================================================================= ==172222==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c69259fd2b0 at pc 0x5609bed93103 bp 0x7fff384c1750 sp 0x7fff384c1748 READ of size 1 at 0x7c69259fd2b0 thread T0 (chrome) #0 0x5609bed93102 in LoginStateChecker::OnExecutionResponseCallback(optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>) gen/third_party/libc++/src/include/optional:338:9 #1 0x5609bed93a5d in void base::internal::Invoker>), base::WeakPtr&&>, base::internal::BindState>), base::WeakPtr>, void (optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)>::RunImpl>), std::__Cr::tuple>, 0ul>(void (LoginStateChecker::*&&)(optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>), std::__Cr::tuple>&&, std::__Cr::integer_sequence, optimization_guide::OptimizationGuideModelExecutionResult&&, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:730:12 #2 0x5609bed7d22d in base::OnceCallback>)>::Run(optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>) && base/functional/callback.h:155:12 #3 0x5609bed7cd16 in void optimization_guide::ExecuteModelWithLogging(optimization_guide::RemoteModelExecutor*, optimization_guide::ModelBasedCapabilityKey, optimization_guide::proto::PasswordChangeRequest const&, std::__Cr::optional, base::OnceCallback>)>)::'lambda'(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)::operator()(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>) const components/optimization_guide/core/model_quality/model_execution_logging_wrappers.h:75:33 #4 0x5609bed7c7f5 in base::internal::Invoker(optimization_guide::RemoteModelExecutor*, optimization_guide::ModelBasedCapabilityKey, optimization_guide::proto::PasswordChangeRequest const&, std::__Cr::optional, base::OnceCallback>)>)::'lambda'(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)&&, base::OnceCallback>)>&&, std::__Cr::unique_ptr>&&>, base::internal::BindState(optimization_guide::RemoteModelExecutor*, optimization_guide::ModelBasedCapabilityKey, optimization_guide::proto::PasswordChangeRequest const&, std::__Cr::optional, base::OnceCallback>)>)::'lambda'(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>), base::OnceCallback>)>, std::__Cr::unique_ptr>>, void (optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)>::RunOnce(base::internal::BindStateBase*, optimization_guide::OptimizationGuideModelExecutionResult&&, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:648:12 #5 0x5609bb822d08 in optimization_guide::ModelExecutionManager::OnModelExecuteResponse(optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>, base::expected) base/functional/callback.h:155:12 #6 0x5609bb826444 in void base::internal::DecayedFunctorTraits>, base::OnceCallback>)>, base::expected), base::WeakPtr&&, optimization_guide::ModelBasedCapabilityKey&&, unsigned long&&, std::__Cr::unique_ptr>&&, base::OnceCallback>)>&&>::Invoke>, base::OnceCallback>)>, base::expected), base::WeakPtr const&, optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>, base::expected>(void (optimization_guide::ModelExecutionManager::*)(optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>, base::expected), base::WeakPtr const&, optimization_guide::ModelBasedCapabilityKey&&, unsigned long&&, std::__Cr::unique_ptr>&&, base::OnceCallback>)>&&, base::expected&&) base/functional/bind_internal.h:730:12 #7 0x5609bb8260ee in base::internal::Invoker>, base::OnceCallback>)>, base::expected), base::WeakPtr&&, optimization_guide::ModelBasedCapabilityKey&&, unsigned long&&, std::__Cr::unique_ptr>&&, base::OnceCallback>)>&&>, base::internal::BindState>, base::OnceCallback>)>, base::expected), base::WeakPtr, optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>>, void (base::expected)>::RunOnce(base::internal::BindStateBase*, base::expected&&) base/functional/bind_internal.h:946:5 #8 0x5609bb81dee7 in optimization_guide::ModelExecutionFetcher::OnAccessTokenReceived(optimization_guide::ModelBasedCapabilityKey, std::__Cr::basic_string, std::__Cr::allocator> const&, std::__Cr::optional, std::__Cr::basic_string, std::__Cr::allocator> const&) base/functional/callback.h:155:12 #9 0x5609bb81f789 in base::internal::Invoker, std::__Cr::allocator> const&, std::__Cr::optional, std::__Cr::basic_string, std::__Cr::allocator> const&), base::WeakPtr&&, optimization_guide::ModelBasedCapabilityKey&&, std::__Cr::basic_string, std::__Cr::allocator>&&, std::__Cr::optional&&>, base::internal::BindState, std::__Cr::allocator> const&, std::__Cr::optional, std::__Cr::basic_string, std::__Cr::allocator> const&), base::WeakPtr, optimization_guide::ModelBasedCapabilityKey, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::optional>, void (std::__Cr::basic_string, std::__Cr::allocator> const&)>::RunOnce(base::internal::BindStateBase*, std::__Cr::basic_string, std::__Cr::allocator> const&) base/functional/bind_internal.h:730:12 #10 0x5609bb773cc1 in optimization_guide::HandleTokenRequestFlow(bool, signin::IdentityManager*, signin::OAuthConsumerId, base::OnceCallback, std::__Cr::allocator> const&)>) base/functional/callback.h:155:12 #11 0x5609bb81d9d3 in optimization_guide::ModelExecutionFetcher::ExecuteModel(optimization_guide::ModelBasedCapabilityKey, signin::IdentityManager*, google::protobuf::MessageLite const&, std::__Cr::optional, base::OnceCallback)>) components/optimization_guide/core/model_execution/model_execution_fetcher.cc:393:3 #12 0x5609bb821a3f in optimization_guide::ModelExecutionManager::ExecuteModel(optimization_guide::ModelBasedCapabilityKey, google::protobuf::MessageLite const&, std::__Cr::optional, std::__Cr::unique_ptr>, base::OnceCallback>)>) components/optimization_guide/core/model_execution/model_execution_manager.cc:222:28 #13 0x5609c02c0642 in OptimizationGuideKeyedService::ExecuteModel(optimization_guide::ModelBasedCapabilityKey, google::protobuf::MessageLite const&, std::__Cr::optional const&, base::OnceCallback>)>) chrome/browser/optimization_guide/optimization_guide_keyed_service.cc:461:29 #14 0x5609bed772b3 in void optimization_guide::ExecuteModelWithLogging(optimization_guide::RemoteModelExecutor*, optimization_guide::ModelBasedCapabilityKey, optimization_guide::proto::PasswordChangeRequest const&, std::__Cr::optional, base::OnceCallback>)>) components/optimization_guide/core/model_quality/model_execution_logging_wrappers.h:79:13 #15 0x5609bed924e0 in LoginStateChecker::OnPageContentReceived(std::__Cr::optional) chrome/browser/password_manager/password_change/login_state_checker.cc:159:3 #16 0x5609bed93554 in void base::internal::DecayedFunctorTraits), base::WeakPtr const&>::Invoke), base::WeakPtr const&, std::__Cr::optional>(void (LoginStateChecker::*)(std::__Cr::optional), base::WeakPtr const&, std::__Cr::optional&&) base/functional/bind_internal.h:730:12 #17 0x5609bed93362 in base::internal::Invoker), base::WeakPtr const&>, base::internal::BindState), base::WeakPtr>, void (std::__Cr::optional)>::Run(base::internal::BindStateBase*, std::__Cr::optional&&) base/functional/bind_internal.h:946:5 #18 0x5609bed6ea22 in AnnotatedPageContentCapturer::CapturePageContent(std::__Cr::optional) base/functional/callback.h:155:12 #19 0x5609bed6f254 in void base::internal::DecayedFunctorTraits), base::WeakPtr&&>::Invoke), base::WeakPtr const&, std::__Cr::optional>(void (AnnotatedPageContentCapturer::*)(std::__Cr::optional), base::WeakPtr const&, std::__Cr::optional&&) base/functional/bind_internal.h:730:12 #20 0x5609bed6f062 in base::internal::Invoker), base::WeakPtr&&>, base::internal::BindState), base::WeakPtr>, void (std::__Cr::optional)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional&&) base/functional/bind_internal.h:946:5 #21 0x5609c50fe936 in optimization_guide::(anonymous namespace)::OnGotAIPageContentOrTimedOutForAllFrames(mojo::StructPtr, base::ElapsedTimer, content::GlobalRenderFrameHostToken, long, gfx::Size const&, std::__Cr::unique_ptr>, base::OnceCallback)>) base/functional/callback.h:155:12 #22 0x5609c51006db in base::internal::Invoker, base::ElapsedTimer, content::GlobalRenderFrameHostToken, long, gfx::Size const&, std::__Cr::unique_ptr>, base::OnceCallback)>), mojo::StructPtr&&, base::ElapsedTimer&&, content::GlobalRenderFrameHostToken&&, long&&, gfx::Size&&, std::__Cr::unique_ptr>&&, base::OnceCallback)>&&>, base::internal::BindState, base::ElapsedTimer, content::GlobalRenderFrameHostToken, long, gfx::Size const&, std::__Cr::unique_ptr>, base::OnceCallback)>), mojo::StructPtr, base::ElapsedTimer, content::GlobalRenderFrameHostToken, long, gfx::Size, std::__Cr::unique_ptr>, base::OnceCallback)>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:663:12 #23 0x5609c510ade5 in optimization_guide::(anonymous namespace)::GetAIPageContentTimeoutHelper::OnMainFrameRun() base/functional/callback.h:155:12 #24 0x5609c51001f4 in base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:730:12 #25 0x5609c5107b38 in optimization_guide::(anonymous namespace)::GetAIPageContentTimeoutHelper::OnGotAIPageContentForFrame(content::GlobalRenderFrameHostToken, mojo::Remote, base::OnceCallback, mojo::StructPtr) base/functional/callback.h:155:12 #26 0x5609c510c8c8 in base::internal::Invoker, base::OnceCallback, mojo::StructPtr), base::WeakPtr&&, content::GlobalRenderFrameHostToken&&, mojo::Remote&&, base::OnceCallback&&>, base::internal::BindState, base::OnceCallback, mojo::StructPtr), base::WeakPtr, content::GlobalRenderFrameHostToken, mojo::Remote, base::OnceCallback>, void (mojo::StructPtr)>::RunOnce(base::internal::BindStateBase*, mojo::StructPtr&&) base/functional/bind_internal.h:730:12 #27 0x5609c510bab9 in mojo::internal::CallbackWithDeleteHelper)>::Run(mojo::StructPtr) base/functional/callback.h:155:12 #28 0x5609c510bd45 in base::internal::Invoker)>::*&&)(mojo::StructPtr), std::__Cr::unique_ptr)>, std::__Cr::default_delete)>>>&&>, base::internal::BindState)>::*)(mojo::StructPtr), std::__Cr::unique_ptr)>, std::__Cr::default_delete)>>>>, void (mojo::StructPtr)>::RunOnce(base::internal::BindStateBase*, mojo::StructPtr&&) base/functional/bind_internal.h:730:12 #29 0x7f59854a4ad1 in blink::mojom::AIPageContentAgent_GetAIPageContent_ForwardToCallback::Accept(mojo::Message*) base/functional/callback.h:155:12 #30 0x7f59a09fa6c4 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1055:41 #31 0x7f59a0a1140b in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:43:19 #32 0x7f59a09ff934 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:731:20 #33 0x7f59a0a209ee in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1163:42 #34 0x7f59a0a1f21d in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:766:7 #35 0x7f59a0a1140b in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:43:19 #36 0x7f59a09e5acf in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase) mojo/public/cpp/bindings/lib/connector.cc:549:49 #37 0x7f59a09e731e in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:607:14 #38 0x7f59a09e6db7 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:438:3 #39 0x7f59a09e99a1 in base::internal::Invoker, base::internal::BindState, base::internal::UnretainedWrapper>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:730:12 #40 0x7f59a09e904e in base::RepeatingCallback::Run(unsigned int) const & base/functional/callback.h:343:12 #41 0x7f59a09e8e04 in base::internal::Invoker const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback const&>, base::internal::BindState const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:663:12 #42 0x7f599f06a600 in base::RepeatingCallback::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:343:12 #43 0x7f599f069fdb in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:278:14 #44 0x7f599f06b044 in base::internal::Invoker&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:730:12 #45 0x7f59a04988c2 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #46 0x7f59a051944e in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:113:5 #47 0x7f59a0518486 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40 #48 0x7f59a06de0ed in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48 #49 0x7f59a051aa98 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:647:12 #50 0x7f59a04041a2 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:134:14 #51 0x7f59935e0073 in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1119:18 #52 0x7f59935e8386 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15 #53 0x7f59935d7655 in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28 #54 0x7f599690f6b5 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:702:10 #55 0x7f5996912a86 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1289:10 #56 0x7f59969123c2 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1128:12 #57 0x7f599690cdab in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:346:36 #58 0x7f599690d07a in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:359:10 #59 0x5609ba863c0f in ChromeMain chrome/app/chrome_main.cc:228:12 #60 0x7f593388a082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 0x7c69259fd2b0 is located 176 bytes inside of 232-byte region [0x7c69259fd200,0x7c69259fd2e8) freed by thread T0 (chrome) here: #0 0x5609ba862bb2 in operator delete(void*, unsigned long) (/home/krace/fuzz/chromium/src/out/ui/chrome+0x64fdbb2) (BuildId: 7a9b4f35ede8b3b3) #1 0x5609c1d19fb8 in PasswordChangeDelegateImpl::ProceedToChangePassword() gen/third_party/libc++/src/include/__memory/unique_ptr.h:77:5 #2 0x5609c1d2204f in base::internal::Invoker const&>, base::internal::BindState>, void (bool)>::Run(base::internal::BindStateBase*, bool) base/functional/bind_internal.h:730:12 #3 0x5609bbf49a8f in base::RepeatingCallback::Run(bool) const & base/functional/callback.h:343:12 #4 0x5609bed92fd0 in LoginStateChecker::OnExecutionResponseCallback(optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>) chrome/browser/password_manager/password_change/login_state_checker.cc:233:26 #5 0x5609bed93a5d in void base::internal::Invoker>), base::WeakPtr&&>, base::internal::BindState>), base::WeakPtr>, void (optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)>::RunImpl>), std::__Cr::tuple>, 0ul>(void (LoginStateChecker::*&&)(optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>), std::__Cr::tuple>&&, std::__Cr::integer_sequence, optimization_guide::OptimizationGuideModelExecutionResult&&, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:730:12 #6 0x5609bed7d22d in base::OnceCallback>)>::Run(optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>) && base/functional/callback.h:155:12 #7 0x5609bed7cd16 in void optimization_guide::ExecuteModelWithLogging(optimization_guide::RemoteModelExecutor*, optimization_guide::ModelBasedCapabilityKey, optimization_guide::proto::PasswordChangeRequest const&, std::__Cr::optional, base::OnceCallback>)>)::'lambda'(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)::operator()(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>) const components/optimization_guide/core/model_quality/model_execution_logging_wrappers.h:75:33 #8 0x5609bed7c7f5 in base::internal::Invoker(optimization_guide::RemoteModelExecutor*, optimization_guide::ModelBasedCapabilityKey, optimization_guide::proto::PasswordChangeRequest const&, std::__Cr::optional, base::OnceCallback>)>)::'lambda'(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)&&, base::OnceCallback>)>&&, std::__Cr::unique_ptr>&&>, base::internal::BindState(optimization_guide::RemoteModelExecutor*, optimization_guide::ModelBasedCapabilityKey, optimization_guide::proto::PasswordChangeRequest const&, std::__Cr::optional, base::OnceCallback>)>)::'lambda'(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>), base::OnceCallback>)>, std::__Cr::unique_ptr>>, void (optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)>::RunOnce(base::internal::BindStateBase*, optimization_guide::OptimizationGuideModelExecutionResult&&, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:648:12 #9 0x5609bb822d08 in optimization_guide::ModelExecutionManager::OnModelExecuteResponse(optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>, base::expected) base/functional/callback.h:155:12 #10 0x5609bb826444 in void base::internal::DecayedFunctorTraits>, base::OnceCallback>)>, base::expected), base::WeakPtr&&, optimization_guide::ModelBasedCapabilityKey&&, unsigned long&&, std::__Cr::unique_ptr>&&, base::OnceCallback>)>&&>::Invoke>, base::OnceCallback>)>, base::expected), base::WeakPtr const&, optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>, base::expected>(void (optimization_guide::ModelExecutionManager::*)(optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>, base::expected), base::WeakPtr const&, optimization_guide::ModelBasedCapabilityKey&&, unsigned long&&, std::__Cr::unique_ptr>&&, base::OnceCallback>)>&&, base::expected&&) base/functional/bind_internal.h:730:12 #11 0x5609bb8260ee in base::internal::Invoker>, base::OnceCallback>)>, base::expected), base::WeakPtr&&, optimization_guide::ModelBasedCapabilityKey&&, unsigned long&&, std::__Cr::unique_ptr>&&, base::OnceCallback>)>&&>, base::internal::BindState>, base::OnceCallback>)>, base::expected), base::WeakPtr, optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>>, void (base::expected)>::RunOnce(base::internal::BindStateBase*, base::expected&&) base/functional/bind_internal.h:946:5 #12 0x5609bb81dee7 in optimization_guide::ModelExecutionFetcher::OnAccessTokenReceived(optimization_guide::ModelBasedCapabilityKey, std::__Cr::basic_string, std::__Cr::allocator> const&, std::__Cr::optional, std::__Cr::basic_string, std::__Cr::allocator> const&) base/functional/callback.h:155:12 #13 0x5609bb81f789 in base::internal::Invoker, std::__Cr::allocator> const&, std::__Cr::optional, std::__Cr::basic_string, std::__Cr::allocator> const&), base::WeakPtr&&, optimization_guide::ModelBasedCapabilityKey&&, std::__Cr::basic_string, std::__Cr::allocator>&&, std::__Cr::optional&&>, base::internal::BindState, std::__Cr::allocator> const&, std::__Cr::optional, std::__Cr::basic_string, std::__Cr::allocator> const&), base::WeakPtr, optimization_guide::ModelBasedCapabilityKey, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::optional>, void (std::__Cr::basic_string, std::__Cr::allocator> const&)>::RunOnce(base::internal::BindStateBase*, std::__Cr::basic_string, std::__Cr::allocator> const&) base/functional/bind_internal.h:730:12 #14 0x5609bb773cc1 in optimization_guide::HandleTokenRequestFlow(bool, signin::IdentityManager*, signin::OAuthConsumerId, base::OnceCallback, std::__Cr::allocator> const&)>) base/functional/callback.h:155:12 #15 0x5609bb81d9d3 in optimization_guide::ModelExecutionFetcher::ExecuteModel(optimization_guide::ModelBasedCapabilityKey, signin::IdentityManager*, google::protobuf::MessageLite const&, std::__Cr::optional, base::OnceCallback)>) components/optimization_guide/core/model_execution/model_execution_fetcher.cc:393:3 #16 0x5609bb821a3f in optimization_guide::ModelExecutionManager::ExecuteModel(optimization_guide::ModelBasedCapabilityKey, google::protobuf::MessageLite const&, std::__Cr::optional, std::__Cr::unique_ptr>, base::OnceCallback>)>) components/optimization_guide/core/model_execution/model_execution_manager.cc:222:28 #17 0x5609c02c0642 in OptimizationGuideKeyedService::ExecuteModel(optimization_guide::ModelBasedCapabilityKey, google::protobuf::MessageLite const&, std::__Cr::optional const&, base::OnceCallback>)>) chrome/browser/optimization_guide/optimization_guide_keyed_service.cc:461:29 #18 0x5609bed772b3 in void optimization_guide::ExecuteModelWithLogging(optimization_guide::RemoteModelExecutor*, optimization_guide::ModelBasedCapabilityKey, optimization_guide::proto::PasswordChangeRequest const&, std::__Cr::optional, base::OnceCallback>)>) components/optimization_guide/core/model_quality/model_execution_logging_wrappers.h:79:13 #19 0x5609bed924e0 in LoginStateChecker::OnPageContentReceived(std::__Cr::optional) chrome/browser/password_manager/password_change/login_state_checker.cc:159:3 #20 0x5609bed92f71 in LoginStateChecker::OnExecutionResponseCallback(optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>) chrome/browser/password_manager/password_change/login_state_checker.cc:227:5 #21 0x5609bed93a5d in void base::internal::Invoker>), base::WeakPtr&&>, base::internal::BindState>), base::WeakPtr>, void (optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)>::RunImpl>), std::__Cr::tuple>, 0ul>(void (LoginStateChecker::*&&)(optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>), std::__Cr::tuple>&&, std::__Cr::integer_sequence, optimization_guide::OptimizationGuideModelExecutionResult&&, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:730:12 #22 0x5609bed7d22d in base::OnceCallback>)>::Run(optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>) && base/functional/callback.h:155:12 #23 0x5609bed7cd16 in void optimization_guide::ExecuteModelWithLogging(optimization_guide::RemoteModelExecutor*, optimization_guide::ModelBasedCapabilityKey, optimization_guide::proto::PasswordChangeRequest const&, std::__Cr::optional, base::OnceCallback>)>)::'lambda'(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)::operator()(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>) const components/optimization_guide/core/model_quality/model_execution_logging_wrappers.h:75:33 #24 0x5609bed7c7f5 in base::internal::Invoker(optimization_guide::RemoteModelExecutor*, optimization_guide::ModelBasedCapabilityKey, optimization_guide::proto::PasswordChangeRequest const&, std::__Cr::optional, base::OnceCallback>)>)::'lambda'(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)&&, base::OnceCallback>)>&&, std::__Cr::unique_ptr>&&>, base::internal::BindState(optimization_guide::RemoteModelExecutor*, optimization_guide::ModelBasedCapabilityKey, optimization_guide::proto::PasswordChangeRequest const&, std::__Cr::optional, base::OnceCallback>)>)::'lambda'(base::OnceCallback>)>, std::__Cr::unique_ptr>, optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>), base::OnceCallback>)>, std::__Cr::unique_ptr>>, void (optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>)>::RunOnce(base::internal::BindStateBase*, optimization_guide::OptimizationGuideModelExecutionResult&&, std::__Cr::unique_ptr>&&) base/functional/bind_internal.h:648:12 #25 0x5609bb822d08 in optimization_guide::ModelExecutionManager::OnModelExecuteResponse(optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>, base::expected) base/functional/callback.h:155:12 #26 0x5609bb826444 in void base::internal::DecayedFunctorTraits>, base::OnceCallback>)>, base::expected), base::WeakPtr&&, optimization_guide::ModelBasedCapabilityKey&&, unsigned long&&, std::__Cr::unique_ptr>&&, base::OnceCallback>)>&&>::Invoke>, base::OnceCallback>)>, base::expected), base::WeakPtr const&, optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>, base::expected>(void (optimization_guide::ModelExecutionManager::*)(optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>, base::expected), base::WeakPtr const&, optimization_guide::ModelBasedCapabilityKey&&, unsigned long&&, std::__Cr::unique_ptr>&&, base::OnceCallback>)>&&, base::expected&&) base/functional/bind_internal.h:730:12 #27 0x5609bb8260ee in base::internal::Invoker>, base::OnceCallback>)>, base::expected), base::WeakPtr&&, optimization_guide::ModelBasedCapabilityKey&&, unsigned long&&, std::__Cr::unique_ptr>&&, base::OnceCallback>)>&&>, base::internal::BindState>, base::OnceCallback>)>, base::expected), base::WeakPtr, optimization_guide::ModelBasedCapabilityKey, unsigned long, std::__Cr::unique_ptr>, base::OnceCallback>)>>, void (base::expected)>::RunOnce(base::internal::BindStateBase*, base::expected&&) base/functional/bind_internal.h:946:5 #28 0x5609bb81dee7 in optimization_guide::ModelExecutionFetcher::OnAccessTokenReceived(optimization_guide::ModelBasedCapabilityKey, std::__Cr::basic_string, std::__Cr::allocator> const&, std::__Cr::optional, std::__Cr::basic_string, std::__Cr::allocator> const&) base/functional/callback.h:155:12 #29 0x5609bb81f789 in base::internal::Invoker, std::__Cr::allocator> const&, std::__Cr::optional, std::__Cr::basic_string, std::__Cr::allocator> const&), base::WeakPtr&&, optimization_guide::ModelBasedCapabilityKey&&, std::__Cr::basic_string, std::__Cr::allocator>&&, std::__Cr::optional&&>, base::internal::BindState, std::__Cr::allocator> const&, std::__Cr::optional, std::__Cr::basic_string, std::__Cr::allocator> const&), base::WeakPtr, optimization_guide::ModelBasedCapabilityKey, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::optional>, void (std::__Cr::basic_string, std::__Cr::allocator> const&)>::RunOnce(base::internal::BindStateBase*, std::__Cr::basic_string, std::__Cr::allocator> const&) base/functional/bind_internal.h:730:12 previously allocated by thread T0 (chrome) here: #0 0x5609ba861fad in operator new(unsigned long) (/home/krace/fuzz/chromium/src/out/ui/chrome+0x64fcfad) (BuildId: 7a9b4f35ede8b3b3) #1 0x5609c1d198fb in PasswordChangeDelegateImpl::StartPasswordChangeFlow() gen/third_party/libc++/src/include/__memory/unique_ptr.h:759:26 #2 0x5609c1d1f103 in PasswordChangeDelegateImpl::OnPrivacyNoticeAccepted() chrome/browser/password_manager/password_change_delegate_impl.cc:597:3 #3 0x5609bed631dc in PasswordChangeUIController::OnPrivacyNoticeAccepted() chrome/browser/ui/passwords/password_change_ui_controller.cc:513:30 #4 0x5609bed654c4 in base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:730:12 #5 0x7f599be158a1 in decltype(auto) std::__Cr::__variant_detail::__visitation::__base::__dispatcher<1ul>::__dispatch, base::RepeatingCallback>&)::$_0, ui::DialogModel::RunButtonCallback(std::__Cr::variant, base::RepeatingCallback>&)::$_1, ui::DialogModel::RunButtonCallback(std::__Cr::variant, base::RepeatingCallback>&)::$_2>>&&, std::__Cr::__variant_detail::__base<(std::__Cr::__variant_detail::_Trait)1, base::internal::DoNothingCallbackTag, base::OnceCallback, base::RepeatingCallback>&>(std::__Cr::__variant_detail::__visitation::__variant::__value_visitor, base::RepeatingCallback>&)::$_0, ui::DialogModel::RunButtonCallback(std::__Cr::variant, base::RepeatingCallback>&)::$_1, ui::DialogModel::RunButtonCallback(std::__Cr::variant, base::RepeatingCallback>&)::$_2>>&&, std::__Cr::__variant_detail::__base<(std::__Cr::__variant_detail::_Trait)1, base::internal::DoNothingCallbackTag, base::OnceCallback, base::RepeatingCallback>&) base/functional/callback.h:155:12 #6 0x7f599be1265a in ui::DialogModel::OnDialogAcceptAction(base::PassKey) gen/third_party/libc++/src/include/variant:502:12 #7 0x7f59716952b2 in base::internal::Invoker), ui::DialogModel*, base::PassKey const&>, base::internal::BindState), base::internal::UnretainedWrapper, base::PassKey>, bool ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:730:12 #8 0x7f5971a33b4f in base::RepeatingCallback::Run() const & base/functional/callback.h:343:12 #9 0x7f5971a33555 in views::DialogDelegate::RunCloseCallback(std::__Cr::variant, base::RepeatingCallback>&) ui/views/window/dialog_delegate.cc:262:61 #10 0x7f5971a3394b in views::DialogDelegate::Accept() ui/views/window/dialog_delegate.cc:246:12 #11 0x7f5971a37478 in views::DialogDelegate::AcceptDialog() ui/views/window/dialog_delegate.cc:549:34 #12 0x7f5971a301a3 in base::internal::Invoker, base::internal::BindState, ui::mojom::DialogButton>, void (ui::Event const&)>::Run(base::internal::BindStateBase*, ui::Event const&) base/functional/bind_internal.h:730:12 #13 0x7f59716db14f in base::RepeatingCallback::Run(ui::Event const&) const & base/functional/callback.h:343:12 #14 0x7f59716d6536 in views::Button::NotifyClick(ui::Event const&) gen/third_party/libc++/src/include/variant:502:12 #15 0x7f59716de49d in views::ButtonController::OnMouseReleased(ui::MouseEvent const&) ui/views/controls/button/button_controller.cc #16 0x7f599b429a44 in ui::ScopedTargetHandler::OnEvent(ui::Event*) ui/events/scoped_target_handler.cc:30:24 #17 0x7f599b410b28 in ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*) ui/events/event_dispatcher.cc:189:12 #18 0x7f599b40f67b in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:138:5 #19 0x7f599b40edd4 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:84:14 #20 0x7f599b40e90f in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:56:15 #21 0x7f59719cbb06 in views::internal::RootView::OnMouseReleased(ui::MouseEvent const&) ui/views/widget/root_view.cc:628:9 #22 0x7f59719fd8c1 in views::Widget::OnMouseEvent(ui::MouseEvent*) ui/views/widget/widget.cc:2157:20 #23 0x7f5971aa928c in views::NativeWidgetAura::OnMouseEvent(ui::MouseEvent*) ui/views/widget/native_widget_aura.cc #24 0x7f599b410b28 in ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*) ui/events/event_dispatcher.cc:189:12 #25 0x7f599b40f67b in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:138:5 #26 0x7f599b40edd4 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:84:14 #27 0x7f599b40e90f in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:56:15 #28 0x7f599b41736f in ui::EventProcessor::OnEventFromSource(ui::Event*) ui/events/event_processor.cc:72:19 #29 0x7f599b41a911 in ui::EventSource::DeliverEventToSink(ui::Event*) ui/events/event_source.cc:119:16 SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/optional:338:9 in LoginStateChecker::OnExecutionResponseCallback(optimization_guide::OptimizationGuideModelExecutionResult, std::__Cr::unique_ptr>) Shadow bytes around the buggy address: 0x7c69259fd000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x7c69259fd080: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd 0x7c69259fd100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c69259fd180: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa 0x7c69259fd200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x7c69259fd280: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fa fa fa 0x7c69259fd300: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 00 0x7c69259fd380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c69259fd400: 00 fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x7c69259fd480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c69259fd500: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==172222==ADDITIONAL INFO ==172222==Note: Please include this section with the ASan report. Task trace: #0 0x7f599f06a9fa in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:102:13 Command line: `/home/krace/fuzz/chromium/src/out/ui/chrome --user-data-dir=/tmp/noexist --password-change-url=http://127.0.0.1:8605/ --flag-switches-begin --flag-switches-end --ozone-platform=x11 http://127.0.0.1:8605/poc.html` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==172222==END OF ADDITIONAL INFO ==172222==ABORTING [1114/140313.440344:ERROR:third_party/crashpad/crashpad/util/file/file_io_posix.cc:145] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq: No such file or directory (2) [1114/140313.440589:ERROR:third_party/crashpad/crashpad/util/file/file_io_posix.cc:145] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq: No such file or directory (2) Received signal 6 #0 0x5609ba7ce146 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x6469145) #1 0x7f59a0686c62 (/home/krace/fuzz/chromium/src/out/ui/libbase.so+0x712c61) #2 0x7f59a062b103 (/home/krace/fuzz/chromium/src/out/ui/libbase.so+0x6b7102) #3 0x7f59a0685efb (/home/krace/fuzz/chromium/src/out/ui/libbase.so+0x711efa) #4 0x7f5934463420 (/usr/lib/x86_64-linux-gnu/libpthread-2.31.so+0x1441f) #5 0x7f59338a900b (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x4300a) #6 0x7f5933888859 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x22858) #7 0x5609ba8491dc (/home/krace/fuzz/chromium/src/out/ui/chrome+0x64e41db) #8 0x5609ba8479ce (/home/krace/fuzz/chromium/src/out/ui/chrome+0x64e29cd) #9 0x5609ba82eecb (/home/krace/fuzz/chromium/src/out/ui/chrome+0x64c9eca) #10 0x5609ba830cad (/home/krace/fuzz/chromium/src/out/ui/chrome+0x64cbcac) #11 0x5609ba831856 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x64cc855) #12 0x5609bed93103 (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa2e102) #13 0x5609bed93a5e (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa2ea5d) #14 0x5609bed7d22e (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa1822d) #15 0x5609bed7cd17 (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa17d16) #16 0x5609bed7c7f6 (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa177f5) #17 0x5609bb822d09 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x74bdd08) #18 0x5609bb826445 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x74c1444) #19 0x5609bb8260ef (/home/krace/fuzz/chromium/src/out/ui/chrome+0x74c10ee) #20 0x5609bb81dee8 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x74b8ee7) #21 0x5609bb81f78a (/home/krace/fuzz/chromium/src/out/ui/chrome+0x74ba789) #22 0x5609bb773cc2 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x740ecc1) #23 0x5609bb81d9d4 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x74b89d3) #24 0x5609bb821a40 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x74bca3f) #25 0x5609c02c0643 (/home/krace/fuzz/chromium/src/out/ui/chrome+0xbf5b642) #26 0x5609bed772b4 (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa122b3) #27 0x5609bed924e1 (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa2d4e0) #28 0x5609bed93555 (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa2e554) #29 0x5609bed93363 (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa2e362) #30 0x5609bed6ea23 (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa09a22) #31 0x5609bed6f255 (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa0a254) #32 0x5609bed6f063 (/home/krace/fuzz/chromium/src/out/ui/chrome+0xaa0a062) #33 0x5609c50fe937 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x10d99936) #34 0x5609c51006dc (/home/krace/fuzz/chromium/src/out/ui/chrome+0x10d9b6db) #35 0x5609c510ade6 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x10da5de5) #36 0x5609c51001f5 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x10d9b1f4) #37 0x5609c5107b39 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x10da2b38) #38 0x5609c510c8c9 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x10da78c8) #39 0x5609c510baba (/home/krace/fuzz/chromium/src/out/ui/chrome+0x10da6ab9) #40 0x5609c510bd46 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x10da6d45) #41 0x7f59854a4ad2 (/home/krace/fuzz/chromium/src/out/ui/libblink_common.so+0x1b13ad1) #42 0x7f59a09fa6c5 (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0x866c4) #43 0x7f59a0a1140c (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0x9d40b) #44 0x7f59a09ff935 (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0x8b934) #45 0x7f59a0a209ef (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0xac9ee) #46 0x7f59a0a1f21e (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0xab21d) #47 0x7f59a0a1140c (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0x9d40b) #48 0x7f59a09e5ad0 (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0x71acf) #49 0x7f59a09e731f (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0x7331e) #50 0x7f59a09e6db8 (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0x72db7) #51 0x7f59a09e99a2 (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0x759a1) #52 0x7f59a09e904f (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0x7504e) #53 0x7f59a09e8e05 (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_cpp_bindings.so+0x74e04) #54 0x7f599f06a601 (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_system_cpp.so+0x36600) #55 0x7f599f069fdc (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_system_cpp.so+0x35fdb) #56 0x7f599f06b045 (/home/krace/fuzz/chromium/src/out/ui/libmojo_public_system_cpp.so+0x37044) #57 0x7f59a04988c3 (/home/krace/fuzz/chromium/src/out/ui/libbase.so+0x5248c2) #58 0x7f59a051944f (/home/krace/fuzz/chromium/src/out/ui/libbase.so+0x5a544e) #59 0x7f59a0518487 (/home/krace/fuzz/chromium/src/out/ui/libbase.so+0x5a4486) #60 0x7f59a06de0ee (/home/krace/fuzz/chromium/src/out/ui/libbase.so+0x76a0ed) #61 0x7f59a051aa99 (/home/krace/fuzz/chromium/src/out/ui/libbase.so+0x5a6a98) #62 0x7f59a04041a3 (/home/krace/fuzz/chromium/src/out/ui/libbase.so+0x4901a2) #63 0x7f59935e0074 (/home/krace/fuzz/chromium/src/out/ui/libcontent.so+0x48b4073) #64 0x7f59935e8387 (/home/krace/fuzz/chromium/src/out/ui/libcontent.so+0x48bc386) #65 0x7f59935d7656 (/home/krace/fuzz/chromium/src/out/ui/libcontent.so+0x48ab655) #66 0x7f599690f6b6 (/home/krace/fuzz/chromium/src/out/ui/libcontent.so+0x7be36b5) #67 0x7f5996912a87 (/home/krace/fuzz/chromium/src/out/ui/libcontent.so+0x7be6a86) #68 0x7f59969123c3 (/home/krace/fuzz/chromium/src/out/ui/libcontent.so+0x7be63c2) #69 0x7f599690cdac (/home/krace/fuzz/chromium/src/out/ui/libcontent.so+0x7be0dab) #70 0x7f599690d07b (/home/krace/fuzz/chromium/src/out/ui/libcontent.so+0x7be107a) #71 0x5609ba863c10 (/home/krace/fuzz/chromium/src/out/ui/chrome+0x64fec0f) #72 0x7f593388a083 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x24082) #73 0x5609ba7866ca (/home/krace/fuzz/chromium/src/out/ui/chrome+0x64216c9) r8: 0000000000000000 r9: 00007fff384c0760 r10: 0000000000000008 r11: 0000000000000246 r12: efffffffffffffff r13: ffffff0000000000 r14: 00005609cab24f98 r15: 0fffff0000000000 di: 0000000000000002 si: 00007fff384c0760 bp: 6000000000000000 bx: 00007f59257be840 dx: 0000000000000000 ax: 0000000000000000 cx: 00007f59338a900b sp: 00007fff384c0760 ip: 00007f59338a900b efl: 0000000000000246 cgf: 002b000000000033 erf: 0000000000000000 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000 [end of stack trace] Aborted