==4176==ERROR: AddressSanitizer: heap-use-after-free on address 0x1214f2ab2cd0 at pc 0x7ffa6a3b77e1 bp 0x00cbac1fb880 sp 0x00cbac1fb8c8 READ of size 8 at 0x1214f2ab2cd0 thread T0 ==4176==*** WARNING: Failed to initialize DbgHelp! *** ==4176==*** Most likely this means that the app is already *** ==4176==*** using DbgHelp, possibly with incompatible flags. *** ==4176==*** Due to technical reasons, symbolization might crash *** ==4176==*** or produce wrong results. *** [10340:11220:0929/034158.052:ERROR:google_apis\gcm\engine\registration_request.cc:274] Registration URL fetching failed. #0 0x7ffa6a3b77e0 in blink::WebMediaPlayerMS::MaybeCreateWatchTimeReporter C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\mediastream\web_media_player_ms.cc:1507 #1 0x7ffa6f0a1db9 in base::internal::Invoker &&,media::VideoTransformation &&,bool &&>,base::internal::BindState<1,1,0,void (WebMediaPlayerMS::*)(media::VideoTransformation, bool),base::WeakPtr,media::VideoTransformation,bool>,void ()>::RunOnce C:\Users\sherkito\chromium\src\base\functional\bind_internal.h:973 #2 0x7ffa5e7688b3 in base::TaskAnnotator::RunTaskImpl C:\Users\sherkito\chromium\src\base\task\common\task_annotator.cc:209 #3 0x7ffa639e03d9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456 #4 0x7ffa639df27f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330 #5 0x7ffa63a26c07 in base::MessagePumpDefault::Run C:\Users\sherkito\chromium\src\base\message_loop\message_pump_default.cc:42 #6 0x7ffa639e2121 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629 #7 0x7ffa5e7d4e7e in base::RunLoop::Run C:\Users\sherkito\chromium\src\base\run_loop.cc:134 #8 0x7ffa619cb487 in content::RendererMain C:\Users\sherkito\chromium\src\content\renderer\renderer_main.cc:356 #9 0x7ffa5c2a0cb6 in content::RunOtherNamedProcessTypeMain C:\Users\sherkito\chromium\src\content\app\content_main_runner_impl.cc:794 #10 0x7ffa5c2a306c in content::ContentMainRunnerImpl::Run C:\Users\sherkito\chromium\src\content\app\content_main_runner_impl.cc:1183 #11 0x7ffa5c2970c3 in content::RunContentProcess C:\Users\sherkito\chromium\src\content\app\content_main.cc:359 #12 0x7ffa5c297c7d in content::ContentMain C:\Users\sherkito\chromium\src\content\app\content_main.cc:372 #13 0x7ffa4c8a2b0b in ChromeMain C:\Users\sherkito\chromium\src\chrome\app\chrome_main.cc:222 #14 0x7ff77aca47bb in MainDllLoader::Launch C:\Users\sherkito\chromium\src\chrome\app\main_dll_loader_win.cc:201 #15 0x7ff77aca2021 in main C:\Users\sherkito\chromium\src\chrome\app\chrome_exe_main_win.cc:352 #16 0x7ff77b159f7b in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #17 0x7ffb09f77373 in BaseThreadInitThunk+0x13 (C:\Windows\System32\KERNEL32.DLL+0x180017373) #18 0x7ffb0bdbcc90 in RtlUserThreadStart+0x20 (C:\Windows\SYSTEM32\ntdll.dll+0x18004cc90) 0x1214f2ab2cd0 is located 848 bytes inside of 920-byte region [0x1214f2ab2980,0x1214f2ab2d18) freed by thread T0 here: #0 0x7ffad490c394 in operator delete+0x94 (C:\Users\sherkito\chromium\src\out\Default\clang_rt.asan_dynamic-x86_64.dll+0x18005c394) #1 0x7ffa6a3c5fb7 in blink::WebMediaPlayerMS::`vector deleting destructor'+0x27 (C:\Users\sherkito\chromium\src\out\Default\chrome.dll+0x19db25fb7) #2 0x7ffa6a904c64 in blink::HTMLMediaElement::ClearMediaPlayerAndAudioSourceProviderClientWithoutLocking C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:4053 #3 0x7ffa6a901b49 in blink::HTMLMediaElement::InvokePreFinalizer C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.h:115 #4 0x7ffa53f7ebc5 in cppgc::internal::PreFinalizerHandler::InvokePreFinalizers C:\Users\sherkito\chromium\src\v8\src\heap\cppgc\prefinalizer-handler.cc:68 #5 0x7ffa53f53300 in cppgc::internal::HeapBase::ExecutePreFinalizers C:\Users\sherkito\chromium\src\v8\src\heap\cppgc\heap-base.cc:169 #6 0x7ffa52183943 in v8::internal::CppHeap::CompactAndSweep C:\Users\sherkito\chromium\src\v8\src\heap\cppgc-js\cpp-heap.cc:990 #7 0x7ffa5227c7e9 in v8::internal::Heap::PerformGarbageCollection C:\Users\sherkito\chromium\src\v8\src\heap\heap.cc:2305 #8 0x7ffa522ce70d in v8::internal::Heap::CollectGarbage::::operator() C:\Users\sherkito\chromium\src\v8\src\heap\heap.cc:1676 #9 0x7ffa522cdce8 in heap::base::Stack::SetMarkerAndCallbackImpl<`lambda at ..\..\v8\src\heap\heap.cc:1644:40'> C:\Users\sherkito\chromium\src\v8\src\heap\base\stack.h:174 #10 0x7ffa76c6f7ec in PushAllRegistersAndIterateStack+0x6c (C:\Users\sherkito\chromium\src\out\Default\chrome.dll+0x1aa3cf7ec) #11 0x7ffa5226fa7b in v8::internal::Heap::CollectGarbage C:\Users\sherkito\chromium\src\v8\src\heap\heap.cc:1644 #12 0x7ffa52183e36 in v8::internal::CppHeap::ReportBufferedAllocationSizeIfPossible C:\Users\sherkito\chromium\src\v8\src\heap\cppgc-js\cpp-heap.cc:1077 #13 0x7ffa53f83d5e in cppgc::internal::StatsCollector::AllocatedObjectSizeSafepointImpl C:\Users\sherkito\chromium\src\v8\src\heap\cppgc\stats-collector.cc:83 #14 0x7ffa53f75f5f in cppgc::internal::ObjectAllocator::OutOfLineAllocateGCSafePoint C:\Users\sherkito\chromium\src\v8\src\heap\cppgc\object-allocator.cc:153 #15 0x7ffa53f43a4f in cppgc::internal::MakeGarbageCollectedTraitInternal::Allocate C:\Users\sherkito\chromium\src\v8\src\heap\cppgc\allocation.cc:57 #16 0x7ffa6a3cbd1e in cppgc::MakeGarbageCollectedTrait,WTF::VectorTraits > > >::Call<> C:\Users\sherkito\chromium\src\third_party\blink\renderer\platform\heap\collection_support\heap_vector_backing.h:223 #17 0x7ffa6a3cb99f in WTF::VectorBufferBase,blink::HeapAllocator>::AllocateBufferNoBarrier C:\Users\sherkito\chromium\src\third_party\blink\renderer\platform\wtf\vector.h:555 #18 0x7ffa6a3c4c3f in blink::WebMediaPlayerMS::GetMediaStreamType C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\mediastream\web_media_player_ms.cc:1641 #19 0x7ffa6a3b662d in blink::WebMediaPlayerMS::MaybeCreateWatchTimeReporter C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\mediastream\web_media_player_ms.cc:1503 #20 0x7ffa6f0a1db9 in base::internal::Invoker &&,media::VideoTransformation &&,bool &&>,base::internal::BindState<1,1,0,void (WebMediaPlayerMS::*)(media::VideoTransformation, bool),base::WeakPtr,media::VideoTransformation,bool>,void ()>::RunOnce C:\Users\sherkito\chromium\src\base\functional\bind_internal.h:973 #21 0x7ffa5e7688b3 in base::TaskAnnotator::RunTaskImpl C:\Users\sherkito\chromium\src\base\task\common\task_annotator.cc:209 #22 0x7ffa639e03d9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456 #23 0x7ffa639df27f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330 #24 0x7ffa63a26c07 in base::MessagePumpDefault::Run C:\Users\sherkito\chromium\src\base\message_loop\message_pump_default.cc:42 #25 0x7ffa639e2121 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629 #26 0x7ffa5e7d4e7e in base::RunLoop::Run C:\Users\sherkito\chromium\src\base\run_loop.cc:134 #27 0x7ffa619cb487 in content::RendererMain C:\Users\sherkito\chromium\src\content\renderer\renderer_main.cc:356 previously allocated by thread T0 here: #0 0x7ffad490b7ad in operator new+0x8d (C:\Users\sherkito\chromium\src\out\Default\clang_rt.asan_dynamic-x86_64.dll+0x18005b7ad) #1 0x7ffa660ba4ed in content::MediaFactory::CreateWebMediaPlayerForMediaStream C:\Users\sherkito\chromium\src\content\renderer\media\media_factory.cc:774 #2 0x7ffa660b6bb3 in content::MediaFactory::CreateMediaPlayer C:\Users\sherkito\chromium\src\content\renderer\media\media_factory.cc:386 #3 0x7ffa619f885f in content::RenderFrameImpl::CreateMediaPlayer C:\Users\sherkito\chromium\src\content\renderer\render_frame_impl.cc:3545 #4 0x7ffa66293041 in blink::ModulesInitializer::CreateWebMediaPlayer C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\modules_initializer.cc:357 #5 0x7ffa667b4d41 in blink::LocalFrameClientImpl::CreateWebMediaPlayer C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\frame\local_frame_client_impl.cc:1004 #6 0x7ffa6a919841 in blink::HTMLMediaElement::StartPlayerLoad C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:1623 #7 0x7ffa6a915ca3 in blink::HTMLMediaElement::LoadResource C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:1478 #8 0x7ffa6a91125d in blink::HTMLMediaElement::LoadSourceFromObject C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:1312 #9 0x7ffa6a910640 in blink::HTMLMediaElement::SelectMediaResource C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:1262 #10 0x7ffa6a90bd67 in blink::HTMLMediaElement::LoadInternal C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:1202 #11 0x7ffa6a901be1 in blink::HTMLMediaElement::LoadTimerFired C:\Users\sherkito\chromium\src\third_party\blink\renderer\core\html\media\html_media_element.cc:928 #12 0x7ffa61b3121b in blink::TimerBase::RunInternal C:\Users\sherkito\chromium\src\third_party\blink\renderer\platform\timer.cc:166 #13 0x7ffa6a94729e in base::internal::Invoker *, blink::HTMLMediaElement *),blink::HeapTaskRunnerTimer *,cppgc::internal::BasicPersistent &&>,base::internal::BindState<0,1,0,void (*)(blink::HeapTaskRunnerTimer *, blink::HTMLMediaElement *),WTF::UnretainedWrapper >,cppgc::internal::BasicPersistent >,void ()>::RunOnce C:\Users\sherkito\chromium\src\base\functional\bind_internal.h:973 #14 0x7ffa5e7688b3 in base::TaskAnnotator::RunTaskImpl C:\Users\sherkito\chromium\src\base\task\common\task_annotator.cc:209 #15 0x7ffa639e03d9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456 #16 0x7ffa639df27f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330 #17 0x7ffa63a26c07 in base::MessagePumpDefault::Run C:\Users\sherkito\chromium\src\base\message_loop\message_pump_default.cc:42 #18 0x7ffa639e2121 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\Users\sherkito\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629 #19 0x7ffa5e7d4e7e in base::RunLoop::Run C:\Users\sherkito\chromium\src\base\run_loop.cc:134 #20 0x7ffa619cb487 in content::RendererMain C:\Users\sherkito\chromium\src\content\renderer\renderer_main.cc:356 #21 0x7ffa5c2a0cb6 in content::RunOtherNamedProcessTypeMain C:\Users\sherkito\chromium\src\content\app\content_main_runner_impl.cc:794 #22 0x7ffa5c2a306c in content::ContentMainRunnerImpl::Run C:\Users\sherkito\chromium\src\content\app\content_main_runner_impl.cc:1183 #23 0x7ffa5c2970c3 in content::RunContentProcess C:\Users\sherkito\chromium\src\content\app\content_main.cc:359 #24 0x7ffa5c297c7d in content::ContentMain C:\Users\sherkito\chromium\src\content\app\content_main.cc:372 #25 0x7ffa4c8a2b0b in ChromeMain C:\Users\sherkito\chromium\src\chrome\app\chrome_main.cc:222 #26 0x7ff77aca47bb in MainDllLoader::Launch C:\Users\sherkito\chromium\src\chrome\app\main_dll_loader_win.cc:201 #27 0x7ff77aca2021 in main C:\Users\sherkito\chromium\src\chrome\app\chrome_exe_main_win.cc:352 SUMMARY: AddressSanitizer: heap-use-after-free C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\mediastream\web_media_player_ms.cc:1507 in blink::WebMediaPlayerMS::MaybeCreateWatchTimeReporter Shadow bytes around the buggy address: 0x1214f2ab2a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1214f2ab2a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1214f2ab2b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1214f2ab2b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1214f2ab2c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x1214f2ab2c80: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd 0x1214f2ab2d00: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1214f2ab2d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1214f2ab2e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x1214f2ab2e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1214f2ab2f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==4176==ADDITIONAL INFO ==4176==Note: Please include this section with the ASan report. Task trace: #0 0x7ffa6f096483 in blink::WebMediaPlayerMSCompositor::CheckForFrameChanges C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\mediastream\web_media_player_ms_compositor.cc:872 #1 0x7ffa6f093a4d in blink::WebMediaPlayerMSCompositor::SetCurrentFrame C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\mediastream\web_media_player_ms_compositor.cc:857 #2 0x7ffa6f08fce8 in blink::WebMediaPlayerMSCompositor::RenderWithoutAlgorithm C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\mediastream\web_media_player_ms_compositor.cc:738 #3 0x7ffa725a4885 in blink::MediaStreamVideoRendererSink::OnReadyStateChanged C:\Users\sherkito\chromium\src\third_party\blink\renderer\modules\mediastream\media_stream_video_renderer_sink.cc:223 Command line: `"C:\Users\sherkito\chromium\src\out\Default\chrome.exe" --type=renderer --user-data-dir="C:\Users\sherkito\AppData\Local\Tempzzzz" --no-pre-read-main-dll --no-sandbox --js-flags="--stress-incremental-marking --expose-gc" --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ko --device-scale-factor=2.25 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --time-ticks-at-unix-epoch=-1759021543344351 --launch-time-ticks=62763948729 --metrics-shmem-handle=4352,i,7695991040908723466,15499138168625511990,2097152 --field-trial-handle=2036,i,12065775627451732198,9711474943222598034,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==4176==END OF ADDITIONAL INFO ==4176==ABORTING