# Reproduce

Tested on commit `effccce563102fd8315819caf7677f68394be7af`, Linux x86_64.

## 1. Build

```
autoninja -C ~/chromium/src/out/asan-release chrome
```

## 2. Generate TLS certificate

```
cd ~/chromium/src/issue_spdy_stream_uaf
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
  -keyout key.pem -out cert.pem -days 1 -nodes -subj '/CN=localhost'
```

## 3. Start servers

```
cd ~/chromium/src/issue_spdy_stream_uaf
python3 -m http.server 8888 &
python3 server.py &
```

## 4. Launch Chrome

```
ASAN_OPTIONS=detect_odr_violation=0 xvfb-run -a ~/chromium/src/out/asan-release/chrome \
  --no-sandbox --disable-gpu --ignore-certificate-errors --disable-web-security \
  --no-proxy-server --user-data-dir=/tmp/poc-$(date +%s) \
  http://localhost:8888/poc.html
```

The network service process crashes with a heap-use-after-free within approximately 15 seconds. ASAN output appears on stderr.