=================================================================
==6832==ERROR: AddressSanitizer: heap-use-after-free on address 0x009002973848 at pc 0x7ffa87bb4eb2 bp 0x008000bfaca0 sp 0x008000bface8
READ of size 8 at 0x009002973848 thread T0
    #0 0x7ffa87bb4eb1 in scoped_refptr<blink::StringImpl>::operator bool C:\b\s\w\ir\cache\builder\src\base\memory\scoped_refptr.h:319
    #1 0x7ffa87bb4eb1 in blink::String::find C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\text\wtf_string.h:409
    #2 0x7ffa87bb4eb1 in blink::AtomicString::find C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\text\atomic_string.h:192
    #3 0x7ffa87bb4eb1 in blink::AtomicString::find C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\text\atomic_string.h:195
    #4 0x7ffa87bb4eb1 in blink::AtomicString::contains C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\text\atomic_string.h:254
    #5 0x7ffa87bb4eb1 in blink::Document::ProcessBaseElement(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\document.cc:5170:17
    #6 0x7ffa87a12e17 in blink::Element::AttributeChanged(struct blink::Element::AttributeModificationParams const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:3798:3
    #7 0x7ffa84aed9de in blink::HTMLElement::AttributeChanged(struct blink::Element::AttributeModificationParams const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\html_element.cc:841:12
    #8 0x7ffa87a187ad in blink::Element::AttributeChangedWithInvalidations(struct blink::Element::AttributeModificationParams const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:3940:3
    #9 0x7ffa87a8b5a6 in blink::Element::DidModifyAttribute C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:11743
    #10 0x7ffa87a8b5a6 in blink::Element::SetAttributeInternal C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:13443
    #11 0x7ffa87a8b5a6 in blink::Element::SetAttributeWithoutValidation(class blink::QualifiedName const &, class blink::AtomicString const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:13258:3
    #12 0x7ffa8857538a in blink::`anonymous namespace'::v8_html_base_element::HrefAttributeSetCallback C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\core\v8\v8_html_base_element.cc:117:17
    #13 0x7ffa6841cdcf in v8::internal::FunctionCallbackArguments::CallOrConstruct(class v8::internal::Isolate *, class v8::internal::Tagged<class v8::internal::FunctionTemplateInfo>, bool) C:\b\s\w\ir\cache\builder\src\v8\src\api\api-arguments-inl.h:176:3
    #14 0x7ffa6841bafc in v8::internal::`anonymous namespace'::HandleApiCallHelper C:\b\s\w\ir\cache\builder\src\v8\src\builtins\builtins-api.cc:120
    #15 0x7ffa6841bafc in v8::internal::Builtins::InvokeApiFunction(class v8::internal::Isolate *, bool, class v8::internal::DirectHandle<class v8::internal::FunctionTemplateInfo>, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::base::Vector<class v8::internal::DirectHandle<class v8::internal::Object> const>, class v8::internal::DirectHandle<class v8::internal::HeapObject>) C:\b\s\w\ir\cache\builder\src\v8\src\builtins\builtins-api.cc:174:10
    #16 0x7ffa69469a1a in v8::internal::Object::SetPropertyWithAccessor(class v8::internal::LookupIterator *, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::Maybe<enum v8::internal::ShouldThrow>) C:\b\s\w\ir\cache\builder\src\v8\src\objects\objects.cc:1696:9
    #17 0x7ffa6946f38f in v8::internal::Object::SetPropertyInternal(class v8::internal::LookupIterator *, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::Maybe<enum v8::internal::ShouldThrow>, enum v8::internal::StoreOrigin, bool *) C:\b\s\w\ir\cache\builder\src\v8\src\objects\objects.cc:2473:16
    #18 0x7ffa69462d56 in v8::internal::Object::SetProperty(class v8::internal::LookupIterator *, class v8::internal::DirectHandle<class v8::internal::Object>, enum v8::internal::StoreOrigin, class v8::Maybe<enum v8::internal::ShouldThrow>) C:\b\s\w\ir\cache\builder\src\v8\src\objects\objects.cc:2567:9
    #19 0x7ffa68d68be6 in v8::internal::StoreIC::Store(class v8::internal::Handle<class v8::internal::Union<class v8::internal::Smi, class v8::internal::HeapNumber, class v8::internal::BigInt, class v8::internal::String, class v8::internal::Symbol, class v8::internal::Boolean, class v8::internal::Null, class v8::internal::Undefined, class v8::internal::JSReceiver>>, class v8::internal::Handle<class v8::internal::Name>, class v8::internal::DirectHandle<class v8::internal::Object>, enum v8::internal::StoreOrigin) C:\b\s\w\ir\cache\builder\src\v8\src\ic\ic.cc:2266:23
    #20 0x7ffa68d79ce9 in v8::internal::__RT_impl_Runtime_StoreIC_Miss C:\b\s\w\ir\cache\builder\src\v8\src\ic\ic.cc:3392
    #21 0x7ffa68d79ce9 in v8::internal::Runtime_StoreIC_Miss(int, unsigned __int64 *, class v8::internal::Isolate *) C:\b\s\w\ir\cache\builder\src\v8\src\ic\ic.cc:3364:1
    #22 0x7ffa917484f9 in Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae5384f9)
    #23 0x7ffa918524ac in Builtins_SetNamedPropertyHandler (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae6424ac)
    #24 0x7ffa916962d6 in Builtins_InterpreterEntryTrampoline (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae4862d6)
    #25 0x7ffa9169305b in Builtins_JSEntryTrampoline (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae48305b)
    #26 0x7ffa91692bbe in Builtins_JSEntry (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae482bbe)
    #27 0x7ffa687dd1c5 in v8::internal::`anonymous namespace'::Invoke C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:475:22
    #28 0x7ffa687dea0f in v8::internal::Execution::CallScript(class v8::internal::Isolate *, class v8::internal::DirectHandle<class v8::internal::JSFunction>, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::internal::DirectHandle<class v8::internal::Object>) C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:575:10
    #29 0x7ffa68307e17 in v8::Script::Run(class v8::Local<class v8::Context>, class v8::Local<class v8::Data>) C:\b\s\w\ir\cache\builder\src\v8\src\api\api.cc:2040:7
    #30 0x7ffa867eb651 in blink::V8ScriptRunner::RunCompiledScript(class v8::Isolate *, class v8::Local<class v8::Script>, class v8::Local<class v8::Data>, class blink::ExecutionContext *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\v8_script_runner.cc:509:22
    #31 0x7ffa867ed27c in blink::V8ScriptRunner::CompileAndRunScript(class blink::ScriptState *, class blink::ClassicScript *, enum blink::ExecuteScriptPolicy, class blink::V8ScriptRunner::RethrowErrorsOption) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\v8_script_runner.cc:633:22
    #32 0x7ffa82db1dd9 in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(class blink::ScriptState *, enum blink::ExecuteScriptPolicy, class blink::V8ScriptRunner::RethrowErrorsOption) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\script\classic_script.cc:227:10
    #33 0x7ffa82d54069 in blink::Script::RunScriptOnScriptState(class blink::ScriptState *, enum blink::ExecuteScriptPolicy, class blink::V8ScriptRunner::RethrowErrorsOption) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\script\script.cc:35:17
    #34 0x7ffa82d54503 in blink::Script::RunScript(class blink::LocalDOMWindow *, enum blink::ExecuteScriptPolicy, class blink::V8ScriptRunner::RethrowErrorsOption) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\script\script.cc:42:3
    #35 0x7ffa8376aef6 in blink::PendingScript::ExecuteScriptBlockInternal(class blink::Script *, class blink::ScriptElementBase *, bool, bool, bool, class base::TimeTicks, bool) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\script\pending_script.cc:312:13
    #36 0x7ffa83769ee6 in blink::PendingScript::ExecuteScriptBlock(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\script\pending_script.cc:209:3
    #37 0x7ffa837860c3 in blink::ScriptLoader::PrepareScript(enum blink::ScriptLoader::ParserBlockingInlineOption, class blink::TextPosition const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\script\script_loader.cc:1179:60
    #38 0x7ffa878287a7 in blink::HTMLParserScriptRunner::ProcessScriptElementInternal(class blink::Element *, class blink::TextPosition const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\script\html_parser_script_runner.cc:587:52
    #39 0x7ffa87827fda in blink::HTMLParserScriptRunner::ProcessScriptElement(class blink::Element *, class blink::TextPosition const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\script\html_parser_script_runner.cc:297:3
    #40 0x7ffa87875e2e in blink::HTMLDocumentParser::RunScriptsForPausedTreeBuilder(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_document_parser.cc:672:21
    #41 0x7ffa87871f28 in blink::HTMLDocumentParser::CanTakeNextToken C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_document_parser.h:232
    #42 0x7ffa87871f28 in blink::HTMLDocumentParser::PumpTokenizer(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_document_parser.cc:741:36
    #43 0x7ffa878703ae in blink::HTMLDocumentParser::PumpTokenizerIfPossible(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_document_parser.cc:635:15
    #44 0x7ffa8787ed30 in blink::HTMLDocumentParser::FinishAppend(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_document_parser.cc:1038:5
    #45 0x7ffa8787d383 in blink::HTMLDocumentParser::Append(class blink::String const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_document_parser.cc:1031:3
    #46 0x7ffa85b538c4 in blink::DecodedDataDocumentParser::UpdateDocument(class blink::String const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\decoded_data_document_parser.cc:153:3
    #47 0x7ffa85b53318 in blink::DecodedDataDocumentParser::AppendBytes(class base::span<unsigned char const, -1, unsigned char const *>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\decoded_data_document_parser.cc:72:3
    #48 0x7ffa87883df5 in blink::HTMLDocumentParser::AppendBytes(class base::span<unsigned char const, -1, unsigned char const *>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\parser\html_document_parser.cc:1405:30
    #49 0x7ffa83886eb0 in blink::DocumentLoader::EncodedBodyData::AppendToParser(class blink::DocumentLoader *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\document_loader.cc:491:22
    #50 0x7ffa83863103 in blink::DocumentLoader::CommitData(class blink::DocumentLoader::BodyData &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\document_loader.cc:1654:8
    #51 0x7ffa8385fa13 in blink::DocumentLoader::ProcessDataBuffer(class blink::DocumentLoader::BodyData *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\document_loader.cc:1936:5
    #52 0x7ffa8385e35a in blink::DocumentLoader::BodyDataReceivedImpl(class blink::DocumentLoader::BodyData &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\document_loader.cc:1380:3
    #53 0x7ffa8385dbde in blink::DocumentLoader::BodyDataReceived(class base::span<char const, -1, char const *>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\document_loader.cc:1326:3
    #54 0x7ffa7120b251 in blink::NavigationBodyLoader::MainThreadBodyReader::DataReceived(class base::span<char const, -1, char const *>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\loader\fetch\url_loader\navigation_body_loader.cc:346:23
    #55 0x7ffa71203931 in blink::`anonymous namespace'::ReadFromDataPipeImpl C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\loader\fetch\url_loader\navigation_body_loader.cc:147:17
    #56 0x7ffa712031cf in blink::NavigationBodyLoader::ReadFromDataPipe(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\loader\fetch\url_loader\navigation_body_loader.cc:548:3
    #57 0x7ffa711fe7bc in blink::NavigationBodyLoader::OnReadable(unsigned int) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\loader\fetch\url_loader\navigation_body_loader.cc:507:3
    #58 0x7ffa71201515 in blink::NavigationBodyLoader::BindURLLoaderAndStartLoadingResponseBodyIfPossible(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\loader\fetch\url_loader\navigation_body_loader.cc:605:3
    #59 0x7ffa71200f19 in blink::NavigationBodyLoader::StartLoadingBody(class blink::WebNavigationBodyLoader::Client *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\loader\fetch\url_loader\navigation_body_loader.cc:452:3
    #60 0x7ffa83869fcd in blink::DocumentLoader::StartLoadingResponse(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\document_loader.cc:2215:19
    #61 0x7ffa8387a6fb in blink::DocumentLoader::CommitNavigation(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\document_loader.cc:3306:3
    #62 0x7ffa837158b0 in blink::FrameLoader::CommitDocumentLoader(class blink::DocumentLoader *, class blink::HistoryItem *, enum blink::CommitReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\frame_loader.cc:1498:21
    #63 0x7ffa83722976 in blink::FrameLoader::CommitNavigation(class std::__Cr::unique_ptr<struct blink::WebNavigationParams, struct std::__Cr::default_delete<struct blink::WebNavigationParams>>, class std::__Cr::unique_ptr<class blink::WebDocumentLoader::ExtraData, struct std::__Cr::default_delete<class blink::WebDocumentLoader::ExtraData>>, enum blink::CommitReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\loader\frame_loader.cc:1310:3
    #64 0x7ffa84f9ce79 in blink::WebLocalFrameImpl::CommitNavigation(class std::__Cr::unique_ptr<struct blink::WebNavigationParams, struct std::__Cr::default_delete<struct blink::WebNavigationParams>>, class std::__Cr::unique_ptr<class blink::WebDocumentLoader::ExtraData, struct std::__Cr::default_delete<class blink::WebDocumentLoader::ExtraData>>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\frame\web_local_frame_impl.cc:2841:24
    #65 0x7ffa82b1c646 in content::RenderFrameImpl::CommitNavigationWithParams(class mojo::StructPtr<class blink::mojom::CommonNavigationParams>, class mojo::StructPtr<class blink::mojom::CommitNavigationParams>, class std::__Cr::unique_ptr<class blink::PendingURLLoaderFactoryBundle, struct std::__Cr::default_delete<class blink::PendingURLLoaderFactoryBundle>>, class std::__Cr::optional<class std::__Cr::vector<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>, class std::__Cr::allocator<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>>>>, class mojo::StructPtr<class blink::mojom::ControllerServiceWorkerInfo>, class mojo::StructPtr<class blink::mojom::ServiceWorkerContainerInfoForClient>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingAssociatedRemote<class blink::mojom::FetchLaterLoaderFactory>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::StructPtr<class content::mojom::CookieManagerInfo>, class mojo::StructPtr<class content::mojom::StorageInfo>, class std::__Cr::unique_ptr<class content::DocumentState, struct std::__Cr::default_delete<class content::DocumentState>>, class std::__Cr::unique_ptr<struct blink::WebNavigationParams, struct std::__Cr::default_delete<struct blink::WebNavigationParams>>) C:\b\s\w\ir\cache\builder\src\content\renderer\render_frame_impl.cc:3017:11
    #66 0x7ffa82b7a2e4 in ??@d03c3135e0a1a833bdf4f2cd124434b5@ C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:740:12
    #67 0x7ffa82b79d83 in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (content::RenderFrameImpl::*&&)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle,std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle> >, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>,std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader> > > >, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState,std::__Cr::default_delete<content::DocumentState> >, std::__Cr::unique_ptr<blink::WebNavigationParams,std::__Cr::default_delete<blink::WebNavigationParams> >),base::WeakPtr<content::RenderFrameImpl> &&,mojo::StructPtr<blink::mojom::CommonNavigationParams> &&,mojo::StructPtr<blink::mojom::CommitNavigationParams> &&,std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle,std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle> > &&,std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>,std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader> > > > &&,mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo> &&,mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient> &&,mojo::PendingRemote<network::mojom::URLLoaderFactory> &&,mojo::PendingRemote<network::mojom::URLLoaderFactory> &&,mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory> &&,mojo::PendingRemote<blink::mojom::CodeCacheHost> &&,mojo::PendingRemote<blink::mojom::CodeCacheHost> &&,mojo::StructPtr<content::mojom::CookieManagerInfo> &&,mojo::StructPtr<content::mojom::StorageInfo> &&,std::__Cr::unique_ptr<content::DocumentState,std::__Cr::default_delete<content::DocumentState> > &&>,void,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:956
    #68 0x7ffa82b79d83 in base::internal::Invoker<base::internal::FunctorTraits<void (content::RenderFrameImpl::*&&)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle,std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle> >, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>,std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader> > > >, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState,std::__Cr::default_delete<content::DocumentState> >, std::__Cr::unique_ptr<blink::WebNavigationParams,std::__Cr::default_delete<blink::WebNavigationParams> >),base::WeakPtr<content::RenderFrameImpl> &&,mojo::StructPtr<blink::mojom::CommonNavigationParams> &&,mojo::StructPtr<blink::mojom::CommitNavigationParams> &&,std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle,std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle> > &&,std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>,std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader> > > > &&,mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo> &&,mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient> &&,mojo::PendingRemote<network::mojom::URLLoaderFactory> &&,mojo::PendingRemote<network::mojom::URLLoaderFactory> &&,mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory> &&,mojo::PendingRemote<blink::mojom::CodeCacheHost> &&,mojo::PendingRemote<blink::mojom::CodeCacheHost> &&,mojo::StructPtr<content::mojom::CookieManagerInfo> &&,mojo::StructPtr<content::mojom::StorageInfo> &&,std::__Cr::unique_ptr<content::DocumentState,std::__Cr::default_delete<content::DocumentState> > &&>,base::internal::BindState<1,1,0,void (content::RenderFrameImpl::*)(mojo::StructPtr<blink::mojom::CommonNavigationParams>, mojo::StructPtr<blink::mojom::CommitNavigationParams>, std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle,std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle> >, std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>,std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader> > > >, mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>, mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingRemote<network::mojom::URLLoaderFactory>, mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::PendingRemote<blink::mojom::CodeCacheHost>, mojo::StructPtr<content::mojom::CookieManagerInfo>, mojo::StructPtr<content::mojom::StorageInfo>, std::__Cr::unique_ptr<content::DocumentState,std::__Cr::default_delete<content::DocumentState> >, std::__Cr::unique_ptr<blink::WebNavigationParams,std::__Cr::default_delete<blink::WebNavigationParams> >),base::WeakPtr<content::RenderFrameImpl>,mojo::StructPtr<blink::mojom::CommonNavigationParams>,mojo::StructPtr<blink::mojom::CommitNavigationParams>,std::__Cr::unique_ptr<blink::PendingURLLoaderFactoryBundle,std::__Cr::default_delete<blink::PendingURLLoaderFactoryBundle> >,std::__Cr::optional<std::__Cr::vector<mojo::StructPtr<blink::mojom::TransferrableURLLoader>,std::__Cr::allocator<mojo::StructPtr<blink::mojom::TransferrableURLLoader> > > >,mojo::StructPtr<blink::mojom::ControllerServiceWorkerInfo>,mojo::StructPtr<blink::mojom::ServiceWorkerContainerInfoForClient>,mojo::PendingRemote<network::mojom::URLLoaderFactory>,mojo::PendingRemote<network::mojom::URLLoaderFactory>,mojo::PendingAssociatedRemote<blink::mojom::FetchLaterLoaderFactory>,mojo::PendingRemote<blink::mojom::CodeCacheHost>,mojo::PendingRemote<blink::mojom::CodeCacheHost>,mojo::StructPtr<content::mojom::CookieManagerInfo>,mojo::StructPtr<content::mojom::StorageInfo>,std::__Cr::unique_ptr<content::DocumentState,std::__Cr::default_delete<content::DocumentState> > >,void (std::__Cr::unique_ptr<blink::WebNavigationParams,std::__Cr::default_delete<blink::WebNavigationParams> >)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069
    #69 0x7ffa82b79d83 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl content::RenderFrameImpl::*&&)(class mojo::StructPtr<class blink::mojom::CommonNavigationParams>, class mojo::StructPtr<class blink::mojom::CommitNavigationParams>, class std::__Cr::unique_ptr<class blink::PendingURLLoaderFactoryBundle, struct std::__Cr::default_delete<class blink::PendingURLLoaderFactoryBundle>>, class std::__Cr::optional<class std::__Cr::vector<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>, class std::__Cr::allocator<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>>>>, class mojo::StructPtr<class blink::mojom::ControllerServiceWorkerInfo>, class mojo::StructPtr<class blink::mojom::ServiceWorkerContainerInfoForClient>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingAssociatedRemote<class blink::mojom::FetchLaterLoaderFactory>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::StructPtr<class content::mojom::CookieManagerInfo>, class mojo::StructPtr<class content::mojom::StorageInfo>, class std::__Cr::unique_ptr<class content::DocumentState, struct std::__Cr::default_delete<class content::DocumentState>>, class std::__Cr::unique_ptr<struct blink::WebNavigationParams, struct std::__Cr::default_delete<struct blink::WebNavigationParams>>), class base::WeakPtr<class content::RenderFrameImpl> &&, class mojo::StructPtr<class blink::mojom::CommonNavigationParams> &&, class mojo::StructPtr<class blink::mojom::CommitNavigationParams> &&, class std::__Cr::unique_ptr<class blink::PendingURLLoaderFactoryBundle, struct std::__Cr::default_delete<class blink::PendingURLLoaderFactoryBundle>> &&, class std::__Cr::optional<class std::__Cr::vector<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>, class std::__Cr::allocator<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>>>> &&, class mojo::StructPtr<class blink::mojom::ControllerServiceWorkerInfo> &&, class mojo::StructPtr<class blink::mojom::ServiceWorkerContainerInfoForClient> &&, class mojo::PendingRemote<class network::mojom::URLLoaderFactory> &&, class mojo::PendingRemote<class network::mojom::URLLoaderFactory> &&, class mojo::PendingAssociatedRemote<class blink::mojom::FetchLaterLoaderFactory> &&, class mojo::PendingRemote<class blink::mojom::CodeCacheHost> &&, class mojo::PendingRemote<class blink::mojom::CodeCacheHost> &&, class mojo::StructPtr<class content::mojom::CookieManagerInfo> &&, class mojo::StructPtr<class content::mojom::StorageInfo> &&, class std::__Cr::unique_ptr<class content::DocumentState, struct std::__Cr::default_delete<class content::DocumentState>> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl content::RenderFrameImpl::*)(class mojo::StructPtr<class blink::mojom::CommonNavigationParams>, class mojo::StructPtr<class blink::mojom::CommitNavigationParams>, class std::__Cr::unique_ptr<class blink::PendingURLLoaderFactoryBundle, struct std::__Cr::default_delete<class blink::PendingURLLoaderFactoryBundle>>, class std::__Cr::optional<class std::__Cr::vector<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>, class std::__Cr::allocator<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>>>>, class mojo::StructPtr<class blink::mojom::ControllerServiceWorkerInfo>, class mojo::StructPtr<class blink::mojom::ServiceWorkerContainerInfoForClient>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingAssociatedRemote<class blink::mojom::FetchLaterLoaderFactory>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::StructPtr<class content::mojom::CookieManagerInfo>, class mojo::StructPtr<class content::mojom::StorageInfo>, class std::__Cr::unique_ptr<class content::DocumentState, struct std::__Cr::default_delete<class content::DocumentState>>, class std::__Cr::unique_ptr<struct blink::WebNavigationParams, struct std::__Cr::default_delete<struct blink::WebNavigationParams>>), class base::WeakPtr<class content::RenderFrameImpl>, class mojo::StructPtr<class blink::mojom::CommonNavigationParams>, class mojo::StructPtr<class blink::mojom::CommitNavigationParams>, class std::__Cr::unique_ptr<class blink::PendingURLLoaderFactoryBundle, struct std::__Cr::default_delete<class blink::PendingURLLoaderFactoryBundle>>, class std::__Cr::optional<class std::__Cr::vector<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>, class std::__Cr::allocator<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>>>>, class mojo::StructPtr<class blink::mojom::ControllerServiceWorkerInfo>, class mojo::StructPtr<class blink::mojom::ServiceWorkerContainerInfoForClient>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingAssociatedRemote<class blink::mojom::FetchLaterLoaderFactory>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::StructPtr<class content::mojom::CookieManagerInfo>, class mojo::StructPtr<class content::mojom::StorageInfo>, class std::__Cr::unique_ptr<class content::DocumentState, struct std::__Cr::default_delete<class content::DocumentState>>>, (class std::__Cr::unique_ptr<struct blink::WebNavigationParams, struct std::__Cr::default_delete<struct blink::WebNavigationParams>>)>::RunOnce(class base::internal::BindStateBase *, class std::__Cr::unique_ptr<struct blink::WebNavigationParams, struct std::__Cr::default_delete<struct blink::WebNavigationParams>> &&) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982:12
    #70 0x7ffa82b1ddf4 in base::OnceCallback<(class std::__Cr::unique_ptr<struct blink::WebNavigationParams, struct std::__Cr::default_delete<struct blink::WebNavigationParams>>)>::Run(class std::__Cr::unique_ptr<struct blink::WebNavigationParams, struct std::__Cr::default_delete<struct blink::WebNavigationParams>>) && C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155:12
    #71 0x7ffa82b16428 in content::RenderFrameImpl::CommitNavigation(class mojo::StructPtr<class blink::mojom::CommonNavigationParams>, class mojo::StructPtr<class blink::mojom::CommitNavigationParams>, class mojo::StructPtr<class network::mojom::URLResponseHead>, class mojo::ScopedHandleBase<class mojo::DataPipeConsumerHandle>, class mojo::StructPtr<class network::mojom::URLLoaderClientEndpoints>, class std::__Cr::unique_ptr<class blink::PendingURLLoaderFactoryBundle, struct std::__Cr::default_delete<class blink::PendingURLLoaderFactoryBundle>>, class std::__Cr::optional<class std::__Cr::vector<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>, class std::__Cr::allocator<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>>>>, class mojo::StructPtr<class blink::mojom::ControllerServiceWorkerInfo>, class mojo::StructPtr<class blink::mojom::ServiceWorkerContainerInfoForClient>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingAssociatedRemote<class blink::mojom::FetchLaterLoaderFactory>, class base::TokenType<class blink::DocumentTokenTypeMarker> const &, class base::UnguessableToken const &, class base::Uuid const &, class mojo::StructPtr<class blink::mojom::PolicyContainer>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::StructPtr<class content::mojom::CookieManagerInfo>, class mojo::StructPtr<class content::mojom::StorageInfo>, class base::OnceCallback<(class mojo::StructPtr<class content::mojom::DidCommitProvisionalLoadParams>, class mojo::StructPtr<class content::mojom::DidCommitProvisionalLoadInterfaceParams>)>) C:\b\s\w\ir\cache\builder\src\content\renderer\render_frame_impl.cc:2875:33
    #72 0x7ffa82b9665a in content::NavigationClient::CommitNavigation(class mojo::StructPtr<class blink::mojom::CommonNavigationParams>, class mojo::StructPtr<class blink::mojom::CommitNavigationParams>, class mojo::StructPtr<class network::mojom::URLResponseHead>, class mojo::ScopedHandleBase<class mojo::DataPipeConsumerHandle>, class mojo::StructPtr<class network::mojom::URLLoaderClientEndpoints>, class std::__Cr::unique_ptr<class blink::PendingURLLoaderFactoryBundle, struct std::__Cr::default_delete<class blink::PendingURLLoaderFactoryBundle>>, class std::__Cr::optional<class std::__Cr::vector<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>, class std::__Cr::allocator<class mojo::StructPtr<class blink::mojom::TransferrableURLLoader>>>>, class mojo::StructPtr<class blink::mojom::ControllerServiceWorkerInfo>, class mojo::StructPtr<class blink::mojom::ServiceWorkerContainerInfoForClient>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingRemote<class network::mojom::URLLoaderFactory>, class mojo::PendingAssociatedRemote<class blink::mojom::FetchLaterLoaderFactory>, class base::TokenType<class blink::DocumentTokenTypeMarker> const &, class base::UnguessableToken const &, class base::Uuid const &, class mojo::StructPtr<class blink::mojom::PolicyContainer>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::PendingRemote<class blink::mojom::CodeCacheHost>, class mojo::StructPtr<class content::mojom::CookieManagerInfo>, class mojo::StructPtr<class content::mojom::StorageInfo>, class base::OnceCallback<(class mojo::StructPtr<class content::mojom::DidCommitProvisionalLoadParams>, class mojo::StructPtr<class content::mojom::DidCommitProvisionalLoadInterfaceParams>)>) C:\b\s\w\ir\cache\builder\src\content\renderer\navigation_client.cc:87:18
    #73 0x7ffa6818d9c9 in content::mojom::NavigationClientStubDispatch::AcceptWithResponder(class content::mojom::NavigationClient *, class mojo::Message *, class std::__Cr::unique_ptr<class mojo::MessageReceiverWithStatus, struct std::__Cr::default_delete<class mojo::MessageReceiverWithStatus>>) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\content\common\navigation_client.mojom.cc:1743:13
    #74 0x7ffa82b9acac in content::mojom::NavigationClientStub<struct mojo::RawPtrImplRefTraits<class content::mojom::NavigationClient>>::AcceptWithResponder(class mojo::Message *, class std::__Cr::unique_ptr<class mojo::MessageReceiverWithStatus, struct std::__Cr::default_delete<class mojo::MessageReceiverWithStatus>>) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\content\common\navigation_client.mojom.h:184:12
    #75 0x7ffa78a95d30 in mojo::InterfaceEndpointClient::HandleValidatedMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:1036:56
    #76 0x7ffa78a92afd in mojo::MessageDispatcher::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\message_dispatcher.cc:44:19
    #77 0x7ffa78a9c46e in mojo::InterfaceEndpointClient::HandleIncomingMessage(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc:747:20
    #78 0x7ffa7c0153d9 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1199:24
    #79 0x7ffa7c0178f1 in base::internal::DecayedFunctorTraits<void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::`anonymous namespace'::ScopedUrgentMessageNotification &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:740
    #80 0x7ffa7c0178f1 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::`anonymous namespace'::ScopedUrgentMessageNotification &&>,void,0,1,2>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:932
    #81 0x7ffa7c0178f1 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::`anonymous namespace'::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::`anonymous namespace'::ScopedUrgentMessageNotification>,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069
    #82 0x7ffa7c0178f1 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),IPC::ChannelAssociatedGroupController *&&,mojo::Message &&,IPC::`anonymous namespace'::ScopedUrgentMessageNotification &&>,base::internal::BindState<1,1,0,void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::`anonymous namespace'::ScopedUrgentMessageNotification),scoped_refptr<IPC::ChannelAssociatedGroupController>,mojo::Message,IPC::`anonymous namespace'::ScopedUrgentMessageNotification>,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982:12
    #83 0x7ffa782cd4e5 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
    #84 0x7ffa782cd4e5 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:229:34
    #85 0x7ffa7829edd9 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:112
    #86 0x7ffa7829edd9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:465:23
    #87 0x7ffa7829dc23 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:336:40
    #88 0x7ffa78411561 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:65:55
    #89 0x7ffa782a0abb in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:640:12
    #90 0x7ffa78348fbc in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:135:14
    #91 0x7ffa829e7634 in content::RendererMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\renderer\renderer_main.cc:336:16
    #92 0x7ffa74aa8cf6 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:763:14
    #93 0x7ffa74aab419 in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1164:10
    #94 0x7ffa74aa6b46 in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:356:36
    #95 0x7ffa74aa7272 in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:369:10
    #96 0x7ffa63212dcb in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:221:12
    #97 0x7ff6b20648f4 in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:204:12
    #98 0x7ff6b2061f56 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:341:20
    #99 0x7ff6b254c9f3 in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #100 0x7ff6b254c9f3 in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #101 0x7ffb5f6f17b2  (C:\WINDOWS\System32\KERNEL32.DLL+0x1800317b2)
    #102 0x7ffb60c7fcff  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18005fcff)

0x009002973848 is located 40 bytes inside of 96-byte region [0x009002973820,0x009002973880)
freed by thread T0 here:
    #0 0x7ffabe90c60f  (C:\Users\win2\Desktop\asan-chrome\clang_rt.asan_dynamic-x86_64.dll+0x18004c60f)
    #1 0x7ffa632123a3 in free C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win_thunk.cpp:55
    #2 0x7ffa87a9bd33 in blink::VectorBuffer<blink::Attribute,4,blink::PartitionAllocator>::DeallocateBuffer C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:754
    #3 0x7ffa87a9bd33 in blink::Vector<class blink::Attribute, 4, class blink::PartitionAllocator>::ReallocateBuffer(unsigned int) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:2732:9
    #4 0x7ffa87a9b673 in blink::Vector<blink::Attribute,4,blink::PartitionAllocator>::reserve C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:2263
    #5 0x7ffa87a9b673 in blink::Vector<class blink::Attribute, 4, class blink::PartitionAllocator>::ExpandCapacity(unsigned int) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:2145:3
    #6 0x7ffa87a9b3f9 in blink::Vector<blink::Attribute,4,blink::PartitionAllocator>::ExpandCapacity C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:2154
    #7 0x7ffa87a9b3f9 in blink::Vector<class blink::Attribute, 4, class blink::PartitionAllocator>::AppendSlowCase<class blink::Attribute>(class blink::Attribute &&) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:2386:9
    #8 0x7ffa87a53882 in blink::Vector<blink::Attribute,4,blink::PartitionAllocator>::push_back C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:2336
    #9 0x7ffa87a53882 in blink::MutableAttributeCollection::Append C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\attribute_collection.h:163
    #10 0x7ffa87a53882 in blink::Element::AppendAttributeInternal(class blink::QualifiedName const &, class blink::AtomicString const &, enum blink::Element::AttributeModificationReason) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:8083:42
    #11 0x7ffa87a8e5c5 in blink::Element::SetAttributeInternal C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:13418
    #12 0x7ffa87a8e5c5 in blink::Element::SetAttributeHinted(class blink::AtomicString, class blink::AtomicStringTable::WeakResult, class blink::AtomicString, class blink::ExceptionState &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:13366:3
    #13 0x7ffa8477ea5c in blink::Element::setAttribute(class blink::AtomicString, class blink::AtomicString, class blink::ExceptionState &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.h:474:5
    #14 0x7ffa88653544 in blink::`anonymous namespace'::v8_element::SetAttributeOperationOverload1 C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\core\v8\v8_element.cc:5185
    #15 0x7ffa88653544 in blink::`anonymous namespace'::v8_element::SetAttributeOperationCallback C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\core\v8\v8_element.cc:5242:8
    #16 0x7ffa91698093 in Builtins_CallApiCallbackGeneric (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae488093)
    #17 0x7ffa916962d6 in Builtins_InterpreterEntryTrampoline (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae4862d6)
    #18 0x7ffa9169305b in Builtins_JSEntryTrampoline (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae48305b)
    #19 0x7ffa91692bbe in Builtins_JSEntry (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae482bbe)
    #20 0x7ffa687dd1c5 in v8::internal::`anonymous namespace'::Invoke C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:475:22
    #21 0x7ffa687da762 in v8::internal::Execution::Call(class v8::internal::Isolate *, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::base::Vector<class v8::internal::DirectHandle<class v8::internal::Object> const>) C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:565:10
    #22 0x7ffa683420cb in v8::Function::Call(class v8::Isolate *, class v8::Local<class v8::Context>, class v8::Local<class v8::Value>, int, class v8::Local<class v8::Value> *const) C:\b\s\w\ir\cache\builder\src\v8\src\api\api.cc:5612:27
    #23 0x7ffa867f151d in blink::V8ScriptRunner::CallFunction(class v8::Local<class v8::Function>, class blink::ExecutionContext *, class v8::Local<class v8::Value>, int, class v8::Local<class v8::Value> *const, class v8::Isolate *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\v8_script_runner.cc:851:48
    #24 0x7ffa88939fe6 in blink::bindings::CallbackInvokeHelper<blink::CallbackFunctionBase,0,0>::CallInternal C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\callback_invoke_helper.cc:123
    #25 0x7ffa88939fe6 in blink::bindings::CallbackInvokeHelper<class blink::CallbackFunctionWithTaskAttributionBase, 0, 0>::Call(int, class v8::Local<class v8::Value> *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\callback_invoke_helper.cc:147:10
    #26 0x7ffa88960b91 in blink::V8EventHandlerNonNull::InvokeWithoutRunnabilityCheck(class blink::bindings::V8ValueOrScriptWrappableAdapter, class blink::BasicHeapVector<1, class blink::ScriptValue, 0> const &) C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\core\v8\v8_event_handler_non_null.cc:193:13
    #27 0x7ffa8696f601 in blink::JSEventHandler::InvokeInternal(class blink::EventTarget &, class blink::Event &, class v8::Local<class v8::Value>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\js_event_handler.cc:134:14
    #28 0x7ffa86974abb in blink::JSBasedEventListener::Invoke(class blink::ExecutionContext *, class blink::Event *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\js_based_event_listener.cc:189:5
    #29 0x7ffa85ac8f76 in blink::EventTarget::FireEventListeners(class blink::Event &, class blink::EventTargetData *, class blink::BasicHeapVector<1, class cppgc::internal::BasicMember<class blink::RegisteredEventListener, class cppgc::internal::StrongMemberTag, struct cppgc::internal::DijkstraWriteBarrierPolicy, class cppgc::internal::DisabledCheckingPolicy, class cppgc::internal::CompressedPointer>, 1>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\events\event_target.cc:1081:15
    #30 0x7ffa85ac6d22 in blink::EventTarget::FireEventListeners(class blink::Event &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\events\event_target.cc:982:29
    #31 0x7ffa879afd5f in blink::EventDispatcher::DispatchEventAtBubbling(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\events\event_dispatcher.cc:356:21
    #32 0x7ffa879aea92 in blink::EventDispatcher::Dispatch(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\events\event_dispatcher.cc:266:7
    #33 0x7ffa879ad171 in blink::EventDispatcher::DispatchEvent(class blink::Node &, class blink::Event &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\events\event_dispatcher.cc:79:16
    #34 0x7ffa85bbc632 in blink::HTMLScriptElement::DispatchErrorEvent(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\html\html_script_element.cc:449:3
    #35 0x7ffa83789274 in blink::ScriptLoader::AddSpeculationRuleSet(class blink::SpeculationRuleSet::Source *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\script\script_loader.cc:1386:15

previously allocated by thread T0 here:
    #0 0x7ffabe90c71f  (C:\Users\win2\Desktop\asan-chrome\clang_rt.asan_dynamic-x86_64.dll+0x18004c71f)
    #1 0x7ffa632123c3 in malloc C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win_thunk.cpp:68
    #2 0x7ffa784a8ced in partition_alloc::PartitionRoot::AllocInternal C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\internal\partition_root_internal.h:1318
    #3 0x7ffa784a8ced in partition_alloc::PartitionRoot::AllocInline<16>(unsigned __int64, char const *) C:\b\s\w\ir\cache\builder\src\base\allocator\partition_allocator\src\partition_alloc\partition_root.cc:2036:10
    #4 0x7ffa838164b7 in blink::PartitionAllocator::AllocateVectorBacking C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\allocator\partition_allocator.h:42
    #5 0x7ffa838164b7 in blink::VectorBufferBase<class blink::Attribute, class blink::PartitionAllocator>::AllocateBufferNoBarrier(unsigned int) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:595:9
    #6 0x7ffa879b6886 in blink::VectorBufferBase<blink::Attribute,blink::PartitionAllocator>::AllocateBuffer C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:468
    #7 0x7ffa879b6886 in blink::VectorBuffer<blink::Attribute,4,blink::PartitionAllocator>::VectorBuffer C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:736
    #8 0x7ffa879b6886 in blink::Vector<class blink::Attribute, 4, class blink::PartitionAllocator>::Vector<class blink::Attribute, 4, class blink::PartitionAllocator><class blink::Attribute>(class base::span<class blink::Attribute const, -1, class blink::Attribute const *>) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\wtf\vector.h:1879:7
    #9 0x7ffa879b6ffa in blink::UniqueElementData::UniqueElementData C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element_data.cc:179
    #10 0x7ffa879b6ffa in cppgc::MakeGarbageCollectedTrait<class blink::UniqueElementData>::Call<class blink::ShareableElementData const &>(class cppgc::AllocationHandle &, class blink::ShareableElementData const &) C:\b\s\w\ir\cache\builder\src\v8\include\cppgc\allocation.h:239:32
    #11 0x7ffa879b4414 in cppgc::MakeGarbageCollected C:\b\s\w\ir\cache\builder\src\v8\include\cppgc\allocation.h:277
    #12 0x7ffa879b4414 in blink::MakeGarbageCollected C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\platform\heap\garbage_collected.h:37
    #13 0x7ffa879b4414 in blink::ElementData::MakeUniqueCopy(void) const C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element_data.cc:94:10
    #14 0x7ffa87a7bdf4 in blink::Element::CreateUniqueElementData(void) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:12033:56
    #15 0x7ffa87a8b36b in blink::Element::EnsureUniqueElementData C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.h:2821
    #16 0x7ffa87a8b36b in blink::Element::SetAttributeInternal C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:13433
    #17 0x7ffa87a8b36b in blink::Element::SetAttributeWithoutValidation(class blink::QualifiedName const &, class blink::AtomicString const &) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\dom\element.cc:13258:3
    #18 0x7ffa8857538a in blink::`anonymous namespace'::v8_html_base_element::HrefAttributeSetCallback C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\blink\renderer\bindings\core\v8\v8_html_base_element.cc:117:17
    #19 0x7ffa6841cdcf in v8::internal::FunctionCallbackArguments::CallOrConstruct(class v8::internal::Isolate *, class v8::internal::Tagged<class v8::internal::FunctionTemplateInfo>, bool) C:\b\s\w\ir\cache\builder\src\v8\src\api\api-arguments-inl.h:176:3
    #20 0x7ffa6841bafc in v8::internal::`anonymous namespace'::HandleApiCallHelper C:\b\s\w\ir\cache\builder\src\v8\src\builtins\builtins-api.cc:120
    #21 0x7ffa6841bafc in v8::internal::Builtins::InvokeApiFunction(class v8::internal::Isolate *, bool, class v8::internal::DirectHandle<class v8::internal::FunctionTemplateInfo>, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::base::Vector<class v8::internal::DirectHandle<class v8::internal::Object> const>, class v8::internal::DirectHandle<class v8::internal::HeapObject>) C:\b\s\w\ir\cache\builder\src\v8\src\builtins\builtins-api.cc:174:10
    #22 0x7ffa69469a1a in v8::internal::Object::SetPropertyWithAccessor(class v8::internal::LookupIterator *, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::Maybe<enum v8::internal::ShouldThrow>) C:\b\s\w\ir\cache\builder\src\v8\src\objects\objects.cc:1696:9
    #23 0x7ffa6946f38f in v8::internal::Object::SetPropertyInternal(class v8::internal::LookupIterator *, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::Maybe<enum v8::internal::ShouldThrow>, enum v8::internal::StoreOrigin, bool *) C:\b\s\w\ir\cache\builder\src\v8\src\objects\objects.cc:2473:16
    #24 0x7ffa69462d56 in v8::internal::Object::SetProperty(class v8::internal::LookupIterator *, class v8::internal::DirectHandle<class v8::internal::Object>, enum v8::internal::StoreOrigin, class v8::Maybe<enum v8::internal::ShouldThrow>) C:\b\s\w\ir\cache\builder\src\v8\src\objects\objects.cc:2567:9
    #25 0x7ffa68d68be6 in v8::internal::StoreIC::Store(class v8::internal::Handle<class v8::internal::Union<class v8::internal::Smi, class v8::internal::HeapNumber, class v8::internal::BigInt, class v8::internal::String, class v8::internal::Symbol, class v8::internal::Boolean, class v8::internal::Null, class v8::internal::Undefined, class v8::internal::JSReceiver>>, class v8::internal::Handle<class v8::internal::Name>, class v8::internal::DirectHandle<class v8::internal::Object>, enum v8::internal::StoreOrigin) C:\b\s\w\ir\cache\builder\src\v8\src\ic\ic.cc:2266:23
    #26 0x7ffa68d79ce9 in v8::internal::__RT_impl_Runtime_StoreIC_Miss C:\b\s\w\ir\cache\builder\src\v8\src\ic\ic.cc:3392
    #27 0x7ffa68d79ce9 in v8::internal::Runtime_StoreIC_Miss(int, unsigned __int64 *, class v8::internal::Isolate *) C:\b\s\w\ir\cache\builder\src\v8\src\ic\ic.cc:3364:1
    #28 0x7ffa917484f9 in Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae5384f9)
    #29 0x7ffa918524ac in Builtins_SetNamedPropertyHandler (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae6424ac)
    #30 0x7ffa916962d6 in Builtins_InterpreterEntryTrampoline (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae4862d6)
    #31 0x7ffa9169305b in Builtins_JSEntryTrampoline (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae48305b)
    #32 0x7ffa91692bbe in Builtins_JSEntry (C:\Users\win2\Desktop\asan-chrome\chrome.dll+0x1ae482bbe)
    #33 0x7ffa687dd1c5 in v8::internal::`anonymous namespace'::Invoke C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:475:22
    #34 0x7ffa687dea0f in v8::internal::Execution::CallScript(class v8::internal::Isolate *, class v8::internal::DirectHandle<class v8::internal::JSFunction>, class v8::internal::DirectHandle<class v8::internal::Object>, class v8::internal::DirectHandle<class v8::internal::Object>) C:\b\s\w\ir\cache\builder\src\v8\src\execution\execution.cc:575:10
    #35 0x7ffa68307e17 in v8::Script::Run(class v8::Local<class v8::Context>, class v8::Local<class v8::Data>) C:\b\s\w\ir\cache\builder\src\v8\src\api\api.cc:2040:7
    #36 0x7ffa867eb651 in blink::V8ScriptRunner::RunCompiledScript(class v8::Isolate *, class v8::Local<class v8::Script>, class v8::Local<class v8::Data>, class blink::ExecutionContext *) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\v8_script_runner.cc:509:22
    #37 0x7ffa867ed27c in blink::V8ScriptRunner::CompileAndRunScript(class blink::ScriptState *, class blink::ClassicScript *, enum blink::ExecuteScriptPolicy, class blink::V8ScriptRunner::RethrowErrorsOption) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\bindings\core\v8\v8_script_runner.cc:633:22
    #38 0x7ffa82db1dd9 in blink::ClassicScript::RunScriptOnScriptStateAndReturnValue(class blink::ScriptState *, enum blink::ExecuteScriptPolicy, class blink::V8ScriptRunner::RethrowErrorsOption) C:\b\s\w\ir\cache\builder\src\third_party\blink\renderer\core\script\classic_script.cc:227:10

SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\base\memory\scoped_refptr.h:319 in scoped_refptr<blink::StringImpl>::operator bool
Shadow bytes around the buggy address:
  0x009002973580: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x009002973600: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x009002973680: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x009002973700: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x009002973780: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
=>0x009002973800: fa fa f7 fa fd fd fd fd fd[fd]fd fd fd fd fd fd
  0x009002973880: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x009002973900: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x009002973980: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x009002973a00: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x009002973a80: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==6832==ADDITIONAL INFO

==6832==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7ffa7c00f1fc in IPC::ChannelAssociatedGroupController::Accept(class mojo::Message *) C:\b\s\w\ir\cache\builder\src\ipc\ipc_mojo_bootstrap.cc:1138:13


Command line: `"C:\Users\win2\Desktop\asan-chrome\chrome.exe" --type=renderer --no-pre-read-main-dll --no-sandbox --file-url-path-alias="/gen=C:\Users\win2\Desktop\asan-chrome\gen" --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1779315071886577 --launch-time-ticks=4024892719 --metrics-shmem-handle=4368,i,12081182741981436351,2854932247164043557,2097152 --field-trial-handle=1940,i,2199645819126170816,8979304261510960661,262144 --variations-seed-version --pseudonymization-salt-handle=2032,i,14654560252774144446,1563059947711893851,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4396 /prefetch:1`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==6832==END OF ADDITIONAL INFO

==6832==ABORTING
[7616:7740:0520/161845.934:ERROR:google_apis\gcm\engine\registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT