=================================================================
==2435984==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d80fca57900 at pc 0x55e9d85958b6 bp 0x7ffc9e486590 sp 0x7ffc9e486588
READ of size 8 at 0x7d80fca57900 thread T0 (chrome)
    #0 0x55e9d85958b5 in UsbChooserController::DisplayDevice(device::mojom::UsbDeviceInfo const&) const chrome/browser/usb/usb_chooser_controller.cc:285:28
    #1 0x55e9d8592945 in UsbChooserController::GotUsbDeviceList(std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>) chrome/browser/usb/usb_chooser_controller.cc:252:9
    #2 0x55e9d85968d1 in void base::internal::DecayedFunctorTraits<void (UsbChooserController::*)(std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>), base::WeakPtr<UsbChooserController>&&>::Invoke<void (UsbChooserController::*)(std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>), base::WeakPtr<UsbChooserController> const&, std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>>(void (UsbChooserController::*)(std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>), base::WeakPtr<UsbChooserController> const&, std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>&&) base/functional/bind_internal.h:731:12
    #3 0x55e9d22d31a1 in Run base/functional/callback.h:156:12
    #4 0x55e9d22d31a1 in void base::internal::DecayedFunctorTraits<base::OnceCallback<void (std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>)>, std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>&&>::Invoke<base::OnceCallback<void (std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>)>, std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>>(base::OnceCallback<void (std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>)>&&, std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>&&) base/functional/bind_internal.h:806:49
    #5 0x55e9d91fb036 in Run base/functional/callback.h:156:12
    #6 0x55e9d91fb036 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/task/common/task_annotator.cc:209:34
    #7 0x55e9d9267ec0 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:458:11)> base/task/common/task_annotator.h:106:5
    #8 0x55e9d9267ec0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:456:23
    #9 0x55e9d9266d67 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #10 0x55e9d9268b5a in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc
    #11 0x55e9d93db14e in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:656:46
    #12 0x55e9d93ddd55 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:275:43
    #13 0x7f610e1ff81e  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5a81e) (BuildId: a65da28c5ecd4721b2388f44c059f41f74ce98ea)

0x7d80fca57900 is located 0 bytes inside of 5832-byte region [0x7d80fca57900,0x7d80fca58fc8)
freed by thread T0 (chrome) here:
    #0 0x55e9c42b96fd in operator delete(void*) /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cpp:143:3
    #1 0x55e9d0747084 in operator() third_party/libc++/src/include/__memory/unique_ptr.h:76:5
    #2 0x55e9d0747084 in reset third_party/libc++/src/include/__memory/unique_ptr.h:287:7
    #3 0x55e9d0747084 in ~unique_ptr third_party/libc++/src/include/__memory/unique_ptr.h:256:71
    #4 0x55e9d0747084 in content::RenderFrameHostManager::~RenderFrameHostManager() content/browser/renderer_host/render_frame_host_manager.cc:621:3
    #5 0x55e9d030ce4a in content::FrameTreeNode::~FrameTreeNode() content/browser/renderer_host/frame_tree_node.cc:324:1
    #6 0x55e9d02f2d1b in content::FrameTree::~FrameTree() content/browser/renderer_host/frame_tree.cc:231:1
    #7 0x55e9d0e39fe4 in content::WebContentsImpl::~WebContentsImpl() content/browser/web_contents/web_contents_impl.cc:1502:1
    #8 0x55e9d0e3ce13 in content::WebContentsImpl::~WebContentsImpl() content/browser/web_contents/web_contents_impl.cc:1381:37
    #9 0x55e9d642a945 in operator() third_party/libc++/src/include/__memory/unique_ptr.h:76:5
    #10 0x55e9d642a945 in reset third_party/libc++/src/include/__memory/unique_ptr.h:287:7
    #11 0x55e9d642a945 in ~unique_ptr third_party/libc++/src/include/__memory/unique_ptr.h:256:71
    #12 0x55e9d642a945 in tabs::TabModel::~TabModel() chrome/browser/ui/tabs/tab_model.cc:81:1
    #13 0x55e9d6445980 in operator() third_party/libc++/src/include/__memory/unique_ptr.h:76:5
    #14 0x55e9d6445980 in reset third_party/libc++/src/include/__memory/unique_ptr.h:287:7
    #15 0x55e9d6445980 in TabStripModel::SendDetachWebContentsNotifications(TabStripModel::DetachNotifications*) chrome/browser/ui/tabs/tab_strip_model.cc:701:15
    #16 0x55e9d6453a40 in TabStripModel::CloseTabs(base::span<content::WebContents* const, 18446744073709551615ul, content::WebContents* const*>, unsigned int) chrome/browser/ui/tabs/tab_strip_model.cc:2639:5
    #17 0x55e9d6455342 in TabStripModel::CloseWebContentsAt(int, unsigned int) chrome/browser/ui/tabs/tab_strip_model.cc:971:3
    #18 0x55e9ef76e13b in BrowserTabStripController::CloseTab(int) chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc:458:11
    #19 0x55e9ef81f910 in TabStrip::CloseTabInternal(int, CloseTabSource) chrome/browser/ui/views/tabs/tab_strip.cc:2249:16
    #20 0x55e9ef76dac8 in Run base/functional/callback.h:156:12
    #21 0x55e9ef76dac8 in BrowserTabStripController::OnCloseTab(int, CloseTabSource, base::OnceCallback<void (CloseTabSource)>) chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc:439:25
    #22 0x55e9ef81f465 in TabStrip::CloseTab(Tab*, CloseTabSource) chrome/browser/ui/views/tabs/tab_strip.cc:1641:18
    #23 0x55e9ef7c7832 in Tab::CloseButtonPressed(ui::Event const&) chrome/browser/ui/views/tabs/tab.cc:1242:16
    #24 0x55e9db9c9baf in base::RepeatingCallback<void (ui::Event const&)>::Run(ui::Event const&) const & base/functional/callback.h:344:12
    #25 0x55e9e0e21be8 in __visit_alt<std::__Cr::__variant_detail::__visitation::__variant::__value_visitor<base::Overloaded<(lambda at ../../ui/views/controls/button/button.cc:134:11), (lambda at ../../ui/views/controls/button/button.cc:135:11), (lambda at ../../ui/views/controls/button/button.cc:136:11)> >, std::__Cr::__variant_detail::__impl<base::OnceCallback<void ()>, base::RepeatingCallback<void ()>, base::RepeatingCallback<void (const ui::Event &)> > &> third_party/libc++/src/include/variant:501:12
    #26 0x55e9e0e21be8 in __visit_alt<std::__Cr::__variant_detail::__visitation::__variant::__value_visitor<base::Overloaded<(lambda at ../../ui/views/controls/button/button.cc:134:11), (lambda at ../../ui/views/controls/button/button.cc:135:11), (lambda at ../../ui/views/controls/button/button.cc:136:11)> >, std::__Cr::variant<base::OnceCallback<void ()>, base::RepeatingCallback<void ()>, base::RepeatingCallback<void (const ui::Event &)> > &> third_party/libc++/src/include/variant:586:12
    #27 0x55e9e0e21be8 in __visit_value<base::Overloaded<(lambda at ../../ui/views/controls/button/button.cc:134:11), (lambda at ../../ui/views/controls/button/button.cc:135:11), (lambda at ../../ui/views/controls/button/button.cc:136:11)>, std::__Cr::variant<base::OnceCallback<void ()>, base::RepeatingCallback<void ()>, base::RepeatingCallback<void (const ui::Event &)> > &> third_party/libc++/src/include/variant:598:12
    #28 0x55e9e0e21be8 in visit<base::Overloaded<(lambda at ../../ui/views/controls/button/button.cc:134:11), (lambda at ../../ui/views/controls/button/button.cc:135:11), (lambda at ../../ui/views/controls/button/button.cc:136:11)>, std::__Cr::variant<base::OnceCallback<void ()>, base::RepeatingCallback<void ()>, base::RepeatingCallback<void (const ui::Event &)> > &, void> third_party/libc++/src/include/variant:1567:10
    #29 0x55e9e0e21be8 in Run ui/views/controls/button/button.cc:132:10
    #30 0x55e9e0e21be8 in views::Button::NotifyClick(ui::Event const&) ui/views/controls/button/button.cc:716:15
    #31 0x55e9e0e289cc in views::ButtonController::OnMouseReleased(ui::MouseEvent const&) ui/views/controls/button/button_controller.cc
    #32 0x55e9e0dbc78c in ui::ScopedTargetHandler::OnEvent(ui::Event*) ui/events/scoped_target_handler.cc:30:24
    #33 0x55e9dbf59221 in DispatchEvent ui/events/event_dispatcher.cc:189:12
    #34 0x55e9dbf59221 in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:138:5
    #35 0x55e9dbf58ab9 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:84:14
    #36 0x55e9dbf586ee in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:56:15
    #37 0x55e9e1052277 in views::internal::RootView::OnMouseReleased(ui::MouseEvent const&) ui/views/widget/root_view.cc:626:9
    #38 0x55e9e107b966 in views::Widget::OnMouseEvent(ui::MouseEvent*) ui/views/widget/widget.cc:2083:20
    #39 0x55e9e111f19a in views::DesktopNativeWidgetAura::OnMouseEvent(ui::MouseEvent*) ui/views/widget/desktop_aura/desktop_native_widget_aura.cc:1400:30
    #40 0x55e9dbf59221 in DispatchEvent ui/events/event_dispatcher.cc:189:12
    #41 0x55e9dbf59221 in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:138:5
    #42 0x55e9dbf58ab9 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:84:14
    #43 0x55e9dbf586ee in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:56:15
    #44 0x55e9e089bf31 in ui::EventProcessor::OnEventFromSource(ui::Event*) ui/events/event_processor.cc:72:19
    #45 0x55e9dbf5fbfd in ui::EventSource::DeliverEventToSink(ui::Event*) ui/events/event_source.cc:119:16

previously allocated by thread T0 (chrome) here:
    #0 0x55e9c42b8e9d in operator new(unsigned long) /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cpp:86:3
    #1 0x55e9d0616956 in operator new content/public/browser/render_frame_host.h:149:3
    #2 0x55e9d0616956 in content::RenderFrameHostFactory::Create(content::SiteInstance*, scoped_refptr<content::RenderViewHostImpl>, content::RenderFrameHostDelegate*, content::FrameTree*, content::FrameTreeNode*, int, mojo::PendingAssociatedRemote<content::mojom::Frame>, base::TokenType<blink::LocalFrameTokenTypeMarker> const&, base::TokenType<blink::DocumentTokenTypeMarker> const&, base::UnguessableToken, bool, content::RenderFrameHostImpl::LifecycleStateImpl, scoped_refptr<content::BrowsingContextState>) content/browser/renderer_host/render_frame_host_factory.cc:39:27
    #3 0x55e9d0749452 in content::RenderFrameHostManager::CreateRenderFrameHost(content::RenderFrameHostManager::CreateFrameCase, content::SiteInstanceImpl*, int, mojo::PendingAssociatedRemote<content::mojom::Frame>, base::TokenType<blink::LocalFrameTokenTypeMarker> const&, base::TokenType<blink::DocumentTokenTypeMarker> const&, base::UnguessableToken, bool, scoped_refptr<content::BrowsingContextState>, content::ProcessAllocationContext const&) content/browser/renderer_host/render_frame_host_manager.cc:4161:10
    #4 0x55e9d07486fe in content::RenderFrameHostManager::InitRoot(content::SiteInstanceImpl*, bool, blink::FramePolicy, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, base::UnguessableToken const&) content/browser/renderer_host/render_frame_host_manager.cc:658:22
    #5 0x55e9d02fd718 in content::FrameTree::Init(content::SiteInstanceImpl*, bool, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::RenderFrameHostImpl*, blink::FramePolicy const&, base::UnguessableToken const&) content/browser/renderer_host/frame_tree.cc:949:27
    #6 0x55e9d0e6b2a2 in content::WebContentsImpl::Init(content::WebContents::CreateParams const&, blink::FramePolicy) content/browser/web_contents/web_contents_impl.cc:3894:23
    #7 0x55e9d0e2e252 in content::WebContentsImpl::CreateWithOpener(content::WebContents::CreateParams const&, content::RenderFrameHostImpl*) content/browser/web_contents/web_contents_impl.cc:1583:17
    #8 0x55e9ee7e04b1 in (anonymous namespace)::CreateTargetContents(NavigateParams const&, GURL const&) chrome/browser/ui/browser_navigator.cc:535:10
    #9 0x55e9ee7ddda8 in Navigate(NavigateParams*) chrome/browser/ui/browser_navigator.cc:850:11
    #10 0x55e9ee858224 in StartupBrowserCreatorImpl::OpenTabsInBrowser(Browser*, chrome::startup::IsProcessStartup, std::__Cr::vector<StartupTab, std::__Cr::allocator<StartupTab>> const&, StartupBrowserCreatorImpl::TabOverWrite) chrome/browser/ui/startup/startup_browser_creator_impl.cc:312:5
    #11 0x55e9ee859d3d in StartupBrowserCreatorImpl::RestoreOrCreateBrowser(std::__Cr::vector<StartupTab, std::__Cr::allocator<StartupTab>> const&, StartupBrowserCreatorImpl::BrowserOpenBehavior, unsigned int, chrome::startup::IsProcessStartup, bool) chrome/browser/ui/startup/startup_browser_creator_impl.cc:629:13
    #12 0x55e9ee857235 in StartupBrowserCreatorImpl::DetermineURLsAndLaunch(chrome::startup::IsProcessStartup, bool) chrome/browser/ui/startup/startup_browser_creator_impl.cc:439:22
    #13 0x55e9ee8569eb in StartupBrowserCreatorImpl::Launch(Profile*, chrome::startup::IsProcessStartup, bool) chrome/browser/ui/startup/startup_browser_creator_impl.cc:155:3
    #14 0x55e9ee84ea8b in StartupBrowserCreator::LaunchBrowser(base::CommandLine const&, Profile*, base::FilePath const&, chrome::startup::IsProcessStartup, chrome::startup::IsFirstRun, bool) chrome/browser/ui/startup/startup_browser_creator.cc:739:9
    #15 0x55e9ee84fdf0 in StartupBrowserCreator::LaunchBrowserForLastProfiles(base::CommandLine const&, base::FilePath const&, chrome::startup::IsProcessStartup, chrome::startup::IsFirstRun, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&, bool) chrome/browser/ui/startup/startup_browser_creator.cc:820:7
    #16 0x55e9ee84e42b in StartupBrowserCreator::ProcessCmdLineImpl(base::CommandLine const&, base::FilePath const&, chrome::startup::IsProcessStartup, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&) chrome/browser/ui/startup/startup_browser_creator.cc:1364:3
    #17 0x55e9ee84c876 in StartupBrowserCreator::Start(base::CommandLine const&, base::FilePath const&, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&) chrome/browser/ui/startup/startup_browser_creator.cc:693:10
    #18 0x55e9d7e56975 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:1701:25
    #19 0x55e9d7e554bc in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1158:18
    #20 0x55e9cf338f55 in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1005:28
    #21 0x55e9d0cfe20b in Run base/functional/callback.h:156:12
    #22 0x55e9d0cfe20b in content::StartupTaskRunner::RunAllTasksNow() content/browser/startup_task_runner.cc:42:29
    #23 0x55e9cf337e58 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:911:25
    #24 0x55e9cf3420b4 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams) content/browser/browser_main_runner_impl.cc:137:15
    #25 0x55e9cf333023 in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:28:32
    #26 0x55e9d62404dc in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:717:10
    #27 0x55e9d62437c0 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1297:10
    #28 0x55e9d6242fab in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:12
    #29 0x55e9d623db86 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:359:36
    #30 0x55e9d623e07b in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:372:10
    #31 0x55e9c42ba73d in ChromeMain chrome/app/chrome_main.cc:222:12

SUMMARY: AddressSanitizer: heap-use-after-free chrome/browser/usb/usb_chooser_controller.cc:285:28 in UsbChooserController::DisplayDevice(device::mojom::UsbDeviceInfo const&) const
Shadow bytes around the buggy address:
  0x7d80fca57680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7d80fca57700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7d80fca57780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7d80fca57800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7d80fca57880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x7d80fca57900:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d80fca57980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d80fca57a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d80fca57a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d80fca57b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d80fca57b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2435984==ADDITIONAL INFO

==2435984==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55e9d858baf3 in UsbChooserContext::GetDevices(base::OnceCallback<void (std::__Cr::vector<mojo::StructPtr<device::mojom::UsbDeviceInfo>, std::__Cr::allocator<mojo::StructPtr<device::mojom::UsbDeviceInfo>>>)>) chrome/browser/usb/usb_chooser_context.cc:544:7
    #1 0x55e9d8fe8327 in PostDispatchNextMessageFromPipe mojo/public/cpp/bindings/lib/connector.cc:582:7
    #2 0x55e9d9d200ec in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:102:13


Command line: `out/asan/chrome --flag-switches-begin --flag-switches-end --ozone-platform-hint=auto --ozone-platform=x11 http://localhost:1337/poc.html`


==2435984==END OF ADDITIONAL INFO
==2435984==ABORTING