=================================================================
==60948==ERROR: AddressSanitizer: heap-use-after-free on address 0x120150a365c0 at pc 0x7ffcb1e268b4 bp 0x006ab5fed5a0 sp 0x006ab5fed5e8
READ of size 8 at 0x120150a365c0 thread T0
    #0 0x7ffcb1e268b3 in blink::TransitionInterpolation::Apply(class blink::InterpolationEnvironment &) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\animation\transition_interpolation.cc:45:9
    #1 0x7ffcb1872979 in blink::StyleCascade::ApplyInterpolation(class blink::CSSProperty const &, class blink::CascadePriority, class blink::HeapVector<class cppgc::internal::BasicMember<class blink::Interpolation, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 1> const &, class blink::CascadeResolver &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\resolver\style_cascade.cc:828:48
    #2 0x7ffcb1872119 in blink::StyleCascade::ApplyInterpolationMap(class blink::BasicHeapHashMap<1, class blink::PropertyHandle, class cppgc::internal::BasicMember<class blink::HeapVector<class cppgc::internal::BasicMember<class blink::Interpolation, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 1>, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, struct WTF::HashTraits<class blink::PropertyHandle>, struct WTF::HashTraits<class cppgc::internal::BasicMember<class blink::HeapVector<class cppgc::internal::BasicMember<class blink::Interpolation, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 1>, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>>> const &, enum blink::CascadeOrigin, unsigned __int64, class blink::CascadeResolver &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\resolver\style_cascade.cc:809:5
    #3 0x7ffcb1865ab3 in blink::StyleCascade::ApplyInterpolations C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\resolver\style_cascade.cc:775
    #4 0x7ffcb1865ab3 in blink::StyleCascade::Apply(class blink::CascadeFilter) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\resolver\style_cascade.cc:281:3
    #5 0x7ffcb18a7f2b in blink::StyleResolver::ApplyAnimatedStyle(class blink::StyleResolverState &, class blink::StyleCascade &, class blink::StyleRecalcContext const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\resolver\style_resolver.cc:2469:13
    #6 0x7ffcb18a455e in blink::StyleResolver::ResolveStyle(class blink::Element *, class blink::StyleRecalcContext const &, class blink::StyleRequest const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\resolver\style_resolver.cc:1314:7
    #7 0x7ffcb1be9500 in blink::Element::OriginalStyleForLayoutObject(class blink::StyleRecalcContext const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:3983:43
    #8 0x7ffcb1be8cc0 in blink::Element::StyleForLayoutObject(class blink::StyleRecalcContext const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:3938:13
    #9 0x7ffcb1becced in blink::Element::RecalcOwnStyle(class blink::StyleRecalcChange, class blink::StyleRecalcContext const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:4500:17
    #10 0x7ffcb1bea89c in blink::Element::RecalcStyle(class blink::StyleRecalcChange, class blink::StyleRecalcContext const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:4136:20
    #11 0x7ffcb019fe28 in blink::StyleEngine::RecalcStyle(class blink::StyleRecalcChange, class blink::StyleRecalcContext const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_engine.cc:3816:16
    #12 0x7ffcb01a4592 in blink::StyleEngine::RecalcStyle C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_engine.cc:3869
    #13 0x7ffcb01a4592 in blink::StyleEngine::UpdateStyleAndLayoutTree(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_engine.cc:3987:7
    #14 0x7ffcb1d518f3 in blink::Document::UpdateStyle(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\document.cc:2522:16
    #15 0x7ffcb1d4ea5e in blink::Document::UpdateStyleAndLayoutTreeForThisDocument(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\document.cc:2460:3
    #16 0x7ffcaf5f99c5 in blink::LocalFrameView::UpdateStyleAndLayoutInternal(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3192:30
    #17 0x7ffcaf5e5850 in blink::LocalFrameView::UpdateStyleAndLayout(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\local_frame_view.cc:3136:18
    #18 0x7ffcb1d4ff5d in blink::Document::UpdateStyleAndLayout(enum blink::DocumentUpdateReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\document.cc:2834:17
    #19 0x7ffcafc35598 in blink::FrameSelection::ComputeAbsoluteBounds(class gfx::Rect &, class gfx::Rect &) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\frame_selection.cc:738:26
    #20 0x7ffcaf4c1df1 in blink::WebFrameWidgetImpl::CalculateSelectionBounds(class gfx::Rect &, class gfx::Rect &, class gfx::Rect *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\web_frame_widget_impl.cc:4708:18
    #21 0x7ffcaf4c12b2 in blink::WebFrameWidgetImpl::GetSelectionBoundsInWindow(class gfx::Rect *, class gfx::Rect *, class gfx::Rect *, enum base::i18n::TextDirection *, enum base::i18n::TextDirection *, bool *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\web_frame_widget_impl.cc:3865:3
    #22 0x7ffcb0f6357d in blink::WidgetBase::UpdateSelectionBounds(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\widget\widget_base.cc:1470:23
    #23 0x7ffcb0f630db in blink::WidgetBase::WillBeginMainFrame(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\widget\widget_base.cc:997:3
    #24 0x7ffca7fa1a15 in cc::LayerTreeHost::WillBeginMainFrame(void) C:\b\s\w\ir\cache\builder\src\cc\trees\layer_tree_host.cc:372:12
    #25 0x7ffca7f731cd in cc::ProxyMain::BeginMainFrame(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>) C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_main.cc:274:21
    #26 0x7ffca7f694de in base::internal::DecayedFunctorTraits<void (cc::ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #27 0x7ffca7f694de in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (cc::ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #28 0x7ffca7f694de in base::internal::Invoker<base::internal::FunctorTraits<void (cc::ProxyMain::*&&)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain> &&,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > &&>,base::internal::BindState<1,1,0,void (cc::ProxyMain::*)(std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,std::__Cr::unique_ptr<cc::BeginMainFrameAndCommitState,std::__Cr::default_delete<cc::BeginMainFrameAndCommitState> > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #29 0x7ffca7f694de in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl cc::ProxyMain::*&&)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain> &&, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl cc::ProxyMain::*)(class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>), class base::WeakPtr<class cc::ProxyMain>, class std::__Cr::unique_ptr<struct cc::BeginMainFrameAndCommitState, struct std::__Cr::default_delete<struct cc::BeginMainFrameAndCommitState>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #30 0x7ffca2cf9343 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #31 0x7ffca2cf9343 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #32 0x7ffca2ccc1c4 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #33 0x7ffca2ccc1c4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #34 0x7ffca2ccb03f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #35 0x7ffca2e21d37 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #36 0x7ffca2ccdeb1 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
    #37 0x7ffca2d63c8e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #38 0x7ffcb8302269 in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:369:16
    #39 0x7ffc9f8ae236 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:780:14
    #40 0x7ffc9f8b0561 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1154:10
    #41 0x7ffc9f8a4695 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359:36
    #42 0x7ffc9f8a523d in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:372:10
    #43 0x7ffc903216c7 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
    #44 0x7ff7e79f47ae in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
    #45 0x7ff7e79f2015 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20
    #46 0x7ff7e807307b in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #47 0x7ff7e807307b in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #48 0x7ffe20607373  (C:\WINDOWS\System32\KERNEL32.DLL+0x180017373)
    #49 0x7ffe20e7cc90  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18004cc90)

0x120150a365c0 is located 0 bytes inside of 64-byte region [0x120150a365c0,0x120150a36600)
freed by thread T0 here:
    #0 0x7ffd765c932d  (G:\chromium-136.0.7091.2-win64-asan\clang_rt.asan_dynamic-x86_64.dll+0x18004932d)
    #1 0x7ffcb8fe8a23 in free C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win_thunk.cpp:55
    #2 0x7ffcb1f26401 in blink::InterpolationType::operator delete C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\animation\interpolation_type.h:31
    #3 0x7ffcb1f26401 in blink::CSSVisibilityInterpolationType::`scalar deleting dtor'(unsigned int) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\animation\css_length_interpolation_type.h:16:19
    #4 0x7ffcb03054d9 in std::__Cr::default_delete<const blink::InterpolationType>::operator() C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:76
    #5 0x7ffcb03054d9 in std::__Cr::unique_ptr<const blink::InterpolationType,std::__Cr::default_delete<const blink::InterpolationType> >::reset C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:287
    #6 0x7ffcb03054d9 in std::__Cr::unique_ptr<const blink::InterpolationType,std::__Cr::default_delete<const blink::InterpolationType> >::~unique_ptr C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:256
    #7 0x7ffcb03054d9 in WTF::VectorTypeOperations<std::__Cr::unique_ptr<const blink::InterpolationType,std::__Cr::default_delete<const blink::InterpolationType> >,WTF::PartitionAllocator>::Destruct C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:177
    #8 0x7ffcb03054d9 in WTF::Vector<std::__Cr::unique_ptr<const blink::InterpolationType,std::__Cr::default_delete<const blink::InterpolationType> >,0,WTF::PartitionAllocator>::~Vector C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:1620
    #9 0x7ffcb03054d9 in blink::PropertyRegistration::~PropertyRegistration(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\property_registration.cc:58:45
    #10 0x7ffc9776328a in cppgc::internal::`anonymous namespace'::SweepFinalizer::FinalizePage::<lambda_1>::operator() C:\b\s\w\ir\cache\builder\src\v8\src\heap\cppgc\sweeper.cc:505
    #11 0x7ffc9776328a in cppgc::internal::`anonymous namespace'::SweepFinalizer::FinalizePage C:\b\s\w\ir\cache\builder\src\v8\src\heap\cppgc\sweeper.cc:519:7
    #12 0x7ffc977683b9 in cppgc::internal::`anonymous namespace'::SweepFinalizer::FinalizeWithDeadline C:\b\s\w\ir\cache\builder\src\v8\src\heap\cppgc\sweeper.cc:488
    #13 0x7ffc977683b9 in cppgc::internal::`anonymous namespace'::MutatorThreadSweeper::FinalizeAndSweepWithDeadline C:\b\s\w\ir\cache\builder\src\v8\src\heap\cppgc\sweeper.cc:658:20
    #14 0x7ffc9775693d in cppgc::internal::Sweeper::SweeperImpl::PerformSweepOnMutatorThread C:\b\s\w\ir\cache\builder\src\v8\src\heap\cppgc\sweeper.cc:1367:24
    #15 0x7ffc9775daeb in cppgc::internal::Sweeper::SweeperImpl::SweepInForegroundTaskImpl(class v8::base::TimeDelta, enum cppgc::internal::StatsCollector::ScopeId) C:\b\s\w\ir\cache\builder\src\v8\src\heap\cppgc\sweeper.cc:1508:39
    #16 0x7ffc9775d6d3 in cppgc::internal::Sweeper::SweeperImpl::SweepForLowPriorityTask C:\b\s\w\ir\cache\builder\src\v8\src\heap\cppgc\sweeper.cc:1051
    #17 0x7ffc9775d6d3 in cppgc::internal::Sweeper::SweeperImpl::IncrementalSweepTask::Run(void) C:\b\s\w\ir\cache\builder\src\v8\src\heap\cppgc\sweeper.cc:1466:20
    #18 0x7ffca9d1f4e6 in base::internal::DecayedFunctorTraits<void (v8::Task::*)(),std::__Cr::unique_ptr<v8::Task,std::__Cr::default_delete<v8::Task> > &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #19 0x7ffca9d1f4e6 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (v8::Task::*&&)(),std::__Cr::unique_ptr<v8::Task,std::__Cr::default_delete<v8::Task> > &&>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
    #20 0x7ffca9d1f4e6 in base::internal::Invoker<base::internal::FunctorTraits<void (v8::Task::*&&)(),std::__Cr::unique_ptr<v8::Task,std::__Cr::default_delete<v8::Task> > &&>,base::internal::BindState<1,1,0,void (v8::Task::*)(),std::__Cr::unique_ptr<v8::Task,std::__Cr::default_delete<v8::Task> > >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #21 0x7ffca9d1f4e6 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl v8::Task::*&&)(void), class std::__Cr::unique_ptr<class v8::Task, struct std::__Cr::default_delete<class v8::Task>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl v8::Task::*)(void), class std::__Cr::unique_ptr<class v8::Task, struct std::__Cr::default_delete<class v8::Task>>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #22 0x7ffca2cf9343 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #23 0x7ffca2cf9343 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #24 0x7ffca2ccc1c4 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #25 0x7ffca2ccc1c4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #26 0x7ffca2ccb03f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #27 0x7ffca2e21d37 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #28 0x7ffca2ccdeb1 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:629:12
    #29 0x7ffca2d63c8e in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134:14
    #30 0x7ffcb8302269 in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:369:16
    #31 0x7ffc9f8ae236 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:780:14
    #32 0x7ffc9f8b0561 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1154:10
    #33 0x7ffc9f8a4695 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359:36
    #34 0x7ffc9f8a523d in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:372:10
    #35 0x7ffc903216c7 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:222:12
    #36 0x7ff7e79f47ae in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201:12
    #37 0x7ff7e79f2015 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352:20
    #38 0x7ff7e807307b in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #39 0x7ff7e807307b in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #40 0x7ffe20607373  (C:\WINDOWS\System32\KERNEL32.DLL+0x180017373)
    #41 0x7ffe20e7cc90  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18004cc90)

previously allocated by thread T0 here:
    #0 0x7ffd765c943d  (G:\chromium-136.0.7091.2-win64-asan\clang_rt.asan_dynamic-x86_64.dll+0x18004943d)
    #1 0x7ffcb8fe8a43 in malloc C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win_thunk.cpp:64
    #2 0x7ffca2ea8e89 in partition_alloc::PartitionRoot::AllocInternal C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\partition_root.h:2144
    #3 0x7ffca2ea8e89 in partition_alloc::PartitionRoot::AllocInline C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\partition_root.h:543
    #4 0x7ffca2ea8e89 in partition_alloc::PartitionRoot::Alloc<0>(unsigned __int64, char const *) C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\partition_root.h:537:12
    #5 0x7ffcb1fbf499 in blink::InterpolationType::operator new C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\animation\interpolation_type.h:31
    #6 0x7ffcb1fbf499 in std::__Cr::make_unique<class blink::CSSNumberInterpolationType, class blink::PropertyHandle &, class blink::PropertyRegistration const *, bool, 0>(class blink::PropertyHandle &, class blink::PropertyRegistration const *&&, bool &&) C:\b\s\w\ir\cache\builder\src\third_party\libc++\src\include\__memory\unique_ptr.h:754:26
    #7 0x7ffcb1fbc7d8 in blink::CreateInterpolationTypeForCSSSyntax C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\animation\css_interpolation_types_map.cc:495
    #8 0x7ffcb1fbc7d8 in blink::CSSInterpolationTypesMap::CreateInterpolationTypesForCSSSyntax(class WTF::AtomicString const &, class blink::CSSSyntaxDefinition const &, class blink::PropertyRegistration const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\animation\css_interpolation_types_map.cc:538:9
    #9 0x7ffcb0307ecc in blink::PropertyRegistration::PropertyRegistration C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\property_registration.cc:52
    #10 0x7ffcb0307ecc in cppgc::MakeGarbageCollectedTrait<class blink::PropertyRegistration>::Call<class WTF::AtomicString const &, class blink::CSSSyntaxDefinition &, bool &, class blink::CSSValue const *&, class blink::StyleRuleProperty *>(class cppgc::AllocationHandle &, class WTF::AtomicString const &, class blink::CSSSyntaxDefinition &, bool &, class blink::CSSValue const *&, class blink::StyleRuleProperty *&&) C:\b\s\w\ir\cache\builder\src\v8\include\cppgc\allocation.h:240:32
    #11 0x7ffcb0306c29 in cppgc::MakeGarbageCollected C:\b\s\w\ir\cache\builder\src\v8\include\cppgc\allocation.h:278
    #12 0x7ffcb0306c29 in blink::MakeGarbageCollected C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\heap\garbage_collected.h:37
    #13 0x7ffcb0306c29 in blink::PropertyRegistration::MaybeCreateForDeclaredProperty(class blink::Document &, class WTF::AtomicString const &, class blink::StyleRuleProperty &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\property_registration.cc:184:10
    #14 0x7ffcb019b871 in blink::StyleEngine::AddPropertyRules(class blink::StyleEngine::AtRuleCascadeMap &, class blink::RuleSet const &, bool) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_engine.cc:3437:9
    #15 0x7ffcb01961a0 in blink::StyleEngine::AddPropertyRulesFromSheets C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_engine.cc:3325
    #16 0x7ffcb01961a0 in blink::StyleEngine::ApplyRuleSetChanges(class blink::TreeScope &, class blink::HeapVector<struct std::__Cr::pair<class cppgc::internal::BasicMember<class blink::CSSStyleSheet, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, class cppgc::internal::BasicMember<class blink::RuleSet, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>>, 0> const &, class blink::HeapVector<struct std::__Cr::pair<class cppgc::internal::BasicMember<class blink::CSSStyleSheet, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, class cppgc::internal::BasicMember<class blink::RuleSet, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>>, 0> const &, class blink::HeapVector<class cppgc::internal::BasicMember<class blink::RuleSetDiff, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 0> const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_engine.cc:3042:7
    #17 0x7ffcb014eb9b in blink::TreeScopeStyleSheetCollection::ApplyActiveStyleSheetChanges(class blink::StyleSheetCollection &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\tree_scope_style_sheet_collection.cc:56:34
    #18 0x7ffcb0692681 in blink::DocumentStyleSheetCollection::UpdateActiveStyleSheets(class blink::StyleEngine &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\document_style_sheet_collection.cc:127:3
    #19 0x7ffcb017b71e in blink::StyleEngine::UpdateActiveStyleSheets(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_engine.cc:685:39
    #20 0x7ffcb0172b03 in blink::StyleEngine::UpdateActiveStyle(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\css\style_engine.cc:763:3
    #21 0x7ffcb1d4e9ee in blink::Document::UpdateStyleAndLayoutTreeForThisDocument(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\document.cc:2453:16
    #22 0x7ffcb1d4d8e3 in blink::Document::UpdateStyleAndLayoutTree(class blink::LayoutUpgrade &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\document.cc:2320:5
    #23 0x7ffcb1d4310f in blink::Document::UpdateStyleAndLayoutTree(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\document.cc:2295:3
    #24 0x7ffcafc37705 in blink::FrameSelection::FocusedOrActiveStateChanged(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\editing\frame_selection.cc:1038:17
    #25 0x7ffcaf4aafd4 in blink::WebFrameWidgetImpl::FocusChanged(enum blink::mojom::FocusState) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\web_frame_widget_impl.cc:1843:11
    #26 0x7ffcb0f9429e in base::internal::DecayedFunctorTraits<void (blink::WidgetBase::*)(blink::mojom::FocusState),base::WeakPtr<blink::WidgetBase> &&,blink::mojom::FocusState &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #27 0x7ffcb0f9429e in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (blink::WidgetBase::*&&)(blink::mojom::FocusState),base::WeakPtr<blink::WidgetBase> &&,blink::mojom::FocusState &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:947
    #28 0x7ffcb0f9429e in base::internal::Invoker<base::internal::FunctorTraits<void (blink::WidgetBase::*&&)(blink::mojom::FocusState),base::WeakPtr<blink::WidgetBase> &&,blink::mojom::FocusState &&>,base::internal::BindState<1,1,0,void (blink::WidgetBase::*)(blink::mojom::FocusState),base::WeakPtr<blink::WidgetBase>,blink::mojom::FocusState>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #29 0x7ffcb0f9429e in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl blink::WidgetBase::*&&)(enum blink::mojom::FocusState), class base::WeakPtr<class blink::WidgetBase> &&, enum blink::mojom::FocusState &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl blink::WidgetBase::*)(enum blink::mojom::FocusState), class base::WeakPtr<class blink::WidgetBase>, enum blink::mojom::FocusState>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #30 0x7ffcb0f93a45 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #31 0x7ffcb0f93a45 in blink::`anonymous namespace'::RunClosureIfNotSwappedOut C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\widget\input\widget_input_handler_impl.cc:37:22
    #32 0x7ffcb0f97258 in base::internal::DecayedFunctorTraits<void (*)(base::WeakPtr<blink::WidgetBase>, base::OnceCallback<void ()>),base::WeakPtr<blink::WidgetBase> &&,base::OnceCallback<void ()> &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:664
    #33 0x7ffcb0f97258 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (*&&)(base::WeakPtr<blink::WidgetBase>, base::OnceCallback<void ()>),base::WeakPtr<blink::WidgetBase> &&,base::OnceCallback<void ()> &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
    #34 0x7ffcb0f97258 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::WeakPtr<blink::WidgetBase>, base::OnceCallback<void ()>),base::WeakPtr<blink::WidgetBase> &&,base::OnceCallback<void ()> &&>,base::internal::BindState<0,1,0,void (*)(base::WeakPtr<blink::WidgetBase>, base::OnceCallback<void ()>),base::WeakPtr<blink::WidgetBase>,base::OnceCallback<void ()> >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #35 0x7ffcb0f97258 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl *&&)(class base::WeakPtr<class blink::WidgetBase>, class base::OnceCallback<(void)>), class base::WeakPtr<class blink::WidgetBase> &&, class base::OnceCallback<void __cdecl(void)> &&>, struct base::internal::BindState<0, 1, 0, void (__cdecl *)(class base::WeakPtr<class blink::WidgetBase>, class base::OnceCallback<(void)>), class base::WeakPtr<class blink::WidgetBase>, class base::OnceCallback<void __cdecl(void)>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #36 0x7ffcb0fb7dc1 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #37 0x7ffcb0fb7dc1 in blink::`anonymous namespace'::QueuedClosure::Dispatch C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\widget\input\main_thread_event_queue.cc:44:71
    #38 0x7ffcb0fac163 in blink::MainThreadEventQueue::DispatchEvents(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\widget\input\main_thread_event_queue.cc:570:11
    #39 0x7ffcb0fb8b4b in base::internal::DecayedFunctorTraits<void (blink::MainThreadEventQueue::*)(),blink::MainThreadEventQueue *&&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:731
    #40 0x7ffcb0fb8b4b in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (blink::MainThreadEventQueue::*&&)(),blink::MainThreadEventQueue *&&>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:923
    #41 0x7ffcb0fb8b4b in base::internal::Invoker<base::internal::FunctorTraits<void (blink::MainThreadEventQueue::*&&)(),blink::MainThreadEventQueue *&&>,base::internal::BindState<1,1,0,void (blink::MainThreadEventQueue::*)(),scoped_refptr<blink::MainThreadEventQueue> >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060
    #42 0x7ffcb0fb8b4b in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl blink::MainThreadEventQueue::*&&)(void), class blink::MainThreadEventQueue *&&>, struct base::internal::BindState<1, 1, 0, void (__cdecl blink::MainThreadEventQueue::*)(void), class scoped_refptr<class blink::MainThreadEventQueue>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973:12
    #43 0x7ffca2cf9343 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:156
    #44 0x7ffca2cf9343 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:209:34
    #45 0x7ffca2ccc1c4 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:106
    #46 0x7ffca2ccc1c4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:456:23
    #47 0x7ffca2ccb03f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:330:40
    #48 0x7ffca2e21d37 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55

SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\animation\transition_interpolation.cc:45:9 in blink::TransitionInterpolation::Apply(class blink::InterpolationEnvironment &) const
Shadow bytes around the buggy address:
  0x120150a36300: fa fa f7 fa 00 00 00 00 00 00 00 fa fa fa f7 fa
  0x120150a36380: 00 00 00 00 00 00 00 fa fa fa f7 fa fa fa fa fa
  0x120150a36400: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 00
  0x120150a36480: fa fa f7 fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x120150a36500: fa fa fa fa fa fa fa fa fa fa f7 fa fd fd fd fd
=>0x120150a36580: fd fd fd fa fa fa f7 fa[fd]fd fd fd fd fd fd fd
  0x120150a36600: fa fa f7 fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x120150a36680: fa fa fa fa fa fa fa fa fa fa f7 fa fa fa fa fa
  0x120150a36700: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 fa
  0x120150a36780: fa fa f7 fa 00 00 00 00 00 00 00 fa fa fa f7 fa
  0x120150a36800: 00 00 00 00 00 00 00 fa fa fa f7 fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==60948==ADDITIONAL INFO

==60948==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7ffca7f61211 in cc::ProxyImpl::ScheduledActionSendBeginMainFrame(struct viz::BeginFrameArgs const &) C:\b\s\w\ir\cache\builder\src\cc\trees\proxy_impl.cc:767:7


Command line: `"G:\chromium-136.0.7091.2-win64-asan\chrome.exe" --type=renderer --no-pre-read-main-dll --no-sandbox --file-url-path-alias="/gen=G:\chromium-136.0.7091.2-win64-asan\gen" --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1742570653892378 --launch-time-ticks=785770462192 --metrics-shmem-handle=4348,i,15483222888000177775,14057892565839972040,2097152 --field-trial-handle=2084,i,18049945435554230983,6143566284878194330,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==60948==END OF ADDITIONAL INFO
==60948==ABORTING