=================================================================
==11361==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f00000d6f8 at pc 0x0003349994b8 bp 0x00016f5c82b0 sp 0x00016f5c82a8
READ of size 1 at 0x60f00000d6f8 thread T0
[11451:259:1030/180843.640154:ERROR:render_process_impl.cc(212)] WebFrame LEAKED 1 TIMES
==11361==WARNING: invalid path to external symbolizer!
==11361==WARNING: Failed to use and restart external symbolizer!
    #0 0x0003349994b4 in content::WebUIMessageHandler::IsJavascriptAllowed()+0x64 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d994b4)
    #1 0x000379736040 in void content::WebUIMessageHandler::CallJavascriptFunction<base::Value, base::Value>(std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, base::Value const&, base::Value const&)+0x170 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xcb7e040)
    #2 0x00037972f19c in void content::WebUIMessageHandler::FireWebUIListener<base::Value>(std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, base::Value const&)+0x194 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xcb7719c)
    #3 0x000379aa9494 in ProfilePickerHandler::OnProfileCreationFinished(bool)+0x168 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xcef1494)
    #4 0x000379ab931c in void base::internal::DecayedFunctorTraits<void (ProfilePickerHandler::*)(bool), ProfilePickerHandler*>::Invoke<void (ProfilePickerHandler::*)(bool), ProfilePickerHandler*, bool>(void (ProfilePickerHandler::*)(bool), ProfilePickerHandler*&&, bool&&)+0x13c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xcf0131c)
    #5 0x000379ab9134 in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (ProfilePickerHandler::*&&)(bool), ProfilePickerHandler*>, void, 0ul>::MakeItSo<void (ProfilePickerHandler::*)(bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, bool>(void (ProfilePickerHandler::*&&)(bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, bool&&)+0x194 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xcf01134)
    #6 0x000379ab8e1c in void base::internal::Invoker<base::internal::FunctorTraits<void (ProfilePickerHandler::*&&)(bool), ProfilePickerHandler*>, base::internal::BindState<true, true, false, void (ProfilePickerHandler::*)(bool), base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (bool)>::RunImpl<void (ProfilePickerHandler::*)(bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(void (ProfilePickerHandler::*&&)(bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>, bool&&)+0x15c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xcf00e1c)
    #7 0x000379ab8bec in base::internal::Invoker<base::internal::FunctorTraits<void (ProfilePickerHandler::*&&)(bool), ProfilePickerHandler*>, base::internal::BindState<true, true, false, void (ProfilePickerHandler::*)(bool), base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (bool)>::RunOnce(base::internal::BindStateBase*, bool)+0x12c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xcf00bec)
    #8 0x00036cc59084 in base::OnceCallback<void (bool)>::Run(bool) &&+0x224 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xa1084)
    #9 0x0003892eb8ac in (anonymous namespace)::FinishFlowAndRunInBrowserStepController::Show(base::OnceCallback<void (bool)>, bool)+0x21c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c7338ac)
    #10 0x0003892ca168 in ProfileManagementFlowController::SwitchToStep(ProfileManagementFlowController::Step, bool, base::OnceCallback<void (bool)>, base::OnceCallback<void ()>)+0x4bc (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c712168)
    #11 0x0003892ee5ec in ProfileManagementFlowControllerImpl::AdvanceToNextPostIdentityStep(base::OnceCallback<void (bool)>)+0x23c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c7365ec)
    #12 0x000389310a18 in void base::internal::DecayedFunctorTraits<void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*>::Invoke<void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*, base::OnceCallback<void (bool)>>(void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*&&, base::OnceCallback<void (bool)>&&)+0x1f4 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c758a18)
    #13 0x00038931078c in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (ProfileManagementFlowControllerImpl::*&&)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*>, void, 0ul>::MakeItSo<void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, base::OnceCallback<void (bool)>>(void (ProfileManagementFlowControllerImpl::*&&)(base::OnceCallback<void (bool)>), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, base::OnceCallback<void (bool)>&&)+0x194 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c75878c)
    #14 0x000389310474 in void base::internal::Invoker<base::internal::FunctorTraits<void (ProfileManagementFlowControllerImpl::*&&)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*>, base::internal::BindState<true, true, false, void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (base::OnceCallback<void (bool)>)>::RunImpl<void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(void (ProfileManagementFlowControllerImpl::*&&)(base::OnceCallback<void (bool)>), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>, base::OnceCallback<void (bool)>&&)+0x15c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c758474)
    #15 0x000389310288 in base::internal::Invoker<base::internal::FunctorTraits<void (ProfileManagementFlowControllerImpl::*&&)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*>, base::internal::BindState<true, true, false, void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (base::OnceCallback<void (bool)>)>::RunOnce(base::internal::BindStateBase*, base::OnceCallback<void (bool)>&&)+0x30 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c758288)
    #16 0x0003892e83cc in base::OnceCallback<void (base::OnceCallback<void (bool)>)>::Run(base::OnceCallback<void (bool)>) &&+0x254 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c7303cc)
    #17 0x0003892e78e8 in (anonymous namespace)::SearchEngineChoiceStepController::Show(base::OnceCallback<void (bool)>, bool)+0x330 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c72f8e8)
    #18 0x0003892ca168 in ProfileManagementFlowController::SwitchToStep(ProfileManagementFlowController::Step, bool, base::OnceCallback<void (bool)>, base::OnceCallback<void ()>)+0x4bc (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c712168)
    #19 0x0003892ee5ec in ProfileManagementFlowControllerImpl::AdvanceToNextPostIdentityStep(base::OnceCallback<void (bool)>)+0x23c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c7365ec)
    #20 0x0003892ee2a8 in ProfileManagementFlowControllerImpl::SwitchToPostIdentitySteps(base::StrongAlias<PostHostClearedCallbackTag, base::OnceCallback<void (Browser*)>>, base::OnceCallback<void (bool)>)+0x298 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c7362a8)
    #21 0x0003892ee9d4 in ProfileManagementFlowControllerImpl::HandleIdentityStepsCompleted(Profile*, base::StrongAlias<PostHostClearedCallbackTag, base::OnceCallback<void (Browser*)>>, bool, base::OnceCallback<void (bool)>)+0x2c4 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c7369d4)
    #22 0x000389309370 in ProfilePickerFlowController::SwitchToSignedOutPostIdentityFlow(Profile*, base::StrongAlias<PostHostClearedCallbackTag, base::OnceCallback<void (Browser*)>>, base::OnceCallback<void (bool)>)+0x2fc (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c751370)
    #23 0x00038932e3e8 in ProfilePickerView::OnLocalProfileInitialized(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*)+0x648 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c7763e8)
    #24 0x00038933e8c0 in void base::internal::DecayedFunctorTraits<void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>&&, std::__Cr::optional<unsigned int>&&, base::TimeTicks&&, base::OnceCallback<void (bool)>&&>::Invoke<void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView> const&, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*>(void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView> const&, std::__Cr::optional<unsigned int>&&, base::TimeTicks&&, base::OnceCallback<void (bool)>&&, Profile*&&)+0x250 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c7868c0)
    #25 0x00038933e5bc in void base::internal::InvokeHelper<true, base::internal::FunctorTraits<void (ProfilePickerView::*&&)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>&&, std::__Cr::optional<unsigned int>&&, base::TimeTicks&&, base::OnceCallback<void (bool)>&&>, void, 0ul, 1ul, 2ul, 3ul>::MakeItSo<void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), std::__Cr::tuple<base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>, Profile*>(void (ProfilePickerView::*&&)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), std::__Cr::tuple<base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>&&, Profile*&&)+0xf8 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c7865bc)
    #26 0x00038933e298 in void base::internal::Invoker<base::internal::FunctorTraits<void (ProfilePickerView::*&&)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>&&, std::__Cr::optional<unsigned int>&&, base::TimeTicks&&, base::OnceCallback<void (bool)>&&>, base::internal::BindState<true, true, false, void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>, void (Profile*)>::RunImpl<void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), std::__Cr::tuple<base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>, 0ul, 1ul, 2ul, 3ul>(void (ProfilePickerView::*&&)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), std::__Cr::tuple<base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>, Profile*&&)+0x18c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c786298)
    #27 0x00038933e014 in base::internal::Invoker<base::internal::FunctorTraits<void (ProfilePickerView::*&&)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>&&, std::__Cr::optional<unsigned int>&&, base::TimeTicks&&, base::OnceCallback<void (bool)>&&>, base::internal::BindState<true, true, false, void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>, void (Profile*)>::RunOnce(base::internal::BindStateBase*, Profile*)+0x12c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1c786014)
    #28 0x0003780b0474 in base::OnceCallback<void (Profile*)>::Run(Profile*) &&+0x220 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xb4f8474)
    #29 0x00037d522e24 in (anonymous namespace)::RunCallbacks(std::__Cr::vector<base::OnceCallback<void (Profile*)>, std::__Cr::allocator<base::OnceCallback<void (Profile*)>>>&, Profile*)+0x1ac (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1096ae24)
    #30 0x00037d522a70 in ProfileManager::OnProfileCreationFinished(Profile*, Profile::CreateMode, bool, bool)+0x574 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1096aa70)
    #31 0x00037d4e9084 in ProfileImpl::DoFinalInit(Profile::CreateMode)+0x106c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x10931084)
    #32 0x00037d4ef6a8 in ProfileImpl::OnLocaleReady(Profile::CreateMode)+0xba8 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x109376a8)
    #33 0x00037d4e6d34 in ProfileImpl::OnPrefsLoaded(Profile::CreateMode, bool)+0x3c8 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1092ed34)
    #34 0x00037d4f46f4 in void base::internal::DecayedFunctorTraits<void (ProfileImpl::*)(Profile::CreateMode, bool), ProfileImpl*, Profile::CreateMode&&>::Invoke<void (ProfileImpl::*)(Profile::CreateMode, bool), ProfileImpl*, Profile::CreateMode, bool>(void (ProfileImpl::*)(Profile::CreateMode, bool), ProfileImpl*&&, Profile::CreateMode&&, bool&&)+0x1a0 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1093c6f4)
    #35 0x00037d4f42ec in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (ProfileImpl::*&&)(Profile::CreateMode, bool), ProfileImpl*, Profile::CreateMode&&>, void, 0ul, 1ul>::MakeItSo<void (ProfileImpl::*)(Profile::CreateMode, bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>, bool>(void (ProfileImpl::*&&)(Profile::CreateMode, bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>&&, bool&&)+0x1a8 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1093c2ec)
    #36 0x00037d4f3f88 in void base::internal::Invoker<base::internal::FunctorTraits<void (ProfileImpl::*&&)(Profile::CreateMode, bool), ProfileImpl*, Profile::CreateMode&&>, base::internal::BindState<true, true, false, void (ProfileImpl::*)(Profile::CreateMode, bool), base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>, void (bool)>::RunImpl<void (ProfileImpl::*)(Profile::CreateMode, bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>, 0ul, 1ul>(void (ProfileImpl::*&&)(Profile::CreateMode, bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>, bool&&)+0x16c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1093bf88)
    #37 0x00037d4f3d3c in base::internal::Invoker<base::internal::FunctorTraits<void (ProfileImpl::*&&)(Profile::CreateMode, bool), ProfileImpl*, Profile::CreateMode&&>, base::internal::BindState<true, true, false, void (ProfileImpl::*)(Profile::CreateMode, bool), base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>, void (bool)>::RunOnce(base::internal::BindStateBase*, bool)+0x12c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1093bd3c)
    #38 0x00010f1ac67c in base::OnceCallback<void (bool)>::Run(bool) &&+0x224 (/Users/minchan/Documents/chromium/src/out/foo/libcomponents_prefs.dylib:arm64+0x1c67c)
    #39 0x00010f1e7138 in PrefNotifierImpl::OnInitializationCompleted(bool)+0x238 (/Users/minchan/Documents/chromium/src/out/foo/libcomponents_prefs.dylib:arm64+0x57138)
    #40 0x00010f22bc84 in PrefValueStore::CheckInitializationCompleted()+0x31c (/Users/minchan/Documents/chromium/src/out/foo/libcomponents_prefs.dylib:arm64+0x9bc84)
    #41 0x00010f22b6ec in PrefValueStore::OnInitializationCompleted(PrefValueStore::PrefStoreType, bool)+0x170 (/Users/minchan/Documents/chromium/src/out/foo/libcomponents_prefs.dylib:arm64+0x9b6ec)
    #42 0x00010f22b56c in PrefValueStore::PrefStoreKeeper::OnInitializationCompleted(bool)+0x9c (/Users/minchan/Documents/chromium/src/out/foo/libcomponents_prefs.dylib:arm64+0x9b56c)
    #43 0x000174707d9c in policy::ConfigurationPolicyPrefStore::OnPolicyServiceInitialized(policy::PolicyDomain)+0x29c (/Users/minchan/Documents/chromium/src/out/foo/libpolicy_component.dylib:arm64+0x4fd9c)
    #44 0x000174a18b68 in policy::PolicyServiceImpl::MaybeNotifyPolicyDomainStatusChange(std::__Cr::vector<policy::PolicyDomain, std::__Cr::allocator<policy::PolicyDomain>> const&)+0x768 (/Users/minchan/Documents/chromium/src/out/foo/libpolicy_component.dylib:arm64+0x360b68)
    #45 0x000174a1b760 in policy::PolicyServiceImpl::NotifyPoliciesUpdated(policy::PolicyBundle const&)+0x4e0 (/Users/minchan/Documents/chromium/src/out/foo/libpolicy_component.dylib:arm64+0x363760)
    #46 0x000174a13518 in policy::PolicyServiceImpl::MergeAndTriggerUpdates()+0x3ec (/Users/minchan/Documents/chromium/src/out/foo/libpolicy_component.dylib:arm64+0x35b518)
    #47 0x000174a21114 in void base::internal::DecayedFunctorTraits<void (policy::PolicyServiceImpl::*)(), base::WeakPtr<policy::PolicyServiceImpl>&&>::Invoke<void (policy::PolicyServiceImpl::*)(), base::WeakPtr<policy::PolicyServiceImpl> const&>(void (policy::PolicyServiceImpl::*)(), base::WeakPtr<policy::PolicyServiceImpl> const&)+0xc8 (/Users/minchan/Documents/chromium/src/out/foo/libpolicy_component.dylib:arm64+0x369114)
    #48 0x000174a20fc4 in void base::internal::InvokeHelper<true, base::internal::FunctorTraits<void (policy::PolicyServiceImpl::*&&)(), base::WeakPtr<policy::PolicyServiceImpl>&&>, void, 0ul>::MakeItSo<void (policy::PolicyServiceImpl::*)(), std::__Cr::tuple<base::WeakPtr<policy::PolicyServiceImpl>>>(void (policy::PolicyServiceImpl::*&&)(), std::__Cr::tuple<base::WeakPtr<policy::PolicyServiceImpl>>&&)+0xa0 (/Users/minchan/Documents/chromium/src/out/foo/libpolicy_component.dylib:arm64+0x368fc4)
    #49 0x000174a20db0 in void base::internal::Invoker<base::internal::FunctorTraits<void (policy::PolicyServiceImpl::*&&)(), base::WeakPtr<policy::PolicyServiceImpl>&&>, base::internal::BindState<true, true, false, void (policy::PolicyServiceImpl::*)(), base::WeakPtr<policy::PolicyServiceImpl>>, void ()>::RunImpl<void (policy::PolicyServiceImpl::*)(), std::__Cr::tuple<base::WeakPtr<policy::PolicyServiceImpl>>, 0ul>(void (policy::PolicyServiceImpl::*&&)(), std::__Cr::tuple<base::WeakPtr<policy::PolicyServiceImpl>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>)+0x150 (/Users/minchan/Documents/chromium/src/out/foo/libpolicy_component.dylib:arm64+0x368db0)
    #50 0x000174a20c04 in base::internal::Invoker<base::internal::FunctorTraits<void (policy::PolicyServiceImpl::*&&)(), base::WeakPtr<policy::PolicyServiceImpl>&&>, base::internal::BindState<true, true, false, void (policy::PolicyServiceImpl::*)(), base::WeakPtr<policy::PolicyServiceImpl>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x28 (/Users/minchan/Documents/chromium/src/out/foo/libpolicy_component.dylib:arm64+0x368c04)
    #51 0x00010609808c in base::OnceCallback<void ()>::Run() &&+0x218 (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x808c)
    #52 0x0001065b87dc in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x51c (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x5287dc)
    #53 0x0001066e3998 in void base::TaskAnnotator::RunTask<base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_3>(perfetto::StaticString, base::PendingTask&, base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_3&&)+0x214 (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x653998)
    #54 0x0001066e2844 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0xcd0 (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x652844)
    #55 0x0001066e15e0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x278 (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x6515e0)
    #56 0x000106a56098 in base::MessagePumpCFRunLoopBase::RunWork()+0x2b4 (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x9c6098)
    #57 0x000106a563c0 in invocation function for block in base::MessagePumpCFRunLoopBase::RunWorkSource(void*)+0x58 (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x9c63c0)
    #58 0x000106a2afb0 in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x99afb0)
    #59 0x000106a53228 in base::MessagePumpCFRunLoopBase::RunWorkSource(void*)+0x164 (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x9c3228)
    #60 0x00018c6fa410 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__+0x18 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64+0x7e410)
    #61 0x00018c6fa3a4 in __CFRunLoopDoSource0+0xac (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64+0x7e3a4)
    #62 0x00018c6fa108 in __CFRunLoopDoSources0+0xf0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64+0x7e108)
    #63 0x00018c6f8cf4 in __CFRunLoopRun+0x344 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64+0x7ccf4)
    #64 0x00018c6f8330 in CFRunLoopRunSpecific+0x238 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64+0x7c330)
    #65 0x000197b310c8 in RunCurrentEventLoopInMode+0x120 (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:arm64+0x10c0c8)
    #66 0x000197b36d18 in ReceiveNextEventCommon+0xd8 (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:arm64+0x111d18)
    #67 0x000197b3701c in _BlockUntilNextEventMatchingListInModeWithFilter+0x48 (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox:arm64+0x11201c)
    #68 0x00019023ca6c in _DPSNextEvent+0x290 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64+0x3aa6c)
    #69 0x000190b627b4 in -[NSApplication(NSEventRouting) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]+0x2ac (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64+0x9607b4)
    #70 0x00037c426f68 in __71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke+0x1f4 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xf86ef68)
    #71 0x000106a2afb0 in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x99afb0)
    #72 0x00037c426a50 in -[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]+0x324 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xf86ea50)
    #73 0x00019022fb78 in -[NSApplication run]+0x1dc (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64+0x2db78)
    #74 0x000106a59424 in base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)+0x2f8 (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x9c9424)
    #75 0x000106a514a4 in base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)+0x384 (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x9c14a4)
    #76 0x0001066e4dbc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x78c (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x654dbc)
    #77 0x00010644d8b8 in base::RunLoop::Run(base::Location const&)+0x600 (/Users/minchan/Documents/chromium/src/out/foo/libbase.dylib:arm64+0x3bd8b8)
    #78 0x00033046e6b0 in content::BrowserMainLoop::RunMainMessageLoop()+0x3e8 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x486e6b0)
    #79 0x0003304a4120 in content::BrowserMainRunnerImpl::Run()+0x318 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x48a4120)
    #80 0x000330460014 in content::BrowserMain(content::MainFunctionParams)+0x368 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x4860014)
    #81 0x00033779a1e8 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*)+0x410 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0xbb9a1e8)
    #82 0x00033779f748 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool)+0x1090 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0xbb9f748)
    #83 0x00033779e330 in content::ContentMainRunnerImpl::Run()+0x9c4 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0xbb9e330)
    #84 0x00033779501c in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x6fc (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0xbb9501c)
    #85 0x000337796234 in content::ContentMain(content::ContentMainParams)+0x160 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0xbb96234)
    #86 0x00036cbc4324 in ChromeMain+0x5f0 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xc324)
    #87 0x000100830d44 in main+0x3bc (/Users/minchan/Documents/chromium/src/out/foo/Chromium.app/Contents/MacOS/Chromium:arm64+0x100000d44)
    #88 0x00018c290270  (<unknown module>)

0x60f00000d6f8 is located 8 bytes inside of 168-byte region [0x60f00000d6f0,0x60f00000d798)
freed by thread T0 here:
[11537:259:1030/180844.236125:ERROR:render_process_impl.cc(212)] WebFrame LEAKED 1 TIMES
    #0 0x0001014fd774 in __sanitizer_finish_switch_fiber+0xa44 (/Users/minchan/Documents/chromium/src/out/foo/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x61774)
    #1 0x000379a9eb00 in ProfilePickerHandler::~ProfilePickerHandler()+0x20 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xcee6b00)
    #2 0x000334993da0 in std::__Cr::default_delete<content::WebUIMessageHandler>::operator()(content::WebUIMessageHandler*) const+0x9c (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d93da0)
    #3 0x000334993cf0 in std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>::reset(content::WebUIMessageHandler*)+0xa4 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d93cf0)
    #4 0x000334993c38 in std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>::~unique_ptr()+0x1c (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d93c38)
    #5 0x000334970fb0 in std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>::~unique_ptr()+0x18 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d70fb0)
    #6 0x000334972cb0 in void std::__Cr::__destroy_at<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>, 0>(std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>*)+0x44 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d72cb0)
    #7 0x000334972c48 in void std::__Cr::allocator_traits<std::__Cr::allocator<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>>>::destroy<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>, void, 0>(std::__Cr::allocator<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>>&, std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>*)+0x18 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d72c48)
    #8 0x000334972bdc in std::__Cr::vector<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>, std::__Cr::allocator<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>>>::__base_destruct_at_end(std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>*)+0x98 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d72bdc)
    #9 0x0003349729c8 in std::__Cr::vector<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>, std::__Cr::allocator<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>>>::__clear()+0x4c (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d729c8)
    #10 0x0003349727ec in std::__Cr::vector<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>, std::__Cr::allocator<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>>>::__destroy_vector::operator()()+0xb8 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d727ec)
    #11 0x000334972664 in std::__Cr::vector<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>, std::__Cr::allocator<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>>>::~vector()+0x124 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d72664)
    #12 0x00033496cb8c in std::__Cr::vector<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>, std::__Cr::allocator<std::__Cr::unique_ptr<content::WebUIMessageHandler, std::__Cr::default_delete<content::WebUIMessageHandler>>>>::~vector()+0x18 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d6cb8c)
    #13 0x00033496c894 in content::WebUIImpl::~WebUIImpl()+0xf4 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d6c894)
    #14 0x00033496cbf8 in content::WebUIImpl::~WebUIImpl()+0x18 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d6cbf8)
    #15 0x00033496cc40 in content::WebUIImpl::~WebUIImpl()+0x18 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d6cc40)
    #16 0x00033320686c in std::__Cr::default_delete<content::WebUIImpl>::operator()(content::WebUIImpl*) const+0x9c (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x760686c)
    #17 0x000333161e9c in std::__Cr::unique_ptr<content::WebUIImpl, std::__Cr::default_delete<content::WebUIImpl>>::reset(content::WebUIImpl*)+0xa4 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x7561e9c)
    #18 0x0003332f8ed8 in content::RenderFrameHostImpl::ClearWebUI()+0xa0 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x76f8ed8)
    #19 0x000333551d04 in content::RenderFrameHostManager::ClearWebUIInstances()+0x1c (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x7951d04)
    #20 0x000332c03418 in content::FrameTree::Shutdown()+0x638 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x7003418)
    #21 0x0003343b9570 in content::WebContentsImpl::~WebContentsImpl()+0xd98 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x87b9570)
    #22 0x0003343bc928 in content::WebContentsImpl::~WebContentsImpl()+0x18 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x87bc928)
    #23 0x0003343bca88 in content::WebContentsImpl::~WebContentsImpl()+0x18 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x87bca88)
    #24 0x00037386cb5c in std::__Cr::default_delete<content::WebContents>::operator()(content::WebContents*) const+0x9c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x6cb4b5c)
    #25 0x00037386caac in std::__Cr::unique_ptr<content::WebContents, std::__Cr::default_delete<content::WebContents>>::reset(content::WebContents*)+0xa4 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x6cb4aac)
    #26 0x00037386c9f4 in std::__Cr::unique_ptr<content::WebContents, std::__Cr::default_delete<content::WebContents>>::~unique_ptr()+0x1c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x6cb49f4)
    #27 0x00037385fb1c in std::__Cr::unique_ptr<content::WebContents, std::__Cr::default_delete<content::WebContents>>::~unique_ptr()+0x18 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x6ca7b1c)
    #28 0x0003796212cc in tabs::TabModel::~TabModel()+0xb8 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xca692cc)
    #29 0x00037962149c in tabs::TabModel::~TabModel()+0x18 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xca6949c)

previously allocated by thread T0 here:
    #0 0x0001014fd36c in __sanitizer_finish_switch_fiber+0x63c (/Users/minchan/Documents/chromium/src/out/foo/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x6136c)
    #1 0x000379ac88d8 in std::__Cr::__unique_if<ProfilePickerHandler>::__unique_single std::__Cr::make_unique<ProfilePickerHandler>()+0x10c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xcf108d8)
    #2 0x000379ac8384 in ProfilePickerUI::ProfilePickerUI(content::WebUI*)+0x300 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xcf10384)
    #3 0x000379aca0f8 in ProfilePickerUI::ProfilePickerUI(content::WebUI*)+0x20 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xcf120f8)
    #4 0x00037a3a408c in std::__Cr::__unique_if<ProfilePickerUI>::__unique_single std::__Cr::make_unique<ProfilePickerUI, content::WebUI*&>(content::WebUI*&)+0x150 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xd7ec08c)
    #5 0x00037a3a3da4 in content::DefaultWebUIConfig<ProfilePickerUI>::CreateWebUIController(content::WebUI*, GURL const&)+0x15c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xd7ebda4)
    #6 0x00032bd6bc38 in content::(anonymous namespace)::WebUIConfigMapWebUIControllerFactory::CreateWebUIControllerForURL(content::WebUI*, GURL const&)+0x2a4 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x16bc38)
    #7 0x0003349543a4 in content::WebUIControllerFactoryRegistry::CreateWebUIControllerForURL(content::WebUI*, GURL const&)+0x284 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d543a4)
    #8 0x000333160ffc in content::NavigationRequest::CreateWebUIIfNeeded(content::RenderFrameHostImpl*)+0x7ac (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x7560ffc)
    #9 0x0003335583f4 in content::RenderFrameHostManager::CreateWebUIForNavigationIfNeeded(content::NavigationRequest*, content::SiteInstanceImpl*, bool)+0x6f4 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x79583f4)
    #10 0x000333553f1c in content::RenderFrameHostManager::GetFrameHostForNavigation(content::NavigationRequest*, content::BrowsingContextGroupSwap*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>*)+0x165c (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x7953f1c)
    #11 0x000333552228 in content::RenderFrameHostManager::DidCreateNavigationRequest(content::NavigationRequest*)+0x454 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x7952228)
    #12 0x000332c302c0 in content::FrameTreeNode::TakeNavigationRequest(std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>)+0x638 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x70302c0)
    #13 0x000333258fd8 in content::Navigator::Navigate(std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, content::ReloadType)+0x10e4 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x7658fd8)
    #14 0x00033302f3e8 in content::NavigationControllerImpl::NavigateWithoutEntry(content::NavigationController::LoadURLParams const&)+0x1160 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x742f3e8)
    #15 0x00033302de34 in content::NavigationControllerImpl::LoadURLWithParams(content::NavigationController::LoadURLParams const&)+0x630 (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x742de34)
    #16 0x0003886ccb20 in (anonymous namespace)::LoadURLInContents(content::WebContents*, GURL const&, NavigateParams*)+0x980 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1bb14b20)
    #17 0x0003886c73d4 in Navigate(NavigateParams*)+0x1b1c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1bb0f3d4)
    #18 0x0003886a10fc in chrome::OpenCurrentURL(Browser*)+0x764 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1bae90fc)
    #19 0x00037881ba64 in ChromeOmniboxClient::OnAutocompleteAccept(GURL const&, std::__Cr::pair<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>*, WindowOpenDisposition, ui::PageTransition, AutocompleteMatchType::Type, base::TimeTicks, bool, bool, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>> const&, AutocompleteMatch const&, AutocompleteMatch const&, IDNA2008DeviationCharacter)+0x36c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xbc63a64)
    #20 0x000385c558a8 in OmniboxEditModel::OpenMatch(OmniboxPopupSelection, AutocompleteMatch, WindowOpenDisposition, GURL const&, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>> const&, base::TimeTicks)+0x2c6c (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1909d8a8)
    #21 0x000385c56db4 in OmniboxEditModel::OpenSelection(OmniboxPopupSelection, base::TimeTicks, WindowOpenDisposition)+0x7c4 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1909edb4)
    #22 0x000389effe00 in OmniboxViewViews::HandleKeyEvent(views::Textfield*, ui::KeyEvent const&)+0x4b4 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0x1d347e00)
    #23 0x00031bb837e8 in views::Textfield::OnKeyPressed(ui::KeyEvent const&)+0x34c (/Users/minchan/Documents/chromium/src/out/foo/libui_views.dylib:arm64+0x5fb7e8)
    #24 0x00031bdc4804 in views::View::OnKeyEvent(ui::KeyEvent*)+0xb4 (/Users/minchan/Documents/chromium/src/out/foo/libui_views.dylib:arm64+0x83c804)
    #25 0x00012bb72c54 in ui::EventHandler::OnEvent(ui::Event*)+0xb4 (/Users/minchan/Documents/chromium/src/out/foo/libui_events.dylib:arm64+0x3ac54)
    #26 0x00012bb6608c in ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*)+0x298 (/Users/minchan/Documents/chromium/src/out/foo/libui_events.dylib:arm64+0x2e08c)
    #27 0x00012bb64ac0 in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*)+0x3d4 (/Users/minchan/Documents/chromium/src/out/foo/libui_events.dylib:arm64+0x2cac0)
    #28 0x00012bb63fdc in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*)+0x184 (/Users/minchan/Documents/chromium/src/out/foo/libui_events.dylib:arm64+0x2bfdc)
    #29 0x00012bb63b1c in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)+0x2d8 (/Users/minchan/Documents/chromium/src/out/foo/libui_events.dylib:arm64+0x2bb1c)

SUMMARY: AddressSanitizer: heap-use-after-free (/Users/minchan/Documents/chromium/src/out/foo/libcontent.dylib:arm64+0x8d994b4) in content::WebUIMessageHandler::IsJavascriptAllowed()+0x64
Shadow bytes around the buggy address:
  0x60f00000d400: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x60f00000d480: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x60f00000d500: f7 fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x60f00000d580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x60f00000d600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x60f00000d680: fd fd fd fd fd fa fa fa fa fa fa fa f7 fa fd[fd]
  0x60f00000d700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x60f00000d780: fd fd fd fa fa fa fa fa fa fa f7 fa fd fd fd fd
  0x60f00000d800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x60f00000d880: fd fd fa fa fa fa fa fa f7 fa fd fd fd fd fd fd
  0x60f00000d900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==11361==ADDITIONAL INFO

==11361==Note: Please include this section with the ASan report.
Task trace:
    #0 0x000174a197a8 in policy::PolicyServiceImpl::OnUpdatePolicy(policy::ConfigurationPolicyProvider*)+0x340 (/Users/minchan/Documents/chromium/src/out/foo/libpolicy_component.dylib:arm64+0x3617a8)
    #1 0x00017493a3e0 in policy::DesktopCloudPolicyStore::Load()+0x3d0 (/Users/minchan/Documents/chromium/src/out/foo/libpolicy_component.dylib:arm64+0x2823e0)
    #2 0x00017493a3e0 in policy::DesktopCloudPolicyStore::Load()+0x3d0 (/Users/minchan/Documents/chromium/src/out/foo/libpolicy_component.dylib:arm64+0x2823e0)
    #3 0x00037851c670 in (anonymous namespace)::NukeProfileFromDiskImpl(base::FilePath const&, unsigned long, unsigned long, base::OnceCallback<void ()>)+0x3f4 (/Users/minchan/Documents/chromium/src/out/foo/libchrome_dll.dylib:arm64+0xb964670)


Command line: `/Users/minchan/Documents/chromium/src/out/foo/Chromium.app/Contents/MacOS/Chromium --no-sandbox --flag-switches-begin --enable-features=Prerender2,ProfilesReordering,WebShare --flag-switches-end`


MiraclePtr Status: PROTECTED
This crash occurred inside a callback where a raw_ptr<T> pointing to the same region was bound to one of the arguments.
MiraclePtr is expected to make this crash non-exploitable once fully enabled.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==11361==END OF ADDITIONAL INFO
==11361==ABORTING
Received signal 6
0   libbase.dylib                       0x00000001069e42f4 base::debug::CollectStackTrace(base::span<void const*, 18446744073709551615ul, void const**>) + 324
1   libbase.dylib                       0x000000010691f924 base::debug::StackTrace::StackTrace(unsigned long) + 632
2   libbase.dylib                       0x000000010691fab8 base::debug::StackTrace::StackTrace(unsigned long) + 36
3   libbase.dylib                       0x000000010691fa84 base::debug::StackTrace::StackTrace() + 40
4   libbase.dylib                       0x00000001069e3ae4 base::debug::(anonymous namespace)::StackDumpSignalHandler(int, __siginfo*, void*) + 3512
5   libsystem_platform.dylib            0x000000018c648184 _sigtramp + 56
6   libsystem_pthread.dylib             0x000000018c612f70 pthread_kill + 288
7   libsystem_c.dylib                   0x000000018c51f908 abort + 128
8   libclang_rt.asan_osx_dynamic.dylib  0x0000000101513b2c __sanitizer_sandbox_on_notify + 1228
9   libclang_rt.asan_osx_dynamic.dylib  0x0000000101513168 __sanitizer_on_print + 30432
10  libclang_rt.asan_osx_dynamic.dylib  0x00000001014f64c4 __asan_on_error + 1512
11  libclang_rt.asan_osx_dynamic.dylib  0x00000001014f577c __asan_unpoison_intra_object_redzone + 15012
12  libclang_rt.asan_osx_dynamic.dylib  0x00000001014f6a10 __asan_report_load1 + 60
13  libcontent.dylib                    0x00000003349994b8 content::WebUIMessageHandler::IsJavascriptAllowed() + 104
14  libchrome_dll.dylib                 0x0000000379736044 void content::WebUIMessageHandler::CallJavascriptFunction<base::Value, base::Value>(std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, base::Value const&, base::Value const&) + 372
15  libchrome_dll.dylib                 0x000000037972f1a0 void content::WebUIMessageHandler::FireWebUIListener<base::Value>(std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, base::Value const&) + 408
16  libchrome_dll.dylib                 0x0000000379aa9498 ProfilePickerHandler::OnProfileCreationFinished(bool) + 364
17  libchrome_dll.dylib                 0x0000000379ab9320 void base::internal::DecayedFunctorTraits<void (ProfilePickerHandler::*)(bool), ProfilePickerHandler*>::Invoke<void (ProfilePickerHandler::*)(bool), ProfilePickerHandler*, bool>(void (ProfilePickerHandler::*)(bool), ProfilePickerHandler*&&, bool&&) + 320
18  libchrome_dll.dylib                 0x0000000379ab9138 void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (ProfilePickerHandler::*&&)(bool), ProfilePickerHandler*>, void, 0ul>::MakeItSo<void (ProfilePickerHandler::*)(bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, bool>(void (ProfilePickerHandler::*&&)(bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, bool&&) + 408
19  libchrome_dll.dylib                 0x0000000379ab8e20 void base::internal::Invoker<base::internal::FunctorTraits<void (ProfilePickerHandler::*&&)(bool), ProfilePickerHandler*>, base::internal::BindState<true, true, false, void (ProfilePickerHandler::*)(bool), base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (bool)>::RunImpl<void (ProfilePickerHandler::*)(bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(void (ProfilePickerHandler::*&&)(bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>, bool&&) + 352
20  libchrome_dll.dylib                 0x0000000379ab8bf0 base::internal::Invoker<base::internal::FunctorTraits<void (ProfilePickerHandler::*&&)(bool), ProfilePickerHandler*>, base::internal::BindState<true, true, false, void (ProfilePickerHandler::*)(bool), base::internal::UnretainedWrapper<ProfilePickerHandler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (bool)>::RunOnce(base::internal::BindStateBase*, bool) + 304
21  libchrome_dll.dylib                 0x000000036cc59088 base::OnceCallback<void (bool)>::Run(bool) && + 552
22  libchrome_dll.dylib                 0x00000003892eb8b0 (anonymous namespace)::FinishFlowAndRunInBrowserStepController::Show(base::OnceCallback<void (bool)>, bool) + 544
23  libchrome_dll.dylib                 0x00000003892ca16c ProfileManagementFlowController::SwitchToStep(ProfileManagementFlowController::Step, bool, base::OnceCallback<void (bool)>, base::OnceCallback<void ()>) + 1216
24  libchrome_dll.dylib                 0x00000003892ee5f0 ProfileManagementFlowControllerImpl::AdvanceToNextPostIdentityStep(base::OnceCallback<void (bool)>) + 576
25  libchrome_dll.dylib                 0x0000000389310a1c void base::internal::DecayedFunctorTraits<void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*>::Invoke<void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*, base::OnceCallback<void (bool)>>(void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*&&, base::OnceCallback<void (bool)>&&) + 504
26  libchrome_dll.dylib                 0x0000000389310790 void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (ProfileManagementFlowControllerImpl::*&&)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*>, void, 0ul>::MakeItSo<void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, base::OnceCallback<void (bool)>>(void (ProfileManagementFlowControllerImpl::*&&)(base::OnceCallback<void (bool)>), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, base::OnceCallback<void (bool)>&&) + 408
27  libchrome_dll.dylib                 0x0000000389310478 void base::internal::Invoker<base::internal::FunctorTraits<void (ProfileManagementFlowControllerImpl::*&&)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*>, base::internal::BindState<true, true, false, void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (base::OnceCallback<void (bool)>)>::RunImpl<void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(void (ProfileManagementFlowControllerImpl::*&&)(base::OnceCallback<void (bool)>), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>, base::OnceCallback<void (bool)>&&) + 352
28  libchrome_dll.dylib                 0x000000038931028c base::internal::Invoker<base::internal::FunctorTraits<void (ProfileManagementFlowControllerImpl::*&&)(base::OnceCallback<void (bool)>), ProfilePickerFlowController*>, base::internal::BindState<true, true, false, void (ProfileManagementFlowControllerImpl::*)(base::OnceCallback<void (bool)>), base::internal::UnretainedWrapper<ProfilePickerFlowController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (base::OnceCallback<void (bool)>)>::RunOnce(base::internal::BindStateBase*, base::OnceCallback<void (bool)>&&) + 52
29  libchrome_dll.dylib                 0x00000003892e83d0 base::OnceCallback<void (base::OnceCallback<void (bool)>)>::Run(base::OnceCallback<void (bool)>) && + 600
30  libchrome_dll.dylib                 0x00000003892e78ec (anonymous namespace)::SearchEngineChoiceStepController::Show(base::OnceCallback<void (bool)>, bool) + 820
31  libchrome_dll.dylib                 0x00000003892ca16c ProfileManagementFlowController::SwitchToStep(ProfileManagementFlowController::Step, bool, base::OnceCallback<void (bool)>, base::OnceCallback<void ()>) + 1216
32  libchrome_dll.dylib                 0x00000003892ee5f0 ProfileManagementFlowControllerImpl::AdvanceToNextPostIdentityStep(base::OnceCallback<void (bool)>) + 576
33  libchrome_dll.dylib                 0x00000003892ee2ac ProfileManagementFlowControllerImpl::SwitchToPostIdentitySteps(base::StrongAlias<PostHostClearedCallbackTag, base::OnceCallback<void (Browser*)>>, base::OnceCallback<void (bool)>) + 668
34  libchrome_dll.dylib                 0x00000003892ee9d8 ProfileManagementFlowControllerImpl::HandleIdentityStepsCompleted(Profile*, base::StrongAlias<PostHostClearedCallbackTag, base::OnceCallback<void (Browser*)>>, bool, base::OnceCallback<void (bool)>) + 712
35  libchrome_dll.dylib                 0x0000000389309374 ProfilePickerFlowController::SwitchToSignedOutPostIdentityFlow(Profile*, base::StrongAlias<PostHostClearedCallbackTag, base::OnceCallback<void (Browser*)>>, base::OnceCallback<void (bool)>) + 768
36  libchrome_dll.dylib                 0x000000038932e3ec ProfilePickerView::OnLocalProfileInitialized(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*) + 1612
37  libchrome_dll.dylib                 0x000000038933e8c4 void base::internal::DecayedFunctorTraits<void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>&&, std::__Cr::optional<unsigned int>&&, base::TimeTicks&&, base::OnceCallback<void (bool)>&&>::Invoke<void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView> const&, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*>(void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView> const&, std::__Cr::optional<unsigned int>&&, base::TimeTicks&&, base::OnceCallback<void (bool)>&&, Profile*&&) + 596
38  libchrome_dll.dylib                 0x000000038933e5c0 void base::internal::InvokeHelper<true, base::internal::FunctorTraits<void (ProfilePickerView::*&&)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>&&, std::__Cr::optional<unsigned int>&&, base::TimeTicks&&, base::OnceCallback<void (bool)>&&>, void, 0ul, 1ul, 2ul, 3ul>::MakeItSo<void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), std::__Cr::tuple<base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>, Profile*>(void (ProfilePickerView::*&&)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), std::__Cr::tuple<base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>&&, Profile*&&) + 252
39  libchrome_dll.dylib                 0x000000038933e29c void base::internal::Invoker<base::internal::FunctorTraits<void (ProfilePickerView::*&&)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>&&, std::__Cr::optional<unsigned int>&&, base::TimeTicks&&, base::OnceCallback<void (bool)>&&>, base::internal::BindState<true, true, false, void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>, void (Profile*)>::RunImpl<void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), std::__Cr::tuple<base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>, 0ul, 1ul, 2ul, 3ul>(void (ProfilePickerView::*&&)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), std::__Cr::tuple<base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>, Profile*&&) + 400
40  libchrome_dll.dylib                 0x000000038933e018 base::internal::Invoker<base::internal::FunctorTraits<void (ProfilePickerView::*&&)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>&&, std::__Cr::optional<unsigned int>&&, base::TimeTicks&&, base::OnceCallback<void (bool)>&&>, base::internal::BindState<true, true, false, void (ProfilePickerView::*)(std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>, Profile*), base::WeakPtr<ProfilePickerView>, std::__Cr::optional<unsigned int>, base::TimeTicks, base::OnceCallback<void (bool)>>, void (Profile*)>::RunOnce(base::internal::BindStateBase*, Profile*) + 304
41  libchrome_dll.dylib                 0x00000003780b0478 base::OnceCallback<void (Profile*)>::Run(Profile*) && + 548
42  libchrome_dll.dylib                 0x000000037d522e28 (anonymous namespace)::RunCallbacks(std::__Cr::vector<base::OnceCallback<void (Profile*)>, std::__Cr::allocator<base::OnceCallback<void (Profile*)>>>&, Profile*) + 432
43  libchrome_dll.dylib                 0x000000037d522a74 ProfileManager::OnProfileCreationFinished(Profile*, Profile::CreateMode, bool, bool) + 1400
44  libchrome_dll.dylib                 0x000000037d4e9088 ProfileImpl::DoFinalInit(Profile::CreateMode) + 4208
45  libchrome_dll.dylib                 0x000000037d4ef6ac ProfileImpl::OnLocaleReady(Profile::CreateMode) + 2988
46  libchrome_dll.dylib                 0x000000037d4e6d38 ProfileImpl::OnPrefsLoaded(Profile::CreateMode, bool) + 972
47  libchrome_dll.dylib                 0x000000037d4f46f8 void base::internal::DecayedFunctorTraits<void (ProfileImpl::*)(Profile::CreateMode, bool), ProfileImpl*, Profile::CreateMode&&>::Invoke<void (ProfileImpl::*)(Profile::CreateMode, bool), ProfileImpl*, Profile::CreateMode, bool>(void (ProfileImpl::*)(Profile::CreateMode, bool), ProfileImpl*&&, Profile::CreateMode&&, bool&&) + 420
48  libchrome_dll.dylib                 0x000000037d4f42f0 void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (ProfileImpl::*&&)(Profile::CreateMode, bool), ProfileImpl*, Profile::CreateMode&&>, void, 0ul, 1ul>::MakeItSo<void (ProfileImpl::*)(Profile::CreateMode, bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>, bool>(void (ProfileImpl::*&&)(Profile::CreateMode, bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>&&, bool&&) + 428
49  libchrome_dll.dylib                 0x000000037d4f3f8c void base::internal::Invoker<base::internal::FunctorTraits<void (ProfileImpl::*&&)(Profile::CreateMode, bool), ProfileImpl*, Profile::CreateMode&&>, base::internal::BindState<true, true, false, void (ProfileImpl::*)(Profile::CreateMode, bool), base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>, void (bool)>::RunImpl<void (ProfileImpl::*)(Profile::CreateMode, bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>, 0ul, 1ul>(void (ProfileImpl::*&&)(Profile::CreateMode, bool), std::__Cr::tuple<base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>, bool&&) + 368
50  libchrome_dll.dylib                 0x000000037d4f3d40 base::internal::Invoker<base::internal::FunctorTraits<void (ProfileImpl::*&&)(Profile::CreateMode, bool), ProfileImpl*, Profile::CreateMode&&>, base::internal::BindState<true, true, false, void (ProfileImpl::*)(Profile::CreateMode, bool), base::internal::UnretainedWrapper<ProfileImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, Profile::CreateMode>, void (bool)>::RunOnce(base::internal::BindStateBase*, bool) + 304
51  libcomponents_prefs.dylib           0x000000010f1ac680 base::OnceCallback<void (bool)>::Run(bool) && + 552
52  libcomponents_prefs.dylib           0x000000010f1e713c PrefNotifierImpl::OnInitializationCompleted(bool) + 572
53  libcomponents_prefs.dylib           0x000000010f22bc88 PrefValueStore::CheckInitializationCompleted() + 800
54  libcomponents_prefs.dylib           0x000000010f22b6f0 PrefValueStore::OnInitializationCompleted(PrefValueStore::PrefStoreType, bool) + 372
55  libcomponents_prefs.dylib           0x000000010f22b570 PrefValueStore::PrefStoreKeeper::OnInitializationCompleted(bool) + 160
56  libpolicy_component.dylib           0x0000000174707da0 policy::ConfigurationPolicyPrefStore::OnPolicyServiceInitialized(policy::PolicyDomain) + 672
57  libpolicy_component.dylib           0x0000000174a18b6c policy::PolicyServiceImpl::MaybeNotifyPolicyDomainStatusChange(std::__Cr::vector<policy::PolicyDomain, std::__Cr::allocator<policy::PolicyDomain>> const&) + 1900
58  libpolicy_component.dylib           0x0000000174a1b764 policy::PolicyServiceImpl::NotifyPoliciesUpdated(policy::PolicyBundle const&) + 1252
59  libpolicy_component.dylib           0x0000000174a1351c policy::PolicyServiceImpl::MergeAndTriggerUpdates() + 1008
60  libpolicy_component.dylib           0x0000000174a21118 void base::internal::DecayedFunctorTraits<void (policy::PolicyServiceImpl::*)(), base::WeakPtr<policy::PolicyServiceImpl>&&>::Invoke<void (policy::PolicyServiceImpl::*)(), base::WeakPtr<policy::PolicyServiceImpl> const&>(void (policy::PolicyServiceImpl::*)(), base::WeakPtr<policy::PolicyServiceImpl> const&) + 204
61  libpolicy_component.dylib           0x0000000174a20fc8 void base::internal::InvokeHelper<true, base::internal::FunctorTraits<void (policy::PolicyServiceImpl::*&&)(), base::WeakPtr<policy::PolicyServiceImpl>&&>, void, 0ul>::MakeItSo<void (policy::PolicyServiceImpl::*)(), std::__Cr::tuple<base::WeakPtr<policy::PolicyServiceImpl>>>(void (policy::PolicyServiceImpl::*&&)(), std::__Cr::tuple<base::WeakPtr<policy::PolicyServiceImpl>>&&) + 164
62  libpolicy_component.dylib           0x0000000174a20db4 void base::internal::Invoker<base::internal::FunctorTraits<void (policy::PolicyServiceImpl::*&&)(), base::WeakPtr<policy::PolicyServiceImpl>&&>, base::internal::BindState<true, true, false, void (policy::PolicyServiceImpl::*)(), base::WeakPtr<policy::PolicyServiceImpl>>, void ()>::RunImpl<void (policy::PolicyServiceImpl::*)(), std::__Cr::tuple<base::WeakPtr<policy::PolicyServiceImpl>>, 0ul>(void (policy::PolicyServiceImpl::*&&)(), std::__Cr::tuple<base::WeakPtr<policy::PolicyServiceImpl>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) + 340
63  libpolicy_component.dylib           0x0000000174a20c08 base::internal::Invoker<base::internal::FunctorTraits<void (policy::PolicyServiceImpl::*&&)(), base::WeakPtr<policy::PolicyServiceImpl>&&>, base::internal::BindState<true, true, false, void (policy::PolicyServiceImpl::*)(), base::WeakPtr<policy::PolicyServiceImpl>>, void ()>::RunOnce(base::internal::BindStateBase*) + 44
64  libbase.dylib                       0x0000000106098090 base::OnceCallback<void ()>::Run() && + 540
65  libbase.dylib                       0x00000001065b87e0 base::TaskAnnotator::RunTaskImpl(base::PendingTask&) + 1312
66  libbase.dylib                       0x00000001066e399c _ZN4base13TaskAnnotator7RunTaskIJZNS_16sequence_manager8internal35ThreadControllerWithMessagePumpImpl10DoWorkImplEPNS_7LazyNowEE3$_3EEEvN8perfetto12StaticStringERNS_11PendingTaskEDpOT_ + 536
67  libbase.dylib                       0x00000001066e2848 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) + 3284
68  libbase.dylib                       0x00000001066e15e4 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() + 636
69  libbase.dylib                       0x0000000106a5609c base::MessagePumpCFRunLoopBase::RunWork() + 696
70  libbase.dylib                       0x0000000106a563c4 ___ZN4base24MessagePumpCFRunLoopBase13RunWorkSourceEPv_block_invoke + 92
71  libbase.dylib                       0x0000000106a2afb4 base::apple::CallWithEHFrame(void () block_pointer) + 16
72  libbase.dylib                       0x0000000106a5322c base::MessagePumpCFRunLoopBase::RunWorkSource(void*) + 360
73  CoreFoundation                      0x000000018c6fa414 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 28
74  CoreFoundation                      0x000000018c6fa3a8 __CFRunLoopDoSource0 + 176
75  CoreFoundation                      0x000000018c6fa10c __CFRunLoopDoSources0 + 244
76  CoreFoundation                      0x000000018c6f8cf8 __CFRunLoopRun + 840
77  CoreFoundation                      0x000000018c6f8334 CFRunLoopRunSpecific + 572
78  HIToolbox                           0x0000000197b310cc RunCurrentEventLoopInMode + 292
79  HIToolbox                           0x0000000197b36d1c ReceiveNextEventCommon + 220
80  HIToolbox                           0x0000000197b37020 _BlockUntilNextEventMatchingListInModeWithFilter + 76
81  AppKit                              0x000000019023ca70 _DPSNextEvent + 660
82  AppKit                              0x0000000190b627b8 -[NSApplication(NSEventRouting) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 688
83  libchrome_dll.dylib                 0x000000037c426f6c __71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke + 504
84  libbase.dylib                       0x0000000106a2afb4 base::apple::CallWithEHFrame(void () block_pointer) + 16
85  libchrome_dll.dylib                 0x000000037c426a54 -[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 808
86  AppKit                              0x000000019022fb7c -[NSApplication run] + 480
87  libbase.dylib                       0x0000000106a59428 base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) + 764
88  libbase.dylib                       0x0000000106a514a8 base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) + 904
89  libbase.dylib                       0x00000001066e4dc0 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) + 1936
90  libbase.dylib                       0x000000010644d8bc base::RunLoop::Run(base::Location const&) + 1540
91  libcontent.dylib                    0x000000033046e6b4 content::BrowserMainLoop::RunMainMessageLoop() + 1004
92  libcontent.dylib                    0x00000003304a4124 content::BrowserMainRunnerImpl::Run() + 796
93  libcontent.dylib                    0x0000000330460018 content::BrowserMain(content::MainFunctionParams) + 876
94  libcontent.dylib                    0x000000033779a1ec content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) + 1044
95  libcontent.dylib                    0x000000033779f74c content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) + 4244
96  libcontent.dylib                    0x000000033779e334 content::ContentMainRunnerImpl::Run() + 2504
97  libcontent.dylib                    0x0000000337795020 content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) + 1792
98  libcontent.dylib                    0x0000000337796238 content::ContentMain(content::ContentMainParams) + 356
99  libchrome_dll.dylib                 0x000000036cbc4328 ChromeMain + 1524
100 Chromium                            0x0000000100830d48 main + 960
101 dyld                                0x000000018c290274 start + 2840
[end of stack trace]