=================================================================
==2432110==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d68951d2684 at pc 0x7ff912e0c4ec bp 0x7bf888590cd0 sp 0x7bf888590cc8
READ of size 4 at 0x7d68951d2684 thread T7 (Chrome_ChildIOT)
    #0 0x7ff912e0c4eb in net::SpdyStream::IncreaseRecvWindowSize(int) net/spdy/spdy_stream.cc:286:36
    #1 0x7ff912e15ed5 in base::internal::Invoker<base::internal::FunctorTraits<void (net::SpdyStream::* const&)(unsigned long, net::SpdyBuffer::ConsumeSource), base::WeakPtr<net::SpdyStream> const&>, base::internal::BindState<true, true, false, void (net::SpdyStream::*)(unsigned long, net::SpdyBuffer::ConsumeSource), base::WeakPtr<net::SpdyStream>>, void (unsigned long, net::SpdyBuffer::ConsumeSource)>::Run(base::internal::BindStateBase*, unsigned long, net::SpdyBuffer::ConsumeSource) base/functional/bind_internal.h:740:12
    #2 0x7ff912d92dc1 in base::RepeatingCallback<void (unsigned long, net::SpdyBuffer::ConsumeSource)>::Run(unsigned long, net::SpdyBuffer::ConsumeSource) const & base/functional/callback.h:346:12
    #3 0x7ff912d9211f in net::SpdyBuffer::~SpdyBuffer() net/spdy/spdy_buffer.cc:109:9
    #4 0x7ff912db011b in base::internal::VectorBuffer<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>>::DestructRange(base::span<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>, 18446744073709551615ul, std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>*>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #5 0x7ff912dafa35 in base::circular_deque<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>>::DestructRange(unsigned long, unsigned long) base/containers/circular_deque.h
    #6 0x7ff912daf358 in net::SpdyReadQueue::Dequeue(base::span<unsigned char, 18446744073709551615ul, unsigned char*>) base/containers/circular_deque.h:1002:5
    #7 0x7ff912d9cb12 in net::SpdyHttpStream::DoBufferedReadCallback() net/spdy/spdy_http_stream.cc:546:30
    #8 0x7ff912da0bc2 in base::internal::Invoker<base::internal::FunctorTraits<void (net::SpdyHttpStream::*&&)(), net::SpdyHttpStream*>, base::internal::BindState<true, true, false, void (net::SpdyHttpStream::*)(), base::internal::UnretainedWrapper<net::SpdyHttpStream, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x7ff91909299f in base::OneShotTimer::RunUserTask() base/functional/callback.h:155:12
    #10 0x7ff91909663c in base::internal::Invoker<base::internal::FunctorTraits<void (base::internal::DelayTimerBase::* const&)(), base::internal::DelayTimerBase*>, base::internal::BindState<true, true, false, void (base::internal::DelayTimerBase::*)(), base::internal::UnretainedWrapper<base::internal::DelayTimerBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #11 0x7ff918f61b59 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #12 0x7ff918fdc1d0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #13 0x7ff918fdb1a6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #14 0x7ff91918c2a9 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55
    #15 0x7ff918fdd823 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #16 0x7ff918eccc72 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #17 0x7ff919075892 in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13
    #18 0x7ff8f8efefa1 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19
    #19 0x7ff919075df5 in base::Thread::ThreadMain() base/threading/thread.cc:426:3
    #20 0x7ff9190daa4c in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #21 0x56340da52b36 in asan_thread_start(void*) asan_interceptors.cpp

0x7d68951d2684 is located 4 bytes inside of 648-byte region [0x7d68951d2680,0x7d68951d2908)
freed by thread T7 (Chrome_ChildIOT) here:
    #0 0x56340da8edc2 in operator delete(void*, unsigned long) (out/asan-release/chrome+0x681cdc2) (BuildId: 436e46875e0ded00)
    #1 0x7ff912dc1b65 in net::SpdySession::CloseActiveStreamIterator(std::__Cr::__map_iterator<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned int, net::SpdyStream*>, void*>*, long>>, int) net/spdy/spdy_session.cc:1855:3
    #2 0x7ff912dc415b in net::SpdySession::StartGoingAway(unsigned int, net::Error) net/spdy/spdy_session.cc:1396:5
    #3 0x7ff912dbd1ff in net::SpdySession::DoDrainSession(net::Error, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, bool) net/spdy/spdy_session.cc:2744:5
    #4 0x7ff912dcb31a in net::SpdySession::EnqueueSessionWrite(net::RequestPriority, spdy::SpdyFrameType, std::__Cr::unique_ptr<spdy::SpdySerializedFrame, std::__Cr::default_delete<spdy::SpdySerializedFrame>>) net/spdy/spdy_session.cc:2566:5
    #5 0x7ff912dc3849 in net::SpdySession::SendWindowUpdateFrame(unsigned int, unsigned int, net::RequestPriority) net/spdy/spdy_session.cc:2476:3
    #6 0x7ff912dc314c in net::SpdySession::SendStreamWindowUpdate(unsigned int, unsigned int) net/spdy/spdy_session.cc:1349:3
    #7 0x7ff912e0c14f in net::SpdyStream::IncreaseRecvWindowSize(int) net/spdy/spdy_stream.cc:283:15
    #8 0x7ff912e15ed5 in base::internal::Invoker<base::internal::FunctorTraits<void (net::SpdyStream::* const&)(unsigned long, net::SpdyBuffer::ConsumeSource), base::WeakPtr<net::SpdyStream> const&>, base::internal::BindState<true, true, false, void (net::SpdyStream::*)(unsigned long, net::SpdyBuffer::ConsumeSource), base::WeakPtr<net::SpdyStream>>, void (unsigned long, net::SpdyBuffer::ConsumeSource)>::Run(base::internal::BindStateBase*, unsigned long, net::SpdyBuffer::ConsumeSource) base/functional/bind_internal.h:740:12
    #9 0x7ff912d92dc1 in base::RepeatingCallback<void (unsigned long, net::SpdyBuffer::ConsumeSource)>::Run(unsigned long, net::SpdyBuffer::ConsumeSource) const & base/functional/callback.h:346:12
    #10 0x7ff912d9211f in net::SpdyBuffer::~SpdyBuffer() net/spdy/spdy_buffer.cc:109:9
    #11 0x7ff912db011b in base::internal::VectorBuffer<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>>::DestructRange(base::span<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>, 18446744073709551615ul, std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>*>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #12 0x7ff912dafa35 in base::circular_deque<std::__Cr::unique_ptr<net::SpdyBuffer, std::__Cr::default_delete<net::SpdyBuffer>>>::DestructRange(unsigned long, unsigned long) base/containers/circular_deque.h
    #13 0x7ff912daf358 in net::SpdyReadQueue::Dequeue(base::span<unsigned char, 18446744073709551615ul, unsigned char*>) base/containers/circular_deque.h:1002:5
    #14 0x7ff912d9cb12 in net::SpdyHttpStream::DoBufferedReadCallback() net/spdy/spdy_http_stream.cc:546:30
    #15 0x7ff912da0bc2 in base::internal::Invoker<base::internal::FunctorTraits<void (net::SpdyHttpStream::*&&)(), net::SpdyHttpStream*>, base::internal::BindState<true, true, false, void (net::SpdyHttpStream::*)(), base::internal::UnretainedWrapper<net::SpdyHttpStream, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #16 0x7ff91909299f in base::OneShotTimer::RunUserTask() base/functional/callback.h:155:12
    #17 0x7ff91909663c in base::internal::Invoker<base::internal::FunctorTraits<void (base::internal::DelayTimerBase::* const&)(), base::internal::DelayTimerBase*>, base::internal::BindState<true, true, false, void (base::internal::DelayTimerBase::*)(), base::internal::UnretainedWrapper<base::internal::DelayTimerBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #18 0x7ff918f61b59 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #19 0x7ff918fdc1d0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #20 0x7ff918fdb1a6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #21 0x7ff91918c2a9 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55
    #22 0x7ff918fdd823 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #23 0x7ff918eccc72 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #24 0x7ff919075892 in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13
    #25 0x7ff8f8efefa1 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19
    #26 0x7ff919075df5 in base::Thread::ThreadMain() base/threading/thread.cc:426:3
    #27 0x7ff9190daa4c in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #28 0x56340da52b36 in asan_thread_start(void*) asan_interceptors.cpp

previously allocated by thread T7 (Chrome_ChildIOT) here:
    #0 0x56340da8e1bd in operator new(unsigned long) (out/asan-release/chrome+0x681c1bd) (BuildId: 436e46875e0ded00)
    #1 0x7ff912dc8f1e in net::SpdySession::CreateStream(net::SpdyStreamRequest const&, base::WeakPtr<net::SpdyStream>*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x7ff912db64d0 in net::SpdySession::TryCreateStream(base::WeakPtr<net::SpdyStreamRequest> const&, base::WeakPtr<net::SpdyStream>*) net/spdy/spdy_session.cc:1697:12
    #3 0x7ff912db564c in net::SpdyStreamRequest::StartRequest(net::SpdyStreamType, base::WeakPtr<net::SpdySession> const&, GURL const&, bool, net::RequestPriority, net::SocketTag const&, net::NetLogWithSource const&, base::OnceCallback<void (int)>, net::NetworkTrafficAnnotationTag const&, bool, base::TimeDelta) net/spdy/spdy_session.cc:617:17
    #4 0x7ff912d9579b in net::SpdyHttpStream::InitializeStream(bool, net::RequestPriority, net::NetLogWithSource const&, base::OnceCallback<void (int)>) net/spdy/spdy_http_stream.cc:74:28
    #5 0x7ff91292d429 in net::HttpNetworkTransaction::DoInitStream() net/http/http_network_transaction.cc:1262:21
    #6 0x7ff912923126 in net::HttpNetworkTransaction::DoLoop(int) net/http/http_network_transaction.cc:1031:14
    #7 0x7ff91291f96e in net::HttpNetworkTransaction::OnIOComplete(int) net/http/http_network_transaction.cc:1003:12
    #8 0x7ff9129289da in net::HttpNetworkTransaction::OnStreamReady(net::ProxyInfo const&, std::__Cr::unique_ptr<net::HttpStream, std::__Cr::default_delete<net::HttpStream>>) net/http/http_network_transaction.cc:885:3
    #9 0x7ff9129d070c in net::HttpStreamFactory::JobController::OnStreamReady(net::HttpStreamFactory::Job*) net/http/http_stream_factory_job_controller.cc:360:14
    #10 0x7ff9129cb8cb in base::internal::Invoker<base::internal::FunctorTraits<void (net::HttpStreamFactory::Job::*&&)(base::TimeTicks), base::WeakPtr<net::HttpStreamFactory::Job>&&, base::TimeTicks&&>, base::internal::BindState<true, true, false, void (net::HttpStreamFactory::Job::*)(base::TimeTicks), base::WeakPtr<net::HttpStreamFactory::Job>, base::TimeTicks>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #11 0x7ff918f61b59 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #12 0x7ff918fdc1d0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #13 0x7ff918fdb1a6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #14 0x7ff91918c2a9 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55
    #15 0x7ff918fdd823 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #16 0x7ff918eccc72 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #17 0x7ff919075892 in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13
    #18 0x7ff8f8efefa1 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19
    #19 0x7ff919075df5 in base::Thread::ThreadMain() base/threading/thread.cc:426:3
    #20 0x7ff9190daa4c in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #21 0x56340da52b36 in asan_thread_start(void*) asan_interceptors.cpp

Thread T7 (Chrome_ChildIOT) created by T0 (chrome) here:
    #0 0x56340da389b1 in pthread_create (out/asan-release/chrome+0x67c69b1) (BuildId: 436e46875e0ded00)
    #1 0x7ff9190da10c in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x7ff91907411b in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:232:26
    #3 0x7ff8f8efddcc in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>, bool) content/child/child_process.cc:152:21
    #4 0x7ff8fdc4d707 in content::UtilityMain(content::MainFunctionParams) content/utility/utility_main.cc:459:16
    #5 0x7ff8fdd90df6 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:762:14
    #6 0x7ff8fdd9350a in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #7 0x7ff8fdd8dc53 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #8 0x7ff8fdd8dfda in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #9 0x56340da90115 in ChromeMain chrome/app/chrome_main.cc:194:12
    #10 0x7ff8a3e29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-use-after-free net/spdy/spdy_stream.cc:286:36 in net::SpdyStream::IncreaseRecvWindowSize(int)
Shadow bytes around the buggy address:
  0x7d68951d2400: 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00
  0x7d68951d2480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d68951d2500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7d68951d2580: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa fa
  0x7d68951d2600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
=>0x7d68951d2680:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d68951d2700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d68951d2780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d68951d2800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d68951d2880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d68951d2900: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2432110==ADDITIONAL INFO

==2432110==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7ff912d9b6b5 in net::SpdyHttpStream::MaybeScheduleBufferedReadCallback() net/spdy/spdy_http_stream.cc:526:30
    #1 0x7ff912dcc3c1 in net::SpdySession::DoReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1997:11
    #2 0x7ff912dcc3c1 in net::SpdySession::DoReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1997:11
    #3 0x7ff912dcc3c1 in net::SpdySession::DoReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1997:11


Command line: `/proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --crashpad-handler-pid=2432044 --enable-crash-reporter=, --user-data-dir=/tmp/tmp.b5PfAeg0TK --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --metrics-shmem-handle=4,i,4220098108197608491,6453642738394115511,524288 --field-trial-handle=3,i,4243207241473691104,8907969781030735218,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,4622112944586293383,260667566832395817,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=stderr`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==2432110==END OF ADDITIONAL INFO

==2432110==ABORTING