=================================================================
==541119==ERROR: AddressSanitizer: heap-use-after-free on address 0x6f6b11eb62b0 at pc 0x564a1816bce9 bp 0x7fffcb665cb0 sp 0x7fffcb665ca8
READ of size 8 at 0x6f6b11eb62b0 thread T0 (chrome)
    #0 0x564a1816bce8 in Lookup<WTF::IdentityHashTranslator<WTF::HashTraits<int> >, int> third_party/blink/renderer/platform/wtf/hash_table.h:1045:28
    #1 0x564a1816bce8 in Contains<WTF::IdentityHashTranslator<WTF::HashTraits<int> >, int> third_party/blink/renderer/platform/wtf/hash_table.h:1458:10
    #2 0x564a1816bce8 in Contains third_party/blink/renderer/platform/wtf/hash_table.h:737:12
    #3 0x564a1816bce8 in Contains third_party/blink/renderer/platform/wtf/hash_map.h:461:16
    #4 0x564a1816bce8 in blink::LegacyDOMSnapshotAgent::VisitNode(blink::Node*, bool, bool) third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc:189:24
    #5 0x564a1816e4a1 in blink::LegacyDOMSnapshotAgent::VisitContainerChildren(blink::Node*, bool, bool) third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc:323:28
    #6 0x564a1816afc7 in blink::LegacyDOMSnapshotAgent::VisitNode(blink::Node*, bool, bool) third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc:303:32
    #7 0x564a18169811 in blink::LegacyDOMSnapshotAgent::VisitNode(blink::Node*, bool, bool) third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc:243:40
    #8 0x564a1816e4a1 in blink::LegacyDOMSnapshotAgent::VisitContainerChildren(blink::Node*, bool, bool) third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc:323:28
    #9 0x564a1816afc7 in blink::LegacyDOMSnapshotAgent::VisitNode(blink::Node*, bool, bool) third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc:303:32
    #10 0x564a1816e4a1 in blink::LegacyDOMSnapshotAgent::VisitContainerChildren(blink::Node*, bool, bool) third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc:323:28
    #11 0x564a1816afc7 in blink::LegacyDOMSnapshotAgent::VisitNode(blink::Node*, bool, bool) third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc:303:32
    #12 0x564a1816e4a1 in blink::LegacyDOMSnapshotAgent::VisitContainerChildren(blink::Node*, bool, bool) third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc:323:28
    #13 0x564a1816afc7 in blink::LegacyDOMSnapshotAgent::VisitNode(blink::Node*, bool, bool) third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc:303:32
    #14 0x564a181670cc in blink::LegacyDOMSnapshotAgent::GetSnapshot(blink::Document*, std::__Cr::unique_ptr<std::__Cr::vector<WTF::String, std::__Cr::allocator<WTF::String>>, std::__Cr::default_delete<std::__Cr::vector<WTF::String, std::__Cr::allocator<WTF::String>>>>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::unique_ptr<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>>>, std::__Cr::default_delete<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>>>>>*, std::__Cr::unique_ptr<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>>>, std::__Cr::default_delete<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>>>>>*, std::__Cr::unique_ptr<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>>>, std::__Cr::default_delete<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>>>>>*) third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc:143:3
    #15 0x564a181045da in blink::InspectorDOMSnapshotAgent::getSnapshot(std::__Cr::unique_ptr<std::__Cr::vector<WTF::String, std::__Cr::allocator<WTF::String>>, std::__Cr::default_delete<std::__Cr::vector<WTF::String, std::__Cr::allocator<WTF::String>>>>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::unique_ptr<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>>>, std::__Cr::default_delete<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>>>>>*, std::__Cr::unique_ptr<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>>>, std::__Cr::default_delete<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>>>>>*, std::__Cr::unique_ptr<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>>>, std::__Cr::default_delete<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>>>>>*) third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.cc:269:24
    #16 0x564a1810485b in non-virtual thunk to blink::InspectorDOMSnapshotAgent::getSnapshot(std::__Cr::unique_ptr<std::__Cr::vector<WTF::String, std::__Cr::allocator<WTF::String>>, std::__Cr::default_delete<std::__Cr::vector<WTF::String, std::__Cr::allocator<WTF::String>>>>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::unique_ptr<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>>>, std::__Cr::default_delete<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::DOMNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::DOMNode>>>>>>*, std::__Cr::unique_ptr<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>>>, std::__Cr::default_delete<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::LayoutTreeNode, std::__Cr::default_delete<blink::protocol::DOMSnapshot::LayoutTreeNode>>>>>>*, std::__Cr::unique_ptr<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>>>, std::__Cr::default_delete<std::__Cr::vector<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>, std::__Cr::allocator<std::__Cr::unique_ptr<blink::protocol::DOMSnapshot::ComputedStyle, std::__Cr::default_delete<blink::protocol::DOMSnapshot::ComputedStyle>>>>>>*) third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.cc
    #17 0x564a04aea836 in blink::protocol::DOMSnapshot::DomainDispatcherImpl::getSnapshot(crdtp::Dispatchable const&) gen/third_party/blink/renderer/core/inspector/protocol/dom_snapshot.cc:452:44
    #18 0x564a10fff670 in operator() third_party/libc++/src/include/__functional/function.h:722:12
    #19 0x564a10fff670 in operator() third_party/libc++/src/include/__functional/function.h:995:10
    #20 0x564a10fff670 in crdtp::UberDispatcher::DispatchResult::Run() third_party/inspector_protocol/crdtp/dispatch.cc:509:3
    #21 0x564a181c916b in blink::DevToolsSession::DispatchProtocolCommandImpl(int, WTF::String const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) third_party/blink/renderer/core/inspector/devtools_session.cc:274:59
    #22 0x564a181c8a90 in blink::DevToolsSession::DispatchProtocolCommand(int, WTF::String const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) third_party/blink/renderer/core/inspector/devtools_session.cc:238:10
    #23 0x564a03fc05f5 in blink::mojom::blink::DevToolsSessionStubDispatch::Accept(blink::mojom::blink::DevToolsSession*, mojo::Message*) gen/third_party/blink/public/mojom/devtools/devtools_agent.mojom-blink.cc:1376:13
    #24 0x564a081e1a5a in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1051:54
    #25 0x564a081fd49a in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:43:19
    #26 0x564a081e73de in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:724:20
    #27 0x564a0aad687e in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1202:24
    #28 0x564a0aad8783 in Invoke<void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification> base/functional/bind_internal.h:729:12
    #29 0x564a0aad8783 in MakeItSo<void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), std::__Cr::tuple<scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification> > base/functional/bind_internal.h:921:12
    #30 0x564a0aad8783 in RunImpl<void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), std::__Cr::tuple<scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, 0UL, 1UL, 2UL> base/functional/bind_internal.h:1058:14
    #31 0x564a0aad8783 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:971:12
    #32 0x564a083e91b2 in Run base/functional/callback.h:156:12
    #33 0x564a083e91b2 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/task/common/task_annotator.cc:210:34
    #34 0x564a084533d8 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:472:11)> base/task/common/task_annotator.h:106:5
    #35 0x564a084533d8 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:470:23
    #36 0x564a0845217a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #37 0x564a0845410a in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc
    #38 0x564a082cb251 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #39 0x564a08454ccc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:643:12
    #40 0x564a0837776f in base::RunLoop::Run(base::Location const&) base/run_loop.cc:134:14
    #41 0x564a1f967671 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:351:16
    #42 0x564a0548a414 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:678:14
    #43 0x564a0548b2dd in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:782:12
    #44 0x564a0548dac5 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1145:10
    #45 0x564a054887ad in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:353:36
    #46 0x564a05488d9b in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:366:10
    #47 0x5649f3a0dbbf in ChromeMain chrome/app/chrome_main.cc:222:12
    #48 0x733b2022a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #49 0x733b2022a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #50 0x5649f3933029 in _start (/mnt/EXTRADISK/asan_software/asan_chrome/chromium-1412674-linux-asan/chrome+0xee68029) (BuildId: 3025975f371efa58)

0x6f6b11eb62b0 is located 0 bytes inside of 24-byte region [0x6f6b11eb62b0,0x6f6b11eb62c8)
freed by thread T0 (chrome) here:
    #0 0x5649f39d2476 in free /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3
    #1 0x564a1810420d in Free third_party/blink/renderer/platform/wtf/allocator/partition_allocator.h:94:37
    #2 0x564a1810420d in operator delete third_party/blink/renderer/platform/wtf/hash_map.h:91:3
    #3 0x564a1810420d in operator() third_party/libc++/src/include/__memory/unique_ptr.h:78:5
    #4 0x564a1810420d in reset third_party/libc++/src/include/__memory/unique_ptr.h:300:7
    #5 0x564a1810420d in blink::InspectorDOMSnapshotAgent::disable() third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.cc:249:19
    #6 0x564a18113b9b in blink::InspectorBaseAgent<blink::protocol::DOMSnapshot::Metainfo>::Dispose() third_party/blink/renderer/core/inspector/inspector_base_agent.h:82:5
    #7 0x564a181c72c9 in blink::DevToolsSession::Detach() third_party/blink/renderer/core/inspector/devtools_session.cc:219:21
    #8 0x564a181d32f2 in Invoke<void (blink::DevToolsSession::*)(), const cppgc::internal::BasicPersistent<blink::DevToolsSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> &> base/functional/bind_internal.h:729:12
    #9 0x564a181d32f2 in MakeItSo<void (blink::DevToolsSession::*)(), std::__Cr::tuple<cppgc::internal::BasicPersistent<blink::DevToolsSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> > > base/functional/bind_internal.h:945:5
    #10 0x564a181d32f2 in RunImpl<void (blink::DevToolsSession::*)(), std::__Cr::tuple<cppgc::internal::BasicPersistent<blink::DevToolsSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> >, 0UL> base/functional/bind_internal.h:1058:14
    #11 0x564a181d32f2 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::DevToolsSession::*&&)(), cppgc::internal::BasicPersistent<blink::DevToolsSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&>, base::internal::BindState<true, true, false, void (blink::DevToolsSession::*)(), cppgc::internal::BasicPersistent<blink::DevToolsSession, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:971:12
    #12 0x564a081e7b88 in Run base/functional/callback.h:156:12
    #13 0x564a081e7b88 in mojo::InterfaceEndpointClient::NotifyError(std::__Cr::optional<mojo::DisconnectReason> const&) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:762:31
    #14 0x564a0aad3c8c in IPC::ChannelAssociatedGroupController::NotifyEndpointOfError(IPC::ChannelAssociatedGroupController::Endpoint*, bool) ipc/ipc_mojo_bootstrap.cc:980:15
    #15 0x564a0aad415b in IPC::ChannelAssociatedGroupController::NotifyEndpointOfErrorOnEndpointThread(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>) ipc/ipc_mojo_bootstrap.cc:1004:5
    #16 0x564a0aad449d in Invoke<void (IPC::ChannelAssociatedGroupController::*)(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>), scoped_refptr<IPC::ChannelAssociatedGroupController>, unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1> > base/functional/bind_internal.h:729:12
    #17 0x564a0aad449d in MakeItSo<void (IPC::ChannelAssociatedGroupController::*)(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>), std::__Cr::tuple<scoped_refptr<IPC::ChannelAssociatedGroupController>, unsigned int, base::internal::UnretainedWrapper<IPC::ChannelAssociatedGroupController::Endpoint, base::unretained_traits::MayDangle, (partition_alloc::internal::RawPtrTraits)0> > > base/functional/bind_internal.h:921:12
    #18 0x564a0aad449d in void base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>), IPC::ChannelAssociatedGroupController*&&, unsigned int&&, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>), scoped_refptr<IPC::ChannelAssociatedGroupController>, unsigned int, base::internal::UnretainedWrapper<IPC::ChannelAssociatedGroupController::Endpoint, base::unretained_traits::MayDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<void (IPC::ChannelAssociatedGroupController::*)(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>), std::__Cr::tuple<scoped_refptr<IPC::ChannelAssociatedGroupController>, unsigned int, base::internal::UnretainedWrapper<IPC::ChannelAssociatedGroupController::Endpoint, base::unretained_traits::MayDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul, 1ul, 2ul>(void (IPC::ChannelAssociatedGroupController::*&&)(unsigned int, base::raw_ptr<IPC::ChannelAssociatedGroupController::Endpoint, (partition_alloc::internal::RawPtrTraits)1>), std::__Cr::tuple<scoped_refptr<IPC::ChannelAssociatedGroupController>, unsigned int, base::internal::UnretainedWrapper<IPC::ChannelAssociatedGroupController::Endpoint, base::unretained_traits::MayDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul, 2ul>) base/functional/bind_internal.h:1058:14
    #19 0x564a083e91b2 in Run base/functional/callback.h:156:12
    #20 0x564a083e91b2 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/task/common/task_annotator.cc:210:34
    #21 0x564a084533d8 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:472:11)> base/task/common/task_annotator.h:106:5
    #22 0x564a084533d8 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:470:23
    #23 0x564a0845217a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #24 0x564a0845410a in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc
    #25 0x564a082cb251 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #26 0x564a08454d51 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #27 0x564a0837776f in base::RunLoop::Run(base::Location const&) base/run_loop.cc:134:14
    #28 0x564a1f92594d in content::(anonymous namespace)::NestedMessageLoopRunnerImpl::Run() content/child/blink_platform_impl.cc:88:14
    #29 0x564a1aef0071 in blink::ClientMessageLoopAdapter::RunLoop(blink::WebLocalFrameImpl*) third_party/blink/renderer/core/exported/web_dev_tools_agent_impl.cc:264:20
    #30 0x5649fbf4108c in v8_inspector::V8Debugger::handleProgramBreak(v8::Local<v8::Context>, v8::Local<v8::Value>, std::__Cr::vector<int, std::__Cr::allocator<int>> const&, v8::base::EnumSet<v8::debug::BreakReason, int>, v8::debug::ExceptionType, bool) v8/src/inspector/v8-debugger.cc:551:28
    #31 0x5649fbf41ee3 in v8_inspector::V8Debugger::ExceptionThrown(v8::Local<v8::Context>, v8::Local<v8::Value>, v8::Local<v8::Value>, bool, v8::debug::ExceptionType) v8/src/inspector/v8-debugger.cc:686:3
    #32 0x5649f9a4cb08 in v8::internal::Debug::OnException(v8::internal::DirectHandle<v8::internal::Object>, v8::internal::MaybeDirectHandle<v8::internal::JSPromise>, v8::debug::ExceptionType) v8/src/debug/debug.cc:2598:22
    #33 0x5649f9a4b414 in v8::internal::Debug::OnThrow(v8::internal::DirectHandle<v8::internal::Object>) v8/src/debug/debug.cc:2459:5
    #34 0x5649f9b54345 in v8::internal::Isolate::Throw(v8::internal::Tagged<v8::internal::Object>, v8::internal::MessageLocation*) v8/src/execution/isolate.cc:2148:62
    #35 0x5649fa099146 in v8::internal::IC::ReferenceError(v8::internal::Handle<v8::internal::Name>) v8/src/ic/ic.cc:308:3
    #36 0x5649fa09b901 in v8::internal::LoadIC::Load(v8::internal::Handle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::Handle<v8::internal::Name>, bool, v8::internal::DirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>) v8/src/ic/ic.cc:474:10
    #37 0x5649fa0beb3c in __RT_impl_Runtime_LoadNoFeedbackIC_Miss v8/src/ic/ic.cc:2826:3
    #38 0x5649fa0beb3c in v8::internal::Runtime_LoadNoFeedbackIC_Miss(int, unsigned long*, v8::internal::Isolate*) v8/src/ic/ic.cc:2811:1
    #39 0x5649fdd26975 in Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit setup-isolate-deserialize.cc
    #40 0x5649fde15339 in Builtins_LdaGlobalHandler setup-isolate-deserialize.cc
    #41 0x5649fdc7fc74 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc
    #42 0x5649fdc7d75b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc

previously allocated by thread T0 (chrome) here:
    #0 0x5649f39d2714 in malloc /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3
    #1 0x564a0862510b in AllocInternal<(partition_alloc::internal::AllocFlags)0> base/allocator/partition_allocator/src/partition_alloc/partition_root.h:2134:51
    #2 0x564a0862510b in AllocInline<(partition_alloc::internal::AllocFlags)0> base/allocator/partition_allocator/src/partition_alloc/partition_root.h:539:12
    #3 0x564a0862510b in void* partition_alloc::PartitionRoot::Alloc<(partition_alloc::internal::AllocFlags)0>(unsigned long, char const*) base/allocator/partition_allocator/src/partition_alloc/partition_root.h:533:12
    #4 0x564a18103cc1 in Malloc<void *, WTF::HashMap<int, WTF::String, WTF::HashTraits<int>, WTF::HashTraits<WTF::String>, WTF::PartitionAllocator> > third_party/blink/renderer/platform/wtf/allocator/partition_allocator.h:82:9
    #5 0x564a18103cc1 in operator new third_party/blink/renderer/platform/wtf/hash_map.h:91:3
    #6 0x564a18103cc1 in make_unique<WTF::HashMap<int, WTF::String, WTF::HashTraits<int>, WTF::HashTraits<WTF::String>, WTF::PartitionAllocator>, 0> third_party/libc++/src/include/__memory/unique_ptr.h:767:26
    #7 0x564a18103cc1 in blink::InspectorDOMSnapshotAgent::EnableAndReset() third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.cc:228:21
    #8 0x564a18103fd6 in enable third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.cc:239:5
    #9 0x564a18103fd6 in non-virtual thunk to blink::InspectorDOMSnapshotAgent::enable() third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.cc
    #10 0x564a04aea27a in blink::protocol::DOMSnapshot::DomainDispatcherImpl::enable(crdtp::Dispatchable const&) gen/third_party/blink/renderer/core/inspector/protocol/dom_snapshot.cc:408:44
    #11 0x564a10fff670 in operator() third_party/libc++/src/include/__functional/function.h:722:12
    #12 0x564a10fff670 in operator() third_party/libc++/src/include/__functional/function.h:995:10
    #13 0x564a10fff670 in crdtp::UberDispatcher::DispatchResult::Run() third_party/inspector_protocol/crdtp/dispatch.cc:509:3
    #14 0x564a181c916b in blink::DevToolsSession::DispatchProtocolCommandImpl(int, WTF::String const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) third_party/blink/renderer/core/inspector/devtools_session.cc:274:59
    #15 0x564a181c8a90 in blink::DevToolsSession::DispatchProtocolCommand(int, WTF::String const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) third_party/blink/renderer/core/inspector/devtools_session.cc:238:10
    #16 0x564a03fc05f5 in blink::mojom::blink::DevToolsSessionStubDispatch::Accept(blink::mojom::blink::DevToolsSession*, mojo::Message*) gen/third_party/blink/public/mojom/devtools/devtools_agent.mojom-blink.cc:1376:13
    #17 0x564a081e1a5a in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1051:54
    #18 0x564a081fd49a in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:43:19
    #19 0x564a081e73de in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:724:20
    #20 0x564a0aad687e in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1202:24
    #21 0x564a0aad8783 in Invoke<void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification> base/functional/bind_internal.h:729:12
    #22 0x564a0aad8783 in MakeItSo<void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), std::__Cr::tuple<scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification> > base/functional/bind_internal.h:921:12
    #23 0x564a0aad8783 in RunImpl<void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), std::__Cr::tuple<scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, 0UL, 1UL, 2UL> base/functional/bind_internal.h:1058:14
    #24 0x564a0aad8783 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:971:12
    #25 0x564a083e91b2 in Run base/functional/callback.h:156:12
    #26 0x564a083e91b2 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/task/common/task_annotator.cc:210:34
    #27 0x564a084533d8 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:472:11)> base/task/common/task_annotator.h:106:5
    #28 0x564a084533d8 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:470:23
    #29 0x564a0845217a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #30 0x564a0845410a in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc
    #31 0x564a082cb251 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #32 0x564a08454ccc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:643:12
    #33 0x564a0837776f in base::RunLoop::Run(base::Location const&) base/run_loop.cc:134:14
    #34 0x564a1f967671 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:351:16
    #35 0x564a0548a414 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:678:14
    #36 0x564a0548b2dd in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:782:12
    #37 0x564a0548dac5 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1145:10
    #38 0x564a054887ad in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:353:36
    #39 0x564a05488d9b in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:366:10
    #40 0x5649f3a0dbbf in ChromeMain chrome/app/chrome_main.cc:222:12
    #41 0x733b2022a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #42 0x733b2022a28a in __libc_start_main csu/../csu/libc-start.c:360:3

SUMMARY: AddressSanitizer: heap-use-after-free third_party/blink/renderer/platform/wtf/hash_table.h:1045:28 in Lookup<WTF::IdentityHashTranslator<WTF::HashTraits<int> >, int>
Shadow bytes around the buggy address:
  0x6f6b11eb6000: f7 fa fd fd fd fd f7 fa 00 00 00 00 f7 fa fd fd
  0x6f6b11eb6080: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
  0x6f6b11eb6100: fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd
  0x6f6b11eb6180: f7 fa fd fd fd fd f7 fa 00 00 00 fa f7 fa fd fd
  0x6f6b11eb6200: fd fa f7 fa fd fd fd fa f7 fa fd fd fd fa f7 fa
=>0x6f6b11eb6280: fd fd fd fd f7 fa[fd]fd fd fa f7 fa fd fd fd fa
  0x6f6b11eb6300: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x6f6b11eb6380: fd fa f7 fa fd fd fd fa f7 fa fd fd fd fd f7 fa
  0x6f6b11eb6400: fd fd fd fd f7 fa fd fd fd fa f7 fa fd fd fd fa
  0x6f6b11eb6480: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa 00 00
  0x6f6b11eb6500: 00 fa f7 fa fd fd fd fa f7 fa fd fd fd fa f7 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==541119==ADDITIONAL INFO

==541119==Note: Please include this section with the ASan report.
Task trace:
    #0 0x564a0aac8432 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1141:13


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=540883 --enable-crash-reporter=, --user-data-dir=/tmp/noexist0 --change-stack-guard-on-fork=enable --no-sandbox --file-url-path-alias=/gen=/mnt/EXTRADISK/asan_software/asan_chrome/chromium-1412674-linux-asan/gen --ozone-platform=x11 --disable-gpu-compositing --lang=ja --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1739159878126648 --launch-time-ticks=12129641813 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,7334258895931672319,7837061557850994644,2097152 --field-trial-handle=3,i,14212318432972717101,1932678443151971568,262144 --variations-seed-version`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==541119==END OF ADDITIONAL INFO
==541119==ABORTING