=================================================================
==39578==ERROR: AddressSanitizer: heap-use-after-free on address 0x6090000dfe80 at pc 0x0001070809ac bp 0x00039b12e520 sp 0x00039b12e518
READ of size 8 at 0x6090000dfe80 thread T13
SCARINESS: 51 (8-byte-read-heap-use-after-free)
    #0 0x0001070809a8 in std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>::operator->() const /Users/happy/chromium/src/third_party/libc++/src/include/__memory/unique_ptr.h:267:101
    #1 0x0001070809a8 in base::ModuleCache::ModuleAndAddressCompare::operator()(std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const&, unsigned long) const /Users/happy/chromium/src/base/profiler/module_cache.cc:190:33
    #2 0x0001070809a8 in bool base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::KeyValueCompare::operator()<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, unsigned long>(std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const&, unsigned long const&) const /Users/happy/chromium/src/base/containers/flat_tree.h:403:14
    #3 0x0001070809a8 in decltype(std::declval<base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::KeyValueCompare&>()(std::declval<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const&>(), std::declval<unsigned long const&>())) std::__Cr::__invoke<base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::KeyValueCompare&, std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const&, unsigned long const&>(base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::KeyValueCompare&, std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const&, unsigned long const&) /Users/happy/chromium/src/third_party/libc++/src/include/__type_traits/invoke.h:179:25
    #4 0x0001070809a8 in std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*> std::__Cr::__lower_bound_bisecting<std::__Cr::_RangeAlgPolicy, std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>, unsigned long, std::__Cr::identity, base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::KeyValueCompare>(std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>, unsigned long const&, std::__Cr::iterator_traits<std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>>::difference_type, base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::KeyValueCompare&, std::__Cr::identity&) /Users/happy/chromium/src/third_party/libc++/src/include/__algorithm/lower_bound.h:40:9
    #5 0x0001070809a8 in std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*> std::__Cr::__lower_bound<std::__Cr::_RangeAlgPolicy, std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>, std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>, unsigned long, std::__Cr::identity, base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::KeyValueCompare>(std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>, std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>, unsigned long const&, base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::KeyValueCompare&, std::__Cr::identity&) /Users/happy/chromium/src/third_party/libc++/src/include/__algorithm/lower_bound.h:89:10
    #6 0x0001070809a8 in std::__Cr::_IfImpl<borrowed_range<T>>::_Select<decltype(std::__Cr::ranges::__cpo::begin(std::declval<T&>())), std::__Cr::ranges::dangling> std::__Cr::ranges::__lower_bound::operator()<base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>> const&, unsigned long, std::__Cr::identity, base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::KeyValueCompare>(T&&, T0 const&, base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::KeyValueCompare, T1) const /Users/happy/chromium/src/third_party/libc++/src/include/__algorithm/ranges_lower_bound.h:56:12
    #7 0x0001070809a8 in std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*> base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::lower_bound<unsigned long>(unsigned long const&) const /Users/happy/chromium/src/base/containers/flat_tree.h:1057:10
    #8 0x0001070809a8 in std::__Cr::pair<std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>, std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>> base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::equal_range<unsigned long>(unsigned long const&) const /Users/happy/chromium/src/base/containers/flat_tree.h:1016:16
    #9 0x0001070809a8 in std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*> base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::find<unsigned long>(unsigned long const&) const /Users/happy/chromium/src/base/containers/flat_tree.h:965:19
    #10 0x0001070809a8 in base::ModuleCache::GetExistingModuleForAddress(unsigned long) const /Users/happy/chromium/src/base/profiler/module_cache.cc:156:58
    #11 0x000107080514 in base::ModuleCache::GetModuleForAddress(unsigned long) /Users/happy/chromium/src/base/profiler/module_cache.cc:69:11
    #12 0x000107090c88 in base::StackSampler::WalkStack(base::ModuleCache*, __darwin_arm_thread_state64*, unsigned long, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>) /Users/happy/chromium/src/base/profiler/stack_sampler.cc:346:36
    #13 0x00010709332c in base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0::operator()(base::StackUnwindData*, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>, __darwin_arm_thread_state64, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>, unsigned long) const /Users/happy/chromium/src/base/profiler/stack_sampler.cc:269:22
    #14 0x00010709332c in std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> base::internal::DecayedFunctorTraits<base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0, base::StackUnwindData*, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>&&, __darwin_arm_thread_state64&, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>&&, unsigned long&&>::Invoke<base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0, base::StackUnwindData*, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>, __darwin_arm_thread_state64&, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>, unsigned long>(base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0&&, base::StackUnwindData*&&, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>&&, __darwin_arm_thread_state64&, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>&&, unsigned long&&) /Users/happy/chromium/src/base/functional/bind_internal.h:649:12
    #15 0x00010709332c in std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> base::internal::InvokeHelper<false, base::internal::FunctorTraits<base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0&&, base::StackUnwindData*, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>&&, __darwin_arm_thread_state64&, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>&&, unsigned long&&>, std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, 0ul, 1ul, 2ul, 3ul, 4ul>::MakeItSo<base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0, std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>, base::internal::OwnedRefWrapper<__darwin_arm_thread_state64>, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>, unsigned long>>(base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0&&, std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>, base::internal::OwnedRefWrapper<__darwin_arm_thread_state64>, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>, unsigned long>&&) /Users/happy/chromium/src/base/functional/bind_internal.h:923:12
    #16 0x00010709332c in std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> base::internal::Invoker<base::internal::FunctorTraits<base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0&&, base::StackUnwindData*, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>&&, __darwin_arm_thread_state64&, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>&&, unsigned long&&>, base::internal::BindState<false, false, false, base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0, base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>, base::internal::OwnedRefWrapper<__darwin_arm_thread_state64>, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>, unsigned long>, std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>::RunImpl<base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0, std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>, base::internal::OwnedRefWrapper<__darwin_arm_thread_state64>, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>, unsigned long>, 0ul, 1ul, 2ul, 3ul, 4ul>(base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0&&, std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>, base::internal::OwnedRefWrapper<__darwin_arm_thread_state64>, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>, unsigned long>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul>) /Users/happy/chromium/src/base/functional/bind_internal.h:1060:14
    #17 0x00010709332c in base::internal::Invoker<base::internal::FunctorTraits<base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0&&, base::StackUnwindData*, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>&&, __darwin_arm_thread_state64&, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>&&, unsigned long&&>, base::internal::BindState<false, false, false, base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>)::$_0, base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::vector<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>, std::__Cr::allocator<std::__Cr::tuple<base::raw_ptr<base::Unwinder, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::UnwinderStateCapture, std::__Cr::default_delete<base::UnwinderStateCapture>>>>>, base::internal::OwnedRefWrapper<__darwin_arm_thread_state64>, std::__Cr::unique_ptr<base::StackBuffer, std::__Cr::default_delete<base::StackBuffer>>, unsigned long>, std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>::RunOnce(base::internal::BindStateBase*) /Users/happy/chromium/src/base/functional/bind_internal.h:973:12
    #18 0x0001070956a8 in base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>::Run() && /Users/happy/chromium/src/base/functional/callback.h:156:12
    #19 0x0001070956a8 in void base::internal::ReturnAsParamAdapter<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*) /Users/happy/chromium/src/base/task/post_task_and_reply_with_result_internal.h:23:48
    #20 0x000107095c50 in void base::internal::DecayedFunctorTraits<void (*)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>&&, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*&&>::Invoke<void (*)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*>(void (*&&)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>&&, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*&&) /Users/happy/chromium/src/base/functional/bind_internal.h:664:12
    #21 0x000107095c50 in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (*&&)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>&&, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*&&>, void, 0ul, 1ul>::MakeItSo<void (*)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), std::__Cr::tuple<base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>>(void (*&&)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), std::__Cr::tuple<base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&) /Users/happy/chromium/src/base/functional/bind_internal.h:923:12
    #22 0x000107095c50 in void base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>&&, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*&&>, base::internal::BindState<false, true, false, void (*)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<void (*)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), std::__Cr::tuple<base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul, 1ul>(void (*&&)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), std::__Cr::tuple<base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>) /Users/happy/chromium/src/base/functional/bind_internal.h:1060:14
    #23 0x000107095c50 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>&&, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*&&>, base::internal::BindState<false, true, false, void (*)(base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>*), base::OnceCallback<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>, std::__Cr::default_delete<std::__Cr::vector<base::Frame, std::__Cr::allocator<base::Frame>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) /Users/happy/chromium/src/base/functional/bind_internal.h:973:12
    #24 0x0001071d2e6c in base::OnceCallback<void ()>::Run() && /Users/happy/chromium/src/base/functional/callback.h:156:12
    #25 0x0001071d2e6c in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(base::internal::PostTaskAndReplyRelay) /Users/happy/chromium/src/base/threading/post_task_and_reply_impl.h:45:28
    #26 0x0001071d333c in void base::internal::DecayedFunctorTraits<void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>::Invoke<void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>(void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&) /Users/happy/chromium/src/base/functional/bind_internal.h:664:12
    #27 0x0001071d333c in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, void, 0ul>::MakeItSo<void (*)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>>(void (*&&)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>&&) /Users/happy/chromium/src/base/functional/bind_internal.h:923:12
    #28 0x0001071d333c in void base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunImpl<void (*)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>, 0ul>(void (*&&)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) /Users/happy/chromium/src/base/functional/bind_internal.h:1060:14
    #29 0x0001071d333c in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunOnce(base::internal::BindStateBase*) /Users/happy/chromium/src/base/functional/bind_internal.h:973:12
    #30 0x00010714453c in base::OnceCallback<void ()>::Run() && /Users/happy/chromium/src/base/functional/callback.h:156:12
    #31 0x00010714453c in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) /Users/happy/chromium/src/base/task/common/task_annotator.cc:209:34
    #32 0x000107201984 in void base::TaskAnnotator::RunTask<base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)::$_0>(perfetto::StaticString, base::PendingTask&, base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)::$_0&&) /Users/happy/chromium/src/base/task/common/task_annotator.h:106:5
    #33 0x000107201984 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) /Users/happy/chromium/src/base/task/thread_pool/task_tracker.cc:691:19
    #34 0x000107201bd0 in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) /Users/happy/chromium/src/base/task/thread_pool/task_tracker.cc:676:3
    #35 0x000107200354 in base::internal::TaskTracker::RunTaskWithShutdownBehavior(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) /Users/happy/chromium/src/base/task/thread_pool/task_tracker.cc:706:7
    #36 0x000107200354 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&) /Users/happy/chromium/src/base/task/thread_pool/task_tracker.cc:504:5
    #37 0x0001071ff644 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) /Users/happy/chromium/src/base/task/thread_pool/task_tracker.cc:394:5
    #38 0x000107222900 in base::internal::WorkerThread::RunWorker() /Users/happy/chromium/src/base/task/thread_pool/worker_thread.cc:473:36
    #39 0x000107221d94 in base::internal::WorkerThread::RunPooledWorker() /Users/happy/chromium/src/base/task/thread_pool/worker_thread.cc:359:3
    #40 0x00010722174c in base::internal::WorkerThread::ThreadMain() /Users/happy/chromium/src/base/task/thread_pool/worker_thread.cc:339:7
    #41 0x0001072b5e20 in base::(anonymous namespace)::ThreadFunc(void*) /Users/happy/chromium/src/base/threading/platform_thread_posix.cc:103:13
    #42 0x00010544c01c in __sanitizer_weak_hook_memcmp ??:0:0
    #43 0x00019717c2e0 in _pthread_deallocate ??:0:0
    #19 0x40698001971770f8  (<unknown module>)

0x6090000dfe80 is located 0 bytes inside of 8-byte region [0x6090000dfe80,0x6090000dfe88)
freed by thread T2 here:
    #0 0x00010545f910 in __sanitizer_finish_switch_fiber ??:0:0
    #1 0x00010708792c in void std::__Cr::__libcpp_operator_delete<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>*, unsigned long>(std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>*, unsigned long) /Users/happy/chromium/src/third_party/libc++/src/include/__new/allocate.h:46:3
    #2 0x00010708792c in void std::__Cr::__libcpp_deallocate<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>(std::__Cr::__type_identity<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>::type*, std::__Cr::__element_count, unsigned long) /Users/happy/chromium/src/third_party/libc++/src/include/__new/allocate.h:86:12
    #3 0x00010708792c in std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>::deallocate(std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>*, unsigned long) /Users/happy/chromium/src/third_party/libc++/src/include/__memory/allocator.h:120:7
    #4 0x00010708792c in std::__Cr::allocator_traits<std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>::deallocate(std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>&, std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>*, unsigned long) /Users/happy/chromium/src/third_party/libc++/src/include/__memory/allocator_traits.h:289:9
    #5 0x00010708792c in std::__Cr::__split_buffer<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>&>::~__split_buffer() /Users/happy/chromium/src/third_party/libc++/src/include/__split_buffer:337:5
    #6 0x00010708792c in std::__Cr::__split_buffer<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>&>::~__split_buffer() /Users/happy/chromium/src/third_party/libc++/src/include/__split_buffer:334:82
    #7 0x00010708792c in std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>*> std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>::emplace<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>(std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>, std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>&&) /Users/happy/chromium/src/third_party/libc++/src/include/__vector/vector.h:1263:3
    #8 0x000107087470 in std::__Cr::pair<std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>*>, bool> base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::emplace_hint_key_args<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>(std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>, std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const&, std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>&&) /Users/happy/chromium/src/base/containers/flat_tree.h:0:0
    #9 0x0001070812c0 in base::ModuleCache::UpdateNonNativeModules(std::__Cr::vector<base::ModuleCache::Module const*, std::__Cr::allocator<base::ModuleCache::Module const*>> const&, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>) /Users/happy/chromium/src/base/profiler/module_cache.cc:132:23
    #10 0x000125542b64 in V8Unwinder::UpdateModules(base::UnwinderStateCapture*) /Users/happy/chromium/src/chrome/renderer/v8_unwinder.cc:245:19
    #11 0x00010708f964 in base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>) /Users/happy/chromium/src/base/profiler/stack_sampler.cc:215:28
    #12 0x00010709b0b4 in base::StackSamplingProfiler::SamplingThread::RecordSampleTask(int) /Users/happy/chromium/src/base/profiler/stack_sampling_profiler.cc:737:24
    #13 0x00010709e420 in void base::internal::DecayedFunctorTraits<void (base::StackSamplingProfiler::SamplingThread::*)(int), base::StackSamplingProfiler::SamplingThread*, int&&>::Invoke<void (base::StackSamplingProfiler::SamplingThread::*)(int), base::StackSamplingProfiler::SamplingThread*, int>(void (base::StackSamplingProfiler::SamplingThread::*)(int), base::StackSamplingProfiler::SamplingThread*&&, int&&) /Users/happy/chromium/src/base/functional/bind_internal.h:731:12
    #14 0x00010709e420 in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (base::StackSamplingProfiler::SamplingThread::*&&)(int), base::StackSamplingProfiler::SamplingThread*, int&&>, void, 0ul, 1ul>::MakeItSo<void (base::StackSamplingProfiler::SamplingThread::*)(int), std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, int>>(void (base::StackSamplingProfiler::SamplingThread::*&&)(int), std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, int>&&) /Users/happy/chromium/src/base/functional/bind_internal.h:923:12
    #15 0x00010709e420 in void base::internal::Invoker<base::internal::FunctorTraits<void (base::StackSamplingProfiler::SamplingThread::*&&)(int), base::StackSamplingProfiler::SamplingThread*, int&&>, base::internal::BindState<true, true, false, void (base::StackSamplingProfiler::SamplingThread::*)(int), base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, int>, void ()>::RunImpl<void (base::StackSamplingProfiler::SamplingThread::*)(int), std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, int>, 0ul, 1ul>(void (base::StackSamplingProfiler::SamplingThread::*&&)(int), std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, int>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>) /Users/happy/chromium/src/base/functional/bind_internal.h:1060:14
    #16 0x00010709e420 in base::internal::Invoker<base::internal::FunctorTraits<void (base::StackSamplingProfiler::SamplingThread::*&&)(int), base::StackSamplingProfiler::SamplingThread*, int&&>, base::internal::BindState<true, true, false, void (base::StackSamplingProfiler::SamplingThread::*)(int), base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, int>, void ()>::RunOnce(base::internal::BindStateBase*) /Users/happy/chromium/src/base/functional/bind_internal.h:973:12
    #17 0x00010714453c in base::OnceCallback<void ()>::Run() && /Users/happy/chromium/src/base/functional/callback.h:156:12
    #18 0x00010714453c in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) /Users/happy/chromium/src/base/task/common/task_annotator.cc:209:34
    #19 0x0001071bb660 in void base::TaskAnnotator::RunTask<base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_3>(perfetto::StaticString, base::PendingTask&, base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_3&&) /Users/happy/chromium/src/base/task/common/task_annotator.h:106:5
    #20 0x0001071bb660 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) /Users/happy/chromium/src/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:456:23
    #21 0x0001071baa5c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() /Users/happy/chromium/src/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #22 0x000106feb1ac in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) /Users/happy/chromium/src/base/message_loop/message_pump_default.cc:42:55
    #23 0x0001071bc9a8 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) /Users/happy/chromium/src/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:629:12
    #24 0x0001070b6de8 in base::RunLoop::Run(base::Location const&) /Users/happy/chromium/src/base/run_loop.cc:134:14
    #25 0x00010724da68 in base::Thread::Run(base::RunLoop*) /Users/happy/chromium/src/base/threading/thread.cc:344:13
    #26 0x00010724decc in base::Thread::ThreadMain() /Users/happy/chromium/src/base/threading/thread.cc:419:3
    #27 0x0001072b5e20 in base::(anonymous namespace)::ThreadFunc(void*) /Users/happy/chromium/src/base/threading/platform_thread_posix.cc:103:13
    #28 0x00010544c01c in __sanitizer_weak_hook_memcmp ??:0:0
    #29 0x00019717c2e0 in _pthread_deallocate ??:0:0
    #19 0x54268001971770f8  (<unknown module>)

previously allocated by thread T12 here:
    #0 0x00010545f508 in __sanitizer_finish_switch_fiber ??:0:0
    #1 0x00010708777c in void* std::__Cr::__libcpp_operator_new<unsigned long>(unsigned long) /Users/happy/chromium/src/third_party/libc++/src/include/__new/allocate.h:37:10
    #2 0x00010708777c in std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>* std::__Cr::__libcpp_allocate<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>(std::__Cr::__element_count, unsigned long) /Users/happy/chromium/src/third_party/libc++/src/include/__new/allocate.h:64:28
    #3 0x00010708777c in std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>::allocate(unsigned long) /Users/happy/chromium/src/third_party/libc++/src/include/__memory/allocator.h:105:14
    #4 0x00010708777c in std::__Cr::__allocation_result<std::__Cr::allocator_traits<std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>::pointer> std::__Cr::__allocate_at_least<std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>(std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>&, unsigned long) /Users/happy/chromium/src/third_party/libc++/src/include/__memory/allocate_at_least.h:41:19
    #5 0x00010708777c in std::__Cr::__split_buffer<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>&>::__split_buffer(unsigned long, unsigned long, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>&) /Users/happy/chromium/src/third_party/libc++/src/include/__split_buffer:325:25
    #6 0x00010708777c in std::__Cr::__split_buffer<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>&>::__split_buffer(unsigned long, unsigned long, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>&) /Users/happy/chromium/src/third_party/libc++/src/include/__split_buffer:321:38
    #7 0x00010708777c in std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>*> std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>::emplace<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>(std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>, std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>&&) /Users/happy/chromium/src/third_party/libc++/src/include/__vector/vector.h:1260:49
    #8 0x000107087470 in std::__Cr::pair<std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>*>, bool> base::internal::flat_tree<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::identity, base::ModuleCache::ModuleAndAddressCompare, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>>::emplace_hint_key_args<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>(std::__Cr::__wrap_iter<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const*>, std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>> const&, std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>&&) /Users/happy/chromium/src/base/containers/flat_tree.h:0:0
    #9 0x0001070812c0 in base::ModuleCache::UpdateNonNativeModules(std::__Cr::vector<base::ModuleCache::Module const*, std::__Cr::allocator<base::ModuleCache::Module const*>> const&, std::__Cr::vector<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>, std::__Cr::allocator<std::__Cr::unique_ptr<base::ModuleCache::Module const, std::__Cr::default_delete<base::ModuleCache::Module const>>>>) /Users/happy/chromium/src/base/profiler/module_cache.cc:132:23
    #10 0x000125541c84 in V8Unwinder::InitializeModules() /Users/happy/chromium/src/chrome/renderer/v8_unwinder.cc:160:19
    #11 0x0001070927c0 in base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0::operator()(base::StackUnwindData*, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>) const /Users/happy/chromium/src/base/profiler/stack_sampler.cc:150:25
    #12 0x0001070927c0 in std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> base::internal::DecayedFunctorTraits<base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0, base::StackUnwindData*, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>&&>::Invoke<base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0, base::StackUnwindData*, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>(base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0&&, base::StackUnwindData*&&, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>&&) /Users/happy/chromium/src/base/functional/bind_internal.h:649:12
    #13 0x0001070927c0 in std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> base::internal::InvokeHelper<false, base::internal::FunctorTraits<base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0&&, base::StackUnwindData*, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>&&>, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, 0ul, 1ul>::MakeItSo<base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0, std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>(base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0&&, std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>&&) /Users/happy/chromium/src/base/functional/bind_internal.h:923:12
    #14 0x0001070927c0 in std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> base::internal::Invoker<base::internal::FunctorTraits<base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0&&, base::StackUnwindData*, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>&&>, base::internal::BindState<false, false, false, base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0, base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>::RunImpl<base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0, std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>, 0ul, 1ul>(base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0&&, std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>) /Users/happy/chromium/src/base/functional/bind_internal.h:1060:14
    #15 0x0001070927c0 in base::internal::Invoker<base::internal::FunctorTraits<base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0&&, base::StackUnwindData*, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>&&>, base::internal::BindState<false, false, false, base::StackSampler::AddAuxUnwinder(std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>)::$_0, base::internal::UnretainedWrapper<base::StackUnwindData, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>, std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>::RunOnce(base::internal::BindStateBase*) /Users/happy/chromium/src/base/functional/bind_internal.h:973:12
    #16 0x0001070947bc in base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>::Run() && /Users/happy/chromium/src/base/functional/callback.h:156:12
    #17 0x0001070947bc in void base::internal::ReturnAsParamAdapter<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*) /Users/happy/chromium/src/base/task/post_task_and_reply_with_result_internal.h:23:48
    #18 0x000107094de8 in void base::internal::DecayedFunctorTraits<void (*)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>&&, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*&&>::Invoke<void (*)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*>(void (*&&)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>&&, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*&&) /Users/happy/chromium/src/base/functional/bind_internal.h:664:12
    #19 0x000107094de8 in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (*&&)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>&&, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*&&>, void, 0ul, 1ul>::MakeItSo<void (*)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), std::__Cr::tuple<base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>>(void (*&&)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), std::__Cr::tuple<base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&) /Users/happy/chromium/src/base/functional/bind_internal.h:923:12
    #20 0x000107094de8 in void base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>&&, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*&&>, base::internal::BindState<false, true, false, void (*)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<void (*)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), std::__Cr::tuple<base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul, 1ul>(void (*&&)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), std::__Cr::tuple<base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>) /Users/happy/chromium/src/base/functional/bind_internal.h:1060:14
    #21 0x000107094de8 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>&&, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*&&>, base::internal::BindState<false, true, false, void (*)(base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>*), base::OnceCallback<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>> ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>, std::__Cr::default_delete<std::__Cr::unique_ptr<base::Unwinder, std::__Cr::default_delete<base::Unwinder>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) /Users/happy/chromium/src/base/functional/bind_internal.h:973:12
    #22 0x0001071d2e6c in base::OnceCallback<void ()>::Run() && /Users/happy/chromium/src/base/functional/callback.h:156:12
    #23 0x0001071d2e6c in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(base::internal::PostTaskAndReplyRelay) /Users/happy/chromium/src/base/threading/post_task_and_reply_impl.h:45:28
    #24 0x0001071d333c in void base::internal::DecayedFunctorTraits<void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>::Invoke<void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>(void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&) /Users/happy/chromium/src/base/functional/bind_internal.h:664:12
    #25 0x0001071d333c in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, void, 0ul>::MakeItSo<void (*)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>>(void (*&&)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>&&) /Users/happy/chromium/src/base/functional/bind_internal.h:923:12
    #26 0x0001071d333c in void base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunImpl<void (*)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>, 0ul>(void (*&&)(base::internal::PostTaskAndReplyRelay), std::__Cr::tuple<base::internal::PostTaskAndReplyRelay>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) /Users/happy/chromium/src/base/functional/bind_internal.h:1060:14
    #27 0x0001071d333c in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunOnce(base::internal::BindStateBase*) /Users/happy/chromium/src/base/functional/bind_internal.h:973:12
    #28 0x00010714453c in base::OnceCallback<void ()>::Run() && /Users/happy/chromium/src/base/functional/callback.h:156:12
    #29 0x00010714453c in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) /Users/happy/chromium/src/base/task/common/task_annotator.cc:209:34
    #30 0x000107201984 in void base::TaskAnnotator::RunTask<base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)::$_0>(perfetto::StaticString, base::PendingTask&, base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&)::$_0&&) /Users/happy/chromium/src/base/task/common/task_annotator.h:106:5
    #31 0x000107201984 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) /Users/happy/chromium/src/base/task/thread_pool/task_tracker.cc:691:19
    #32 0x000107201bd0 in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) /Users/happy/chromium/src/base/task/thread_pool/task_tracker.cc:676:3
    #33 0x000107200354 in base::internal::TaskTracker::RunTaskWithShutdownBehavior(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) /Users/happy/chromium/src/base/task/thread_pool/task_tracker.cc:706:7
    #34 0x000107200354 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&) /Users/happy/chromium/src/base/task/thread_pool/task_tracker.cc:504:5
    #35 0x0001071ff644 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) /Users/happy/chromium/src/base/task/thread_pool/task_tracker.cc:394:5
    #36 0x000107222900 in base::internal::WorkerThread::RunWorker() /Users/happy/chromium/src/base/task/thread_pool/worker_thread.cc:473:36
    #37 0x000107221d94 in base::internal::WorkerThread::RunPooledWorker() /Users/happy/chromium/src/base/task/thread_pool/worker_thread.cc:359:3
    #38 0x00010722174c in base::internal::WorkerThread::ThreadMain() /Users/happy/chromium/src/base/task/thread_pool/worker_thread.cc:339:7
    #39 0x0001072b5e20 in base::(anonymous namespace)::ThreadFunc(void*) /Users/happy/chromium/src/base/threading/platform_thread_posix.cc:103:13
    #40 0x00010544c01c in __sanitizer_weak_hook_memcmp ??:0:0
    #41 0x00019717c2e0 in _pthread_deallocate ??:0:0
    #21 0xa6748001971770f8  (<unknown module>)

Thread T13 created by T2 here:
    #0 0x000105446d8c in __sanitizer_weak_hook_memcmp ??:0:0
    #1 0x0001072b53e4 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) /Users/happy/chromium/src/base/threading/platform_thread_posix.cc:151:13
    #2 0x0001072204d0 in base::internal::WorkerThread::Start(scoped_refptr<base::SingleThreadTaskRunner>, base::WorkerThreadObserver*) /Users/happy/chromium/src/base/task/thread_pool/worker_thread.cc:185:3
    #3 0x00010720415c in base::internal::ThreadGroup::BaseScopedCommandsExecutor::Flush() /Users/happy/chromium/src/base/task/thread_pool/thread_group.cc:89:13
    #4 0x000107203ecc in base::internal::ThreadGroup::BaseScopedCommandsExecutor::~BaseScopedCommandsExecutor() /Users/happy/chromium/src/base/task/thread_pool/thread_group.cc:80:3
    #5 0x00010720b7e4 in base::internal::ThreadGroupImpl::ScopedCommandsExecutor::~ScopedCommandsExecutor() /Users/happy/chromium/src/base/task/thread_pool/thread_group_impl.cc:42:3
    #6 0x00010720b7e4 in base::internal::ThreadGroupImpl::ScopedCommandsExecutor::~ScopedCommandsExecutor() /Users/happy/chromium/src/base/task/thread_pool/thread_group_impl.cc:35:38
    #7 0x00010720b7e4 in base::internal::ThreadGroupImpl::PushTaskSourceAndWakeUpWorkers(base::internal::RegisteredTaskSourceAndTransaction) /Users/happy/chromium/src/base/task/thread_pool/thread_group_impl.cc:276:1
    #8 0x000107219cbc in base::internal::ThreadPoolImpl::PostTaskWithSequenceNow(base::internal::Task, scoped_refptr<base::internal::Sequence>) /Users/happy/chromium/src/base/task/thread_pool/thread_pool_impl.cc:465:38
    #9 0x00010721a488 in base::internal::ThreadPoolImpl::PostTaskWithSequence(base::internal::Task, scoped_refptr<base::internal::Sequence>) /Users/happy/chromium/src/base/task/thread_pool/thread_pool_impl.cc:488:12
    #10 0x0001071e39a0 in base::internal::PooledSequencedTaskRunner::PostDelayedTask(base::Location const&, base::OnceCallback<void ()>, base::TimeDelta) /Users/happy/chromium/src/base/task/thread_pool/pooled_sequenced_task_runner.cc:36:40
    #11 0x0001071d2920 in base::TaskRunner::PostTask(base::Location const&, base::OnceCallback<void ()>) /Users/happy/chromium/src/base/task/task_runner.cc:19:10
    #12 0x0001071d2920 in base::TaskRunner::PostTaskAndReply(base::Location const&, base::OnceCallback<void ()>, base::OnceCallback<void ()>)::$_0::operator()(base::Location const&, base::OnceCallback<void ()>) const /Users/happy/chromium/src/base/task/task_runner.cc:27:16
    #13 0x0001071d2920 in bool base::internal::PostTaskAndReplyImpl<base::TaskRunner::PostTaskAndReply(base::Location const&, base::OnceCallback<void ()>, base::OnceCallback<void ()>)::$_0>(base::TaskRunner::PostTaskAndReply(base::Location const&, base::OnceCallback<void ()>, base::OnceCallback<void ()>)::$_0, base::Location const&, base::OnceCallback<void ()>, base::OnceCallback<void ()>) /Users/happy/chromium/src/base/threading/post_task_and_reply_impl.h:94:34
    #14 0x0001071d2920 in base::TaskRunner::PostTaskAndReply(base::Location const&, base::OnceCallback<void ()>, base::OnceCallback<void ()>) /Users/happy/chromium/src/base/task/task_runner.cc:25:10
    #15 0x00010708e204 in base::StackSampler::Initialize() /Users/happy/chromium/src/base/profiler/stack_sampler.cc:108:24
    #16 0x0001070982c0 in base::StackSamplingProfiler::SamplingThread::AddCollectionTask(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>) /Users/happy/chromium/src/base/profiler/stack_sampling_profiler.cc:657:24
    #17 0x00010709d4e8 in void base::internal::DecayedFunctorTraits<void (base::StackSamplingProfiler::SamplingThread::*)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), base::StackSamplingProfiler::SamplingThread*, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>&&>::Invoke<void (base::StackSamplingProfiler::SamplingThread::*)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), base::StackSamplingProfiler::SamplingThread*, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>>(void (base::StackSamplingProfiler::SamplingThread::*)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), base::StackSamplingProfiler::SamplingThread*&&, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>&&) /Users/happy/chromium/src/base/functional/bind_internal.h:731:12
    #18 0x00010709d4e8 in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (base::StackSamplingProfiler::SamplingThread::*&&)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), base::StackSamplingProfiler::SamplingThread*, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>&&>, void, 0ul, 1ul>::MakeItSo<void (base::StackSamplingProfiler::SamplingThread::*)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>>>(void (base::StackSamplingProfiler::SamplingThread::*&&)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>>&&) /Users/happy/chromium/src/base/functional/bind_internal.h:923:12
    #19 0x00010709d4e8 in void base::internal::Invoker<base::internal::FunctorTraits<void (base::StackSamplingProfiler::SamplingThread::*&&)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), base::StackSamplingProfiler::SamplingThread*, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>&&>, base::internal::BindState<true, true, false, void (base::StackSamplingProfiler::SamplingThread::*)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>>, void ()>::RunImpl<void (base::StackSamplingProfiler::SamplingThread::*)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>>, 0ul, 1ul>(void (base::StackSamplingProfiler::SamplingThread::*&&)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), std::__Cr::tuple<base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>) /Users/happy/chromium/src/base/functional/bind_internal.h:1060:14
    #20 0x00010709d4e8 in base::internal::Invoker<base::internal::FunctorTraits<void (base::StackSamplingProfiler::SamplingThread::*&&)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), base::StackSamplingProfiler::SamplingThread*, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>&&>, base::internal::BindState<true, true, false, void (base::StackSamplingProfiler::SamplingThread::*)(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>), base::internal::UnretainedWrapper<base::StackSamplingProfiler::SamplingThread, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>>, void ()>::RunOnce(base::internal::BindStateBase*) /Users/happy/chromium/src/base/functional/bind_internal.h:973:12
    #21 0x00010714453c in base::OnceCallback<void ()>::Run() && /Users/happy/chromium/src/base/functional/callback.h:156:12
    #22 0x00010714453c in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) /Users/happy/chromium/src/base/task/common/task_annotator.cc:209:34
    #23 0x0001071bb660 in void base::TaskAnnotator::RunTask<base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_3>(perfetto::StaticString, base::PendingTask&, base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_3&&) /Users/happy/chromium/src/base/task/common/task_annotator.h:106:5
    #24 0x0001071bb660 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) /Users/happy/chromium/src/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:456:23
    #25 0x0001071baa5c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() /Users/happy/chromium/src/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330:40
    #26 0x000106feb1ac in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) /Users/happy/chromium/src/base/message_loop/message_pump_default.cc:42:55
    #27 0x0001071bc9a8 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) /Users/happy/chromium/src/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:629:12
    #28 0x0001070b6de8 in base::RunLoop::Run(base::Location const&) /Users/happy/chromium/src/base/run_loop.cc:134:14
    #29 0x00010724da68 in base::Thread::Run(base::RunLoop*) /Users/happy/chromium/src/base/threading/thread.cc:344:13
    #30 0x00010724decc in base::Thread::ThreadMain() /Users/happy/chromium/src/base/threading/thread.cc:419:3
    #31 0x0001072b5e20 in base::(anonymous namespace)::ThreadFunc(void*) /Users/happy/chromium/src/base/threading/platform_thread_posix.cc:103:13
    #32 0x00010544c01c in __sanitizer_weak_hook_memcmp ??:0:0
    #33 0x00019717c2e0 in _pthread_deallocate ??:0:0
    #24 0x54268001971770f8  (<unknown module>)

Thread T2 created by T0 here:
    #0 0x000105446d8c in __sanitizer_weak_hook_memcmp ??:0:0
    #1 0x0001072b53e4 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) /Users/happy/chromium/src/base/threading/platform_thread_posix.cc:151:13
    #2 0x00010724c8ac in base::Thread::StartWithOptions(base::Thread::Options) /Users/happy/chromium/src/base/threading/thread.cc:211:26
    #3 0x00010724c358 in base::Thread::Start() /Users/happy/chromium/src/base/threading/thread.cc:169:10
    #4 0x000107097e04 in base::StackSamplingProfiler::SamplingThread::GetOrCreateTaskRunnerForAdd() /Users/happy/chromium/src/base/profiler/stack_sampling_profiler.cc:513:3
    #5 0x00010709791c in base::StackSamplingProfiler::SamplingThread::Add(std::__Cr::unique_ptr<base::StackSamplingProfiler::SamplingThread::CollectionContext, std::__Cr::default_delete<base::StackSamplingProfiler::SamplingThread::CollectionContext>>) /Users/happy/chromium/src/base/profiler/stack_sampling_profiler.cc:398:7
    #6 0x00010709c938 in base::StackSamplingProfiler::Start() /Users/happy/chromium/src/base/profiler/stack_sampling_profiler.cc:938:49
    #7 0x00011c18dfa0 in sampling_profiler::ThreadProfiler::ThreadProfiler(sampling_profiler::ProfilerThreadType, scoped_refptr<base::SingleThreadTaskRunner>) /Users/happy/chromium/src/components/sampling_profiler/thread_profiler.cc:212:22
    #8 0x00011c18c96c in sampling_profiler::ThreadProfiler::ThreadProfiler(sampling_profiler::ProfilerThreadType, scoped_refptr<base::SingleThreadTaskRunner>) /Users/happy/chromium/src/components/sampling_profiler/thread_profiler.cc:200:57
    #9 0x00011c18c96c in sampling_profiler::ThreadProfiler::CreateAndStartOnMainThread() /Users/happy/chromium/src/components/sampling_profiler/thread_profiler.cc:118:28
    #10 0x0001254eb228 in ChromeContentRendererClient::ChromeContentRendererClient() /Users/happy/chromium/src/chrome/renderer/chrome_content_renderer_client.cc:385:7
    #11 0x00011aa8e8a8 in base::LazyInstanceTraitsBase<ChromeContentRendererClient>::New(void*) /Users/happy/chromium/src/base/lazy_instance.h:71:27
    #12 0x00011aa8e8a8 in base::internal::DestructorAtExitLazyInstanceTraits<ChromeContentRendererClient>::New(void*) /Users/happy/chromium/src/base/lazy_instance.h:95:12
    #13 0x00011aa8e8a8 in ChromeContentRendererClient* base::subtle::GetOrCreateLazyPointer<ChromeContentRendererClient>(std::__Cr::atomic<unsigned long>&, ChromeContentRendererClient* (*)(void*), void*, void (*)(void*), void*) /Users/happy/chromium/src/base/lazy_instance_helpers.h:83:46
    #14 0x00011aa8e8a8 in base::LazyInstance<ChromeContentRendererClient, base::internal::DestructorAtExitLazyInstanceTraits<ChromeContentRendererClient>>::Pointer() /Users/happy/chromium/src/base/lazy_instance.h:158:12
    #15 0x00011aa8e8a8 in ChromeMainDelegate::CreateContentRendererClient() /Users/happy/chromium/src/chrome/app/chrome_main_delegate.cc:1635:43
    #16 0x000133e878d0 in content::ContentClientInitializer::Set(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::ContentMainDelegate*) /Users/happy/chromium/src/content/app/content_main_runner_impl.cc:573:45
    #17 0x000133e86f28 in content::ContentMainRunnerImpl::Initialize(content::ContentMainParams) /Users/happy/chromium/src/content/app/content_main_runner_impl.cc:975:3
    #18 0x000133e83f1c in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) /Users/happy/chromium/src/content/app/content_main.cc:340:38
    #19 0x000133e844ac in content::ContentMain(content::ContentMainParams) /Users/happy/chromium/src/content/app/content_main.cc:387:10
    #20 0x00011aa884d0 in ChromeMain /Users/happy/chromium/src/chrome/app/chrome_main.cc:222:12

SUMMARY: AddressSanitizer: heap-use-after-free (/Users/happy/chromium/src/out/asan/libbase.dylib:arm64+0x1309a8)
Shadow bytes around the buggy address:
  0x6090000dfc00: fa fa fa fa fa fa f7 fa 00 00 fa fa fa fa fa fa
  0x6090000dfc80: fa fa fa fa fa fa fa fa f7 fa 00 00 fa fa fa fa
  0x6090000dfd00: fa fa fa fa fa fa fa fa fa fa f7 fa fd fa fa fa
  0x6090000dfd80: fa fa fa fa fa fa fa fa fa fa fa fa f7 fa fd fa
  0x6090000dfe00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
=>0x6090000dfe80:[fd]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6090000dff00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6090000dff80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6090000e0000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6090000e0080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6090000e0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==39578==ADDITIONAL INFO

==39578==Note: Please include this section with the ASan report.
Task trace:
    #0 0x00010708fa54 in base::StackSampler::RecordStackFrames(base::StackBuffer*, base::PlatformThreadId, base::OnceCallback<void ()>) stack_sampler.cc:263
    #1 0x00010709b34c in base::StackSamplingProfiler::SamplingThread::RecordSampleTask(int) stack_sampling_profiler.cc:749
    #2 0x00010709b34c in base::StackSamplingProfiler::SamplingThread::RecordSampleTask(int) stack_sampling_profiler.cc:749
    #3 0x00010709b34c in base::StackSamplingProfiler::SamplingThread::RecordSampleTask(int) stack_sampling_profiler.cc:749


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==39578==END OF ADDITIONAL INFO
==39578==ABORTING