~ScopedCommandsExecutor C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group_impl.cc:49 #6 0x7ffd713ff5be in base::internal::ThreadGroupImpl::Start C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_group_impl.cc:248 #7 0x7ffd6c98d9b8 in base::internal::ThreadPoolImpl::Start C:\b\s\w\ir\cache\builder\src\base\task\thread_pool\thread_pool_impl.cc:190 #8 0x7ffd6b75f97a in content::ChildProcess::ChildProcess C:\b\s\w\ir\cache\builder\src\content\child\child_process.cc:102 #9 0x7ffd75c05848 in content::RenderProcess::RenderProcess C:\b\s\w\ir\cache\builder\src\content\renderer\render_process.cc:18 #10 0x7ffd7052c8ea in content::RenderProcessImpl::RenderProcessImpl C:\b\s\w\ir\cache\builder\src\content\renderer\render_process_impl.cc:113 #11 0x7ffd7052cfe5 in content::RenderProcessImpl::Create C:\b\s\w\ir\cache\builder\src\content\renderer\render_process_impl.cc:228 #12 0x7ffd6bd87092 in content::RendererMain C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:289 #13 0x7ffd66675dd1 in content::RunOtherNamedProcessTypeMain C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:795 #14 0x7ffd6667802f in content::ContentMainRunnerImpl::Run C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1164 #15 0x7ffd6666c635 in content::RunContentProcess C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:356 #16 0x7ffd6666d1dd in content::ContentMain C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:369 #17 0x7ffd57f916b0 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:231 #18 0x7ff7302c43ed in MainDllLoader::Launch C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201 #19 0x7ff7302c200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:351 #20 0x7ff7306e68cb in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #21 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #22 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27) Thread T9 created by T0 here: #0 0x7ff730395252 in CreateThread C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_win.cpp:158 #1 0x7ffd6819be97 in base::`anonymous namespace'::CreateThreadInternal C:\b\s\w\ir\cache\builder\src\base\threading\platform_thread_win.cc:196 #2 0x7ffd6823672e in base::SimpleThread::StartAsync C:\b\s\w\ir\cache\builder\src\base\threading\simple_thread.cc:55 #3 0x7ffd65b16c88 in blink::Thread::CreateAndSetCompositorThread C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\scheduler\common\thread.cc:84 #4 0x7ffd705376d4 in content::RenderThreadImpl::InitializeCompositorThread C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:837 #5 0x7ffd7053361b in content::RenderThreadImpl::InitializeWebKit C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:872 #6 0x7ffd7052ff01 in content::RenderThreadImpl::Init C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:564 #7 0x7ffd70532b8d in content::RenderThreadImpl::RenderThreadImpl C:\b\s\w\ir\cache\builder\src\content\renderer\render_thread_impl.cc:518 #8 0x7ffd6bd87103 in content::RendererMain C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:293 #9 0x7ffd66675dd1 in content::RunOtherNamedProcessTypeMain C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:795 #10 0x7ffd6667802f in content::ContentMainRunnerImpl::Run C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1164 #11 0x7ffd6666c635 in content::RunContentProcess C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:356 #12 0x7ffd6666d1dd in content::ContentMain C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:369 #13 0x7ffd57f916b0 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:231 #14 0x7ff7302c43ed in MainDllLoader::Launch C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201 #15 0x7ff7302c200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:351 #16 0x7ff7306e68cb in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #17 0x7ffdcc44257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c) #18 0x7ffdcd62af27 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005af27) SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\cc\tiles\gpu_image_decode_cache.cc:2469 in cc::GpuImageDecodeCache::DecodeImageIfNecessary Shadow bytes around the buggy address: 0x11fe92769680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x11fe92769900: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11fe92769b00: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x11fe92769b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1472==ADDITIONAL INFO ==1472==Note: Please include this section with the ASan report. Task trace: #0 0x7ffd76f7a874 in cc::ImageController::ScheduleImageDecodeOnWorkerIfNeeded C:\b\s\w\ir\cache\builder\src\cc\tiles\image_controller.cc:402 #1 0x7ffd6dc2e877 in cc::ProxyMain::SetLayerTreeFrameSink C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:542 #2 0x7ffd72310385 in cc::ProxyImpl::ScheduledActionBeginLayerTreeFrameSinkCreation C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:877 #3 0x7ffd6dc2c1c5 in cc::ProxyMain::BeginMainFrame C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:468 MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==1472==END OF ADDITIONAL INFO ==1472==ABORTING