Note: Google Test filter = CJSFieldSetDisplayUAFEmbedderTest.*
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from CJSFieldSetDisplayUAFEmbedderTest
[ RUN      ] CJSFieldSetDisplayUAFEmbedderTest.SetDisplayArgSequencingUAF
=================================================================
==1604==ERROR: AddressSanitizer: heap-use-after-free on address 0x7218f91e0a30 at pc 0x572bfbe48f68 bp 0x7fff9ae4c2a0 sp 0x7fff9ae4c298
READ of size 8 at 0x7218f91e0a30 thread T0
    #0 0x572bfbe48f67 in CPDFSDK_FormFillEnvironment::GetInteractiveForm() gen/third_party/libc++/src/include/__memory/unique_ptr.h:275:12
    #1 0x572bfc46139f in (anonymous namespace)::SetDisplay(CPDFSDK_FormFillEnvironment*, fxcrt::WideString const&, int, int) third_party/pdfium/fxjs/cjs_field.cpp:328:50
    #2 0x572bfc46121f in CJS_Field::set_display(CJS_Runtime*, v8::Local<v8::Value>) third_party/pdfium/fxjs/cjs_field.cpp:1278:5
    #3 0x572bfc477088 in void JSPropSetter<CJS_Field, &CJS_Field::set_display(CJS_Runtime*, v8::Local<v8::Value>)>(char const*, char const*, v8::Local<v8::Name>, v8::Local<v8::Value>, v8::PropertyCallbackInfo<v8::Boolean> const&) third_party/pdfium/fxjs/js_define.h:113:23
    #4 0x572bfcec606a in v8::internal::PropertyCallbackArguments::CallAccessorSetter(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::AccessorInfo>, v8::internal::DirectHandle<v8::internal::Name>, v8::internal::DirectHandle<v8::internal::Object>) v8/src/api/api-arguments-inl.h:633:3
    #5 0x572bfd68d9e9 in v8::internal::Object::SetPropertyWithAccessor(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>) v8/src/objects/objects.cc:1663:24
    #6 0x572bfd693af1 in v8::internal::Object::SetPropertyInternal(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>, v8::internal::StoreOrigin, bool*) v8/src/objects/objects.cc:2469:16
    #7 0x572bfd688756 in v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) v8/src/objects/objects.cc:2563:9
    #8 0x572bfcea5a44 in v8::internal::StoreIC::Store(v8::internal::Handle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::Handle<v8::internal::Name>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin) v8/src/ic/ic.cc:2187:23
    #9 0x572bfceb5031 in v8::internal::Runtime_StoreIC_Miss(int, unsigned long*, v8::internal::Isolate*) v8/src/ic/ic.cc:3313:40
    #10 0x572c016194b5 in Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit crtstuff.c
    #11 0x572c017202ec in Builtins_SetNamedPropertyHandler crtstuff.c
    #12 0x572c01567956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #13 0x572c015646db in Builtins_JSEntryTrampoline crtstuff.c
    #14 0x572c0156442a in Builtins_JSEntry crtstuff.c
    #15 0x572bfc916bd1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #16 0x572bfc919532 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) v8/src/execution/execution.cc:575:10
    #17 0x572bfc565fc3 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) v8/src/api/api.cc:2042:7
    #18 0x572bfc3ff7fb in CFXJS_Engine::Execute(fxcrt::WideString const&) third_party/pdfium/fxjs/cfxjs_engine.cpp:612:25
    #19 0x572bfc456c00 in CJS_EventContext::RunScript(fxcrt::WideString const&) third_party/pdfium/fxjs/cjs_event_context.cpp:49:21
    #20 0x572bfbe4c754 in CPDFSDK_FormFillEnvironment::RunScript(fxcrt::WideString const&, std::__Cr::function<void (IJS_EventContext*)> const&) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:1278:12
    #21 0x572bfbe4a10e in CPDFSDK_FormFillEnvironment::ExecuteDocumentOpenAction(CPDF_Action const&, std::__Cr::set<CPDF_Dictionary const*, std::__Cr::less<CPDF_Dictionary const*>, std::__Cr::allocator<CPDF_Dictionary const*>>*) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:1211:3
    #22 0x572bfbe48a52 in CPDFSDK_FormFillEnvironment::ProcOpenAction() third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:905:10
    #23 0x572bfaf76cf2 in CJSFieldSetDisplayUAFEmbedderTest_SetDisplayArgSequencingUAF_Test::TestBody() third_party/pdfium/fxjs/cjs_field_embeddertest.cpp:72:3
    #24 0x572c01ae8bfb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #25 0x572c01aead17 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #26 0x572c01aecbf3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #27 0x572c01b1b454 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #28 0x572c01b19fca in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #29 0x572bfa79aa68 in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73
    #30 0x7538f9f9d249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7218f91e0a30 is located 80 bytes inside of 152-byte region [0x7218f91e09e0,0x7218f91e0a78)
freed by thread T0 here:
    #0 0x572bfa79a1a2 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/pdfium_embeddertests+0x2a761a2) (BuildId: 717901da6329a03e)
    #1 0x572bfb0a0283 in EmbedderTest::CloseDocument() third_party/pdfium/public/cpp/fpdf_deleters.h:48:5
    #2 0x572bfaf76e10 in (anonymous namespace)::CJSFieldSetDisplayUAFEmbedderTest::FieldBrowseTrampoline(_IPDF_JsPlatform*, void*, int) third_party/pdfium/fxjs/cjs_field_embeddertest.cpp:42:15
    #3 0x572bfbe4285f in CPDFSDK_FormFillEnvironment::JS_fieldBrowse() third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:244:28
    #4 0x572bfc46bd04 in CJS_Field::browseForFileToSubmit(CJS_Runtime*, pdfium::span<v8::Local<v8::Value>, 18446744073709551615ul, v8::Local<v8::Value>*>) third_party/pdfium/fxjs/cjs_field.cpp:2384:45
    #5 0x572bfc4861be in void JSMethod<CJS_Field, &CJS_Field::browseForFileToSubmit(CJS_Runtime*, pdfium::span<v8::Local<v8::Value>, 18446744073709551615ul, v8::Local<v8::Value>*>)>(char const*, char const*, v8::FunctionCallbackInfo<v8::Value> const&) third_party/pdfium/fxjs/js_define.h:141:35
    #6 0x572c015696d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #7 0x572c01567956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #8 0x572c015646db in Builtins_JSEntryTrampoline crtstuff.c
    #9 0x572c0156442a in Builtins_JSEntry crtstuff.c
    #10 0x572bfc916bd1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #11 0x572bfc915511 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) v8/src/execution/execution.cc:565:10
    #12 0x572bfd56d193 in T<v8::internal::Object>::MaybeType v8::internal::JSReceiver::OrdinaryToPrimitive<v8::internal::DirectHandle>(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSReceiver>, v8::internal::OrdinaryToPrimitiveHint) v8/src/objects/js-objects.cc:2229:28
    #13 0x572bfd56ca91 in T<v8::internal::Object>::MaybeType v8::internal::JSReceiver::ToPrimitive<v8::internal::DirectHandle>(v8::internal::Isolate*, T<v8::internal::JSReceiver>, v8::internal::ToPrimitiveHint) v8/src/objects/js-objects.cc:2193:10
    #14 0x572bfd64cf23 in T<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber>>::MaybeType v8::internal::Object::ConvertToNumber<v8::internal::DirectHandle>(v8::internal::Isolate*, T<v8::internal::Object>) v8/src/objects/objects.cc:329:9
    #15 0x572bfd64e2a4 in T<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber>>::MaybeType v8::internal::Object::ConvertToInt32<v8::internal::DirectHandle>(v8::internal::Isolate*, T<v8::internal::Object>) v8/src/objects/objects.cc:393:46
    #16 0x572bfc576965 in v8::Value::Int32Value(v8::Local<v8::Context>) const v8/src/objects/objects-inl.h:704:10
    #17 0x572bfc4bfe28 in fxv8::ReentrantToInt32Helper(v8::Isolate*, v8::Local<v8::Value>) third_party/pdfium/fxjs/fxv8.cpp:139:18
    #18 0x572bfc46120f in CJS_Field::set_display(CJS_Runtime*, v8::Local<v8::Value>) third_party/pdfium/fxjs/cjs_field.cpp:1279:26
    #19 0x572bfc477088 in void JSPropSetter<CJS_Field, &CJS_Field::set_display(CJS_Runtime*, v8::Local<v8::Value>)>(char const*, char const*, v8::Local<v8::Name>, v8::Local<v8::Value>, v8::PropertyCallbackInfo<v8::Boolean> const&) third_party/pdfium/fxjs/js_define.h:113:23
    #20 0x572bfcec606a in v8::internal::PropertyCallbackArguments::CallAccessorSetter(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::AccessorInfo>, v8::internal::DirectHandle<v8::internal::Name>, v8::internal::DirectHandle<v8::internal::Object>) v8/src/api/api-arguments-inl.h:633:3
    #21 0x572bfd68d9e9 in v8::internal::Object::SetPropertyWithAccessor(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>) v8/src/objects/objects.cc:1663:24
    #22 0x572bfd693af1 in v8::internal::Object::SetPropertyInternal(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>, v8::internal::StoreOrigin, bool*) v8/src/objects/objects.cc:2469:16
    #23 0x572bfd688756 in v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) v8/src/objects/objects.cc:2563:9
    #24 0x572bfcea5a44 in v8::internal::StoreIC::Store(v8::internal::Handle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::Handle<v8::internal::Name>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin) v8/src/ic/ic.cc:2187:23
    #25 0x572bfceb5031 in v8::internal::Runtime_StoreIC_Miss(int, unsigned long*, v8::internal::Isolate*) v8/src/ic/ic.cc:3313:40
    #26 0x572c016194b5 in Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit crtstuff.c
    #27 0x572c017202ec in Builtins_SetNamedPropertyHandler crtstuff.c
    #28 0x572c01567956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #29 0x572c015646db in Builtins_JSEntryTrampoline crtstuff.c

previously allocated by thread T0 here:
    #0 0x572bfa79959d in operator new(unsigned long) (/chromium/chromium/src/out/asan/pdfium_embeddertests+0x2a7559d) (BuildId: 717901da6329a03e)
    #1 0x572bfbeabffc in FPDFDOC_InitFormFillEnvironment gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x572bfb0a1292 in EmbedderTest::SetupFormFillEnvironment(fpdf_document_t__*, EmbedderTest::JavaScriptOption) third_party/pdfium/testing/embedder_test.cpp:784:7
    #3 0x572bfb0a23ef in EmbedderTest::OpenDocumentHelper(fxcrt::ByteString const&, EmbedderTest::LinearizeOption, EmbedderTest::JavaScriptOption, FakeFileAccess*, std::__Cr::unique_ptr<fpdf_document_t__, FPDFDocumentDeleter>*, std::__Cr::unique_ptr<fpdf_avail_t__, FPDFAvailDeleter>*, std::__Cr::unique_ptr<fpdf_form_handle_t__, FPDFFormHandleDeleter>*) third_party/pdfium/testing/embedder_test.cpp:712:22
    #4 0x572bfb0a200a in EmbedderTest::OpenDocumentWithOptions(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, fxcrt::ByteString const&, EmbedderTest::LinearizeOption, EmbedderTest::JavaScriptOption) third_party/pdfium/testing/embedder_test.cpp:643:10
    #5 0x572bfb0a14bd in EmbedderTest::OpenDocument(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) third_party/pdfium/testing/embedder_test.cpp:596:10
    #6 0x572bfaf76a39 in CJSFieldSetDisplayUAFEmbedderTest_SetDisplayArgSequencingUAF_Test::TestBody() third_party/pdfium/fxjs/cjs_field_embeddertest.cpp:57:15
    #7 0x572c01ae8bfb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x572c01aead17 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #9 0x572c01aecbf3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #10 0x572c01b1b454 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #11 0x572c01b19fca in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #12 0x572bfa79aa68 in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73
    #13 0x7538f9f9d249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__memory/unique_ptr.h:275:12 in CPDFSDK_FormFillEnvironment::GetInteractiveForm()
Shadow bytes around the buggy address:
  0x7218f91e0780: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
  0x7218f91e0800: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7218f91e0880: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x7218f91e0900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7218f91e0980: fd fd fd fa fa fa fa fa fa fa fa fa fd fd fd fd
=>0x7218f91e0a00: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fa
  0x7218f91e0a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7218f91e0b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7218f91e0b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7218f91e0c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7218f91e0c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb