=================================================================
==16784==ERROR: AddressSanitizer: heap-use-after-free on address 0x11b78c231e70 at pc 0x7ffe820f176e bp 0x00aad99fb780 sp 0x00aad99fb7c8
READ of size 4 at 0x11b78c231e70 thread T0
    #0 0x7ffe820f176d in std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >::operator= C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__utility\pair.h:236
    #1 0x7ffe820f176d in std::__Cr::__move_impl<std::__Cr::_ClassicAlgPolicy>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\move.h:46
    #2 0x7ffe820f176d in std::__Cr::__copy_move_unwrap_iters C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\copy_move_common.h:94
    #3 0x7ffe820f176d in std::__Cr::__move C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\move.h:122
    #4 0x7ffe820f176d in std::__Cr::move C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__algorithm\move.h:132
    #5 0x7ffe820f176d in std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > >::erase C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:1175
    #6 0x7ffe820f176d in base::internal::flat_tree<unsigned int, struct base::internal::GetFirst, struct std::__Cr::less<void>, class std::__Cr::vector<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>, class std::__Cr::allocator<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>>>>::erase(class std::__Cr::__wrap_iter<struct std::__Cr::pair<unsigned int, class base::OnceCallback<void __cdecl(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>> *>) C:\b\s\w\ir\cache\builder\src\base\containers\flat_tree.h:862:16
    #7 0x7ffe820f132b in cc::LayerTreeHost::NotifyTransitionRequestsFinished(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:539:30
    #8 0x7ffe820b45e9 in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #9 0x7ffe820b45e9 in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #10 0x7ffe820b45e9 in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain>,unsigned int,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #11 0x7ffe820b45e9 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain> &&, unsigned int &&, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain>, unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #12 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #13 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #14 0x7ffe7cde9a29 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #15 0x7ffe7cde9a29 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #16 0x7ffe7cde88cf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #17 0x7ffe7cf49427 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #18 0x7ffe7cdeb751 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
    #19 0x7ffe7ce8643e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #20 0x7ffe9278f8fb in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:369:16
    #21 0x7ffe79901686 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:781:14
    #22 0x7ffe799039d1 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1155:10
    #23 0x7ffe798f7ab3 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359:36
    #24 0x7ffe798f866d in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:372:10
    #25 0x7ffe6a1116bb in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
    #26 0x7ff6e68147bb in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
    #27 0x7ff6e6812021 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20
    #28 0x7ff6e6cc55fb in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #29 0x7ff6e6cc55fb in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #30 0x7fff890ae8d6  (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
    #31 0x7fff8b1dbf6b  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x1800bbf6b)

0x11b78c231e70 is located 16 bytes inside of 32-byte region [0x11b78c231e60,0x11b78c231e80)
freed by thread T0 here:
    #0 0x7fff3e30b244  (E:\chrome_asan\asan-win32-release_x64-1448748\clang_rt.asan_dynamic-x86_64.dll+0x18005b244)
    #1 0x7ffe82107583 in std::__Cr::__libcpp_operator_delete C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:46
    #2 0x7ffe82107583 in std::__Cr::__libcpp_deallocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:86
    #3 0x7ffe82107583 in std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > >::deallocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocator.h:120
    #4 0x7ffe82107583 in std::__Cr::allocator_traits<std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > >::deallocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocator_traits.h:289
    #5 0x7ffe82107583 in std::__Cr::__split_buffer<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > &>::~__split_buffer C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__split_buffer:337
    #6 0x7ffe82107583 in std::__Cr::vector<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>, class std::__Cr::allocator<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>>>::emplace<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>(class std::__Cr::__wrap_iter<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>> const *>, unsigned int &&, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)> &&) C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:1263:3
    #7 0x7ffe820f7902 in base::internal::flat_tree<unsigned int,base::internal::GetFirst,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::unsafe_emplace C:\b\s\w\ir\cache\builder\src\base\containers\flat_tree.h:1103
    #8 0x7ffe820f7902 in base::flat_map<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::operator[] C:\b\s\w\ir\cache\builder\src\base\containers\flat_map.h:294
    #9 0x7ffe820f7902 in cc::LayerTreeHost::AddViewTransitionRequest(class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:975:5
    #10 0x7ffe8b6a36b4 in blink::PaintArtifactCompositor::Update(class blink::PaintArtifact const &, struct blink::PaintArtifactCompositor::ViewportProperties const &, class blink::HeapVector<class cppgc::internal::BasicMember<class blink::TransformPaintPropertyNode const, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 32> const &, class WTF::Vector<class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>, 0, class WTF::PartitionAllocator>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\graphics\compositing\paint_artifact_compositor.cc:980:11
    #11 0x7ffe899cc848 in blink::LocalFrameView::PushPaintArtifactToCompositor(bool) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3016:31
    #12 0x7ffe899c8877 in blink::LocalFrameView::RunPaintLifecyclePhase(enum blink::PaintBenchmarkMode) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2683:5
    #13 0x7ffe899c6e6b in blink::LocalFrameView::UpdateLifecyclePhasesInternal(enum blink::DocumentLifecycle::LifecycleState) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2378:3
    #14 0x7ffe899c29cf in blink::LocalFrameView::UpdateLifecyclePhases(enum blink::DocumentLifecycle::LifecycleState, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2163:3
    #15 0x7ffe899c210e in blink::LocalFrameView::UpdateAllLifecyclePhases(enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:1887:54
    #16 0x7ffe878671f4 in blink::PageAnimator::UpdateAllLifecyclePhases(class blink::LocalFrame &, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\page_animator.cc:397:9
    #17 0x7ffe8987caf5 in blink::WebFrameWidgetImpl::UpdateLifecycle(enum blink::WebLifecycleUpdate, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\web_frame_widget_impl.cc:1764:14
    #18 0x7ffe8b359f6d in blink::WidgetBase::UpdateVisualState(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\widget\widget_base.cc:1054:12
    #19 0x7ffe820ef283 in cc::LayerTreeHost::RequestMainFrameUpdate(bool) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:402:12
    #20 0x7ffe820c0359 in cc::ProxyMain::BeginMainFrame(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>) C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:297:21
    #21 0x7ffe820b64be in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #22 0x7ffe820b64be in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #23 0x7ffe820b64be in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #24 0x7ffe820b64be in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain> &&, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain>, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #25 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #26 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #27 0x7ffe7cde9a29 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #28 0x7ffe7cde9a29 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #29 0x7ffe7cde88cf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #30 0x7ffe7cf49427 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #31 0x7ffe7cdeb7c8 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:626:12
    #32 0x7ffe7ce8643e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #33 0x7ffe93241ceb in printing::PrintRenderFrameHelper::RequestPrintPreview(enum printing::PrintRenderFrameHelper::PrintPreviewRequestType, bool) C:\b\s\w\ir\cache\builder\src\components\printing\renderer\print_render_frame_helper.cc:2694:12
    #34 0x7ffe93240d49 in printing::PrintRenderFrameHelper::ScriptedPrint(bool) C:\b\s\w\ir\cache\builder\src\components\printing\renderer\print_render_frame_helper.cc:1229:5
    #35 0x7ffe928c9795 in content::RenderFrameImpl::ScriptedPrint(void) C:\b\s\w\ir\cache\builder\src\content\renderer\render_frame_impl.cc:2104:14
    #36 0x7ffe895a09d1 in blink::ChromeClientImpl::PrintDelegate(class blink::LocalFrame *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\chrome_client_impl.cc:777:24
    #37 0x7ffe87f39d6d in blink::ChromeClient::Print(class blink::LocalFrame *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\chrome_client.cc:282:3
    #38 0x7ffe8a127890 in blink::EditorCommand::Execute(class WTF::String const &, class blink::Event *) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\commands\editor_command.cc:2161:10
    #39 0x7ffe8d9aa9e2 in blink::Document::execCommand(class WTF::String const &, bool, class blink::V8UnionStringOrTrustedHTML const *, class blink::ExceptionState &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\commands\document_exec_command.cc:149:25
    #40 0x7ffe8da0a4db in blink::`anonymous namespace'::v8_document::ExecCommandOperationCallback C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\modules\v8\v8_document.cc:6933:39
    #41 0x7ffe93ad1b44 in Builtins_CallApiCallbackGeneric (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99c1b44)
    #42 0x7ffe93acfd34 in Builtins_InterpreterEntryTrampoline (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bfd34)
    #43 0x7ffe93acfd34 in Builtins_InterpreterEntryTrampoline (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bfd34)
    #44 0x7ffe93acd29b in Builtins_JSEntryTrampoline (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bd29b)
    #45 0x7ffe93accdfe in Builtins_JSEntry (E:\chrome_asan\asan-win32-release_x64-1448748\chrome.dll+0x1a99bcdfe)
    #46 0x7ffe6f5eefbe in v8::internal::GeneratedCode<unsigned long long,unsigned long long,unsigned long long,unsigned long long,unsigned long long,long long,unsigned long long **>::Call C:\b\s\w\ir\cache\builder\src\v8\src\execution\simulator.h:212
    #47 0x7ffe6f5eefbe in v8::internal::`anonymous namespace'::Invoke C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:440:22
    #48 0x7ffe6f5ed68d in v8::internal::Execution::Call(class v8::internal::Isolate *, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::base::Vector<class v8::internal::DirectHandle<class v8::internal::Object> const>) C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:530:10
    #49 0x7ffe6f009468 in v8::Function::Call(class v8::Isolate *, class v8::Local<class v8::Context>, class v8::Local<class v8::Value>, int, class v8::Local<class v8::Value> *const) C:\b\s\w\ir\cache\builder\src\v8\src\api\api.cc:5427:7
    #50 0x7ffe8aeb6c68 in blink::V8ScriptRunner::CallFunction(class v8::Local<class v8::Function>, class blink::ExecutionContext *, class v8::Local<class v8::Value>, int, class v8::Local<class v8::Value> *const, class v8::Isolate *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\v8_script_runner.cc:886:48
    #51 0x7ffe8ce54106 in blink::bindings::CallbackInvokeHelper<blink::CallbackFunctionBase,0,1>::CallInternal C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\callback_invoke_helper.cc:142
    #52 0x7ffe8ce54106 in blink::bindings::CallbackInvokeHelper<class blink::CallbackFunctionWithTaskAttributionBase, 0, 1>::Call(int, class v8::Local<class v8::Value> *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\callback_invoke_helper.cc:157:10
    #53 0x7ffe8ce5cf3c in blink::V8ViewTransitionCallback::Invoke(class blink::bindings::V8ValueOrScriptWrappableAdapter) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\core\v8\v8_view_transition_callback.cc:57:13
    #54 0x7ffe8a492c00 in blink::DOMViewTransition::InvokeDOMChangeCallback(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\view_transition\dom_view_transition.cc:234:31
    #55 0x7ffe8a4802c9 in blink::ViewTransition::ProcessCurrentState(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\view_transition\view_transition.cc:528:27
    #56 0x7ffe8a48ae5f in base::internal::DecayedFunctorTraits<void (ViewTransition::*)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::ViewTransition *>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #57 0x7ffe8a48ae5f in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ViewTransition::*&&)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::ViewTransition *>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #58 0x7ffe8a48ae5f in base::internal::Invoker<base::internal::FunctorTraits<void (ViewTransition::*&&)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::ViewTransition *>,base::internal::BindState<1,1,0,void (ViewTransition::*)(const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),blink::internal::BasicUnwrappingCrossThreadHandle<blink::ViewTransition,blink::internal::WeakCrossThreadHandleWeaknessPolicy> >,void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #59 0x7ffe8a48ae5f in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl blink::ViewTransition::*&&)(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class blink::ViewTransition *>, struct base::internal::BindState<1, 1, 0, void (__cdecl blink::ViewTransition::*)(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class blink::internal::BasicUnwrappingCrossThreadHandle<class blink::ViewTransition, struct blink::internal::WeakCrossThreadHandleWeaknessPolicy>>, (class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>::RunOnce(class base::internal::BindStateBase *, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #60 0x7ffe820f1300 in base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #61 0x7ffe820f1300 in cc::LayerTreeHost::NotifyTransitionRequestsFinished(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:538:25
    #62 0x7ffe820b45e9 in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #63 0x7ffe820b45e9 in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #64 0x7ffe820b45e9 in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain> &&,unsigned int &&,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(unsigned int, const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &),base::WeakPtr<cc::ProxyMain>,unsigned int,std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #65 0x7ffe820b45e9 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain> &&, unsigned int &&, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &), class base::WeakPtr<class cc::ProxyMain>, unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #66 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #67 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34

previously allocated by thread T0 here:
    #0 0x7fff3e30a65d  (E:\chrome_asan\asan-win32-release_x64-1448748\clang_rt.asan_dynamic-x86_64.dll+0x18005a65d)
    #1 0x7ffe821073f4 in std::__Cr::__libcpp_operator_new C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:37
    #2 0x7ffe821073f4 in std::__Cr::__libcpp_allocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__new\allocate.h:64
    #3 0x7ffe821073f4 in std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > >::allocate C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocator.h:105
    #4 0x7ffe821073f4 in std::__Cr::__allocate_at_least C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\allocate_at_least.h:41
    #5 0x7ffe821073f4 in std::__Cr::__split_buffer<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > &>::__split_buffer C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__split_buffer:325
    #6 0x7ffe821073f4 in std::__Cr::vector<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>, class std::__Cr::allocator<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>>>::emplace<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>>(class std::__Cr::__wrap_iter<struct std::__Cr::pair<unsigned int, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)>> const *>, unsigned int &&, class base::OnceCallback<(class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &)> &&) C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__vector\vector.h:1260:49
    #7 0x7ffe820f7902 in base::internal::flat_tree<unsigned int,base::internal::GetFirst,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::unsafe_emplace C:\b\s\w\ir\cache\builder\src\base\containers\flat_tree.h:1103
    #8 0x7ffe820f7902 in base::flat_map<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)>,std::__Cr::less<void>,std::__Cr::vector<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >,std::__Cr::allocator<std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> > > > >::operator[] C:\b\s\w\ir\cache\builder\src\base\containers\flat_map.h:294
    #9 0x7ffe820f7902 in cc::LayerTreeHost::AddViewTransitionRequest(class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:975:5
    #10 0x7ffe8b6a36b4 in blink::PaintArtifactCompositor::Update(class blink::PaintArtifact const &, struct blink::PaintArtifactCompositor::ViewportProperties const &, class blink::HeapVector<class cppgc::internal::BasicMember<class blink::TransformPaintPropertyNode const, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 32> const &, class WTF::Vector<class std::__Cr::unique_ptr<class cc::ViewTransitionRequest, struct std::__Cr::default_delete<class cc::ViewTransitionRequest>>, 0, class WTF::PartitionAllocator>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\graphics\compositing\paint_artifact_compositor.cc:980:11
    #11 0x7ffe899cc848 in blink::LocalFrameView::PushPaintArtifactToCompositor(bool) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3016:31
    #12 0x7ffe899c8877 in blink::LocalFrameView::RunPaintLifecyclePhase(enum blink::PaintBenchmarkMode) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2683:5
    #13 0x7ffe899c6e6b in blink::LocalFrameView::UpdateLifecyclePhasesInternal(enum blink::DocumentLifecycle::LifecycleState) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2378:3
    #14 0x7ffe899c29cf in blink::LocalFrameView::UpdateLifecyclePhases(enum blink::DocumentLifecycle::LifecycleState, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:2163:3
    #15 0x7ffe899c210e in blink::LocalFrameView::UpdateAllLifecyclePhases(enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:1887:54
    #16 0x7ffe878671f4 in blink::PageAnimator::UpdateAllLifecyclePhases(class blink::LocalFrame &, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\page\page_animator.cc:397:9
    #17 0x7ffe8987caf5 in blink::WebFrameWidgetImpl::UpdateLifecycle(enum blink::WebLifecycleUpdate, enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\web_frame_widget_impl.cc:1764:14
    #18 0x7ffe8b359f6d in blink::WidgetBase::UpdateVisualState(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\widget\widget_base.cc:1054:12
    #19 0x7ffe820ef283 in cc::LayerTreeHost::RequestMainFrameUpdate(bool) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:402:12
    #20 0x7ffe820c0359 in cc::ProxyMain::BeginMainFrame(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>) C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:297:21
    #21 0x7ffe820b64be in base::internal::DecayedFunctorTraits<void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #22 0x7ffe820b64be in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #23 0x7ffe820b64be in base::internal::Invoker<base::internal::FunctorTraits<void (ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,base::internal::BindState<1,1,0,void (ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #24 0x7ffe820b64be in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain> &&, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain>, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #25 0x7ffe7ce169d3 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #26 0x7ffe7ce169d3 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #27 0x7ffe7cde9a29 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #28 0x7ffe7cde9a29 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #29 0x7ffe7cde88cf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #30 0x7ffe7cf49427 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #31 0x7ffe7cdeb751 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
    #32 0x7ffe7ce8643e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #33 0x7ffe9278f8fb in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:369:16
    #34 0x7ffe79901686 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:781:14
    #35 0x7ffe799039d1 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1155:10
    #36 0x7ffe798f7ab3 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359:36
    #37 0x7ffe798f866d in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:372:10
    #38 0x7ffe6a1116bb in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
    #39 0x7ff6e68147bb in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
    #40 0x7ff6e6812021 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20
    #41 0x7ff6e6cc55fb in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #42 0x7ff6e6cc55fb in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #43 0x7fff890ae8d6  (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6)
    #44 0x7fff8b1dbf6b  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x1800bbf6b)

SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__utility\pair.h:236 in std::__Cr::pair<unsigned int,base::OnceCallback<void (const std::__Cr::unordered_map<viz::ViewTransitionElementResourceId,gfx::RectF,std::__Cr::hash<viz::ViewTransitionElementResourceId>,std::__Cr::equal_to<viz::ViewTransitionElementResourceId>,std::__Cr::allocator<std::__Cr::pair<const viz::ViewTransitionElementResourceId,gfx::RectF> > > &)> >::operator=
Shadow bytes around the buggy address:
  0x11b78c231b80: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c231c00: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
  0x11b78c231c80: fd fd fd fa f7 fa fd fd fd fd f7 fa fd fd fd fd
  0x11b78c231d00: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c231d80: fd fd f7 fa fd fd fd fd f7 fa 00 00 00 fa f7 fa
=>0x11b78c231e00: 00 00 00 fa f7 fa 00 00 00 00 f7 fa fd fd[fd]fd
  0x11b78c231e80: f7 fa fd fd fd fa f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c231f00: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fa f7 fa
  0x11b78c231f80: 00 00 00 00 f7 fa fd fd fd fd f7 fa fd fd fd fd
  0x11b78c232000: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
  0x11b78c232080: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==16784==ADDITIONAL INFO

==16784==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7ffe820ac7c7 in cc::ProxyImpl::NotifyTransitionRequestFinished(unsigned int, class std::__Cr::unordered_map<class viz::ViewTransitionElementResourceId, class gfx::RectF, struct std::__Cr::hash<class viz::ViewTransitionElementResourceId>, struct std::__Cr::equal_to<class viz::ViewTransitionElementResourceId>, class std::__Cr::allocator<struct std::__Cr::pair<class viz::ViewTransitionElementResourceId const, class gfx::RectF>>> const &) C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:643:7
    #1 0x7ffe7d330a58 in mojo::SimpleWatcher::Context::Notify(unsigned int, struct MojoHandleSignalsState, unsigned int) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\system\simple_watcher.cc:102:13


Command line: `"E:\chrome_asan\asan-win32-release_x64-1448748\chrome.exe" --type=renderer --noerrdialogs --user-data-dir=TMP/idl_fuzz_285258 --no-pre-read-main-dll --no-sandbox --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-breakpad --enable-automation --enable-experimental-web-platform-features --enable-blink-test-features --file-url-path-alias="/gen=E:\chrome_asan\asan-win32-release_x64-1448748\gen" --force-color-profile=srgb --remote-debugging-port=0 --use-fake-ui-for-media-stream --allow-pre-commit-input --js-flags="--expose-gc --allow-natives-syntax" --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=2 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1743991026287498 --launch-time-ticks=973588537249 --field-trial-handle=1808,i,16815833194804320407,12888828551620295727,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DesktopPWAsAdditionalWindowingControls,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PartitionedPopins,PdfOopif,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,SelectAudioOutput,StorageAccessHeaders,ThirdPartyStoragePartitioning --disable-features=AcceptCHFrame,IsolateSandboxedIframes,MediaRouter,OptimizationHints,PaintHolding,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --enable-logging=stderr --mojo-platform-channel-handle=4072 /prefetch:1`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==16784==END OF ADDITIONAL INFO
==16784==ABORTINGs