[4176923:4176935:0421/135036.398563:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[4176923:4176935:0421/135036.420213:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[4176970:4176970:0421/135036.420467:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[4176970:4176970:0421/135036.420603:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[4176970:4176970:0421/135036.420655:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[4176923:4176923:0421/135036.486868:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured.
[4176970:4176970:0421/135036.492280:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:123] Should skip nVidia device named: nvidia-drm
[4176970:4176970:0421/135036.492968:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process.
[4176923:4176935:0421/135036.495714:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[4177020:4177020:0421/135036.500725:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[4177020:4177020:0421/135036.500851:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[4177020:4177020:0421/135036.500880:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[4176988:4176988:0421/135036.523186:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[4176988:4176988:0421/135036.523229:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[4176988:4176988:0421/135036.523240:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[4176923:4176935:0421/135036.527504:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[4177067:4177067:0421/135036.645424:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[4177067:4177067:0421/135036.645571:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[4177067:4177067:0421/135036.645617:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[4177068:4177068:0421/135036.651285:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[4177068:4177068:0421/135036.651411:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[4177068:4177068:0421/135036.651439:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[4176923:4176923:0421/135036.708151:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[4176923:4176935:0421/135036.708275:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[4176923:4176923:0421/135036.708657:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[4176923:4176923:0421/135036.716088:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[4176923:4176923:0421/135036.720653:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[4176923:4176935:0421/135036.720759:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[4176923:4176923:0421/135036.734345:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[4176923:4176923:0421/135036.738379:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[4176923:4176935:0421/135036.738464:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[4176923:4176923:0421/135036.756670:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[4176923:4176935:0421/135036.756775:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[4176923:4176923:0421/135036.780703:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[4176923:4176935:0421/135036.780820:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[4176923:4176923:0421/135036.784559:INFO:CONSOLE:14] "[poc] navigator.storage.getDirectory()...", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.792743:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[4176923:4176923:0421/135036.792777:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used.
[4176923:4176923:0421/135036.825629:INFO:CONSOLE:14] "[poc] OPFS root acquired", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.825721:INFO:CONSOLE:14] "[poc] getFileHandle(target, create)...", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.829182:INFO:CONSOLE:14] "[poc] target file handle acquired", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.829240:INFO:CONSOLE:14] "[poc] new FileSystemObserver + observe(root)...", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.830214:INFO:CONSOLE:14] "[poc] observer registered", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.831291:INFO:CONSOLE:14] "[poc] starting 40 infinite 4MB write chains", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.848312:INFO:CONSOLE:14] "[poc] 40 write chains running on file_task_runner", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.848389:INFO:CONSOLE:14] "[poc] waiting 3 seconds to let DidWrite callbacks accumulate on", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.848430:INFO:CONSOLE:14] "[poc] file_task_runner, then calling window.close() to trigger", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.848462:INFO:CONSOLE:14] "[poc] the last-incognito-window close path, which runs", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.848508:INFO:CONSOLE:14] "[poc] ProfileDestroyer -> StoragePartition teardown ->", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.848544:INFO:CONSOLE:14] "[poc] ~FileSystemAccessBucketPathWatcher on UI while Unretained", source: http://127.0.0.1:8765/poc.html (14)
[4176923:4176923:0421/135036.848578:INFO:CONSOLE:14] "[poc] (watcher) callbacks are still queued and undrained.", source: http://127.0.0.1:8765/poc.html (14)
[4178098:4178098:0421/135038.841098:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[4178098:4178098:0421/135038.841300:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[4178098:4178098:0421/135038.841406:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
[4176923:4176935:0421/135039.114469:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
[4176923:4176923:0421/135042.834131:INFO:CONSOLE:14] "[poc] calling window.close() now", source: http://127.0.0.1:8765/poc.html (14)
[4179497:4179497:0421/135042.866409:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 7)
[4179497:4179497:0421/135042.866535:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 8)
[4179497:4179497:0421/135042.866565:WARNING:third_party/crashpad/crashpad/util/posix/signals.cc:162] sanitizers are preventing signal handler installation (sig 11)
=================================================================
==4176923==ERROR: MiraclePtr: dangling-pointer-instantiation on address 0x7556754703e0 at pc 0x5d5ee9ecf15c bp 0x73d662af8340 sp 0x73d65feb0ca0
=================================================================
==4176923==ERROR: AddressSanitizer: heap-use-after-free on address 0x7556754703e0 at pc 0x5d5edde127da bp 0x7fff8c9fcbb0 sp 0x7fff8c9fcba8
READ of size 8 at 0x7556754703e0 thread T0 (chrome)
    #0 0x5d5ed1ab0e41 in __sanitizer_print_stack_trace (/home/ab/code/chromium/src/out/asan_nodcheck/chrome+0x11043e41) (BuildId: ce979aaffb8be006)
    #1 0x5d5ee9ecf0a5 in base::(anonymous namespace)::Log(base::(anonymous namespace)::MessageLevel, unsigned long, char const*, char const*) base/memory/raw_ptr_asan_service.cc:829:3
    #2 0x5d5ee9ecf15b in base::RawPtrAsanService::CrashOnDanglingInstantiation(void const volatile*) const base/memory/raw_ptr_asan_service.cc:853:3
    #3 0x5d5edde11106 in void storage::TaskRunnerBoundObserverList<storage::FileChangeObserver>::Notify<void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), storage::FileSystemURL const&>(void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), storage::FileSystemURL const&) const base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr_hookable_impl.h:60:9
    #4 0x5d5ef03ebf98 in storage::ObfuscatedFileUtil::DeleteFile(storage::FileSystemOperationContext*, storage::FileSystemURL const&) storage/browser/file_system/obfuscated_file_util.cc:814:32
    #5 0x5d5ef03ad5aa in base::internal::Invoker<base::internal::FunctorTraits<base::File::Error (storage::FileSystemFileUtil::*&&)(storage::FileSystemOperationContext*, storage::FileSystemURL const&), storage::FileSystemFileUtil*, storage::FileSystemOperationContext*, storage::FileSystemURL&&>, base::internal::BindState<true, true, false, base::File::Error (storage::FileSystemFileUtil::*)(storage::FileSystemOperationContext*, storage::FileSystemURL const&), base::internal::UnretainedWrapper<storage::FileSystemFileUtil, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::OwnedWrapper<storage::FileSystemOperationContext, std::__Cr::default_delete<storage::FileSystemOperationContext>>, storage::FileSystemURL>, base::File::Error ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #6 0x5d5ef03254a4 in void base::internal::ReturnAsParamAdapter<std::__Cr::tuple<base::File::Error>, base::File::Error>(base::OnceCallback<base::File::Error ()>, std::__Cr::unique_ptr<std::__Cr::tuple<base::File::Error>, std::__Cr::default_delete<std::__Cr::tuple<base::File::Error>>>*) base/functional/callback.h:155:12
    #7 0x5d5ef0325aac in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::OnceCallback<base::File::Error ()>, std::__Cr::unique_ptr<std::__Cr::tuple<base::File::Error>, std::__Cr::default_delete<std::__Cr::tuple<base::File::Error>>>*), base::OnceCallback<base::File::Error ()>&&, std::__Cr::unique_ptr<std::__Cr::tuple<base::File::Error>, std::__Cr::default_delete<std::__Cr::tuple<base::File::Error>>>*&&>, base::internal::BindState<false, true, false, void (*)(base::OnceCallback<base::File::Error ()>, std::__Cr::unique_ptr<std::__Cr::tuple<base::File::Error>, std::__Cr::default_delete<std::__Cr::tuple<base::File::Error>>>*), base::OnceCallback<base::File::Error ()>, base::internal::UnretainedWrapper<std::__Cr::unique_ptr<std::__Cr::tuple<base::File::Error>, std::__Cr::default_delete<std::__Cr::tuple<base::File::Error>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #8 0x5d5ee9ddadeb in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(base::internal::PostTaskAndReplyRelay) base/functional/callback.h:155:12
    #9 0x5d5ee9ddb33e in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #10 0x5d5ee9d4f623 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #11 0x5d5ee9de8522 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5
    #12 0x5d5ee9de876c in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:675:3
    #13 0x5d5ee9de6d59 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:705:7
    #14 0x5d5ee9de5fe2 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5
    #15 0x5d5ee9e2af13 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36
    #16 0x5d5ee9e2a054 in base::internal::WorkerThread::RunPooledWorker() base/task/thread_pool/worker_thread.cc:359:3
    #17 0x5d5ee9e29abb in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:339:7
    #18 0x5d5ee9eb3cde in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #19 0x5d5ed1aa2f16 in asan_thread_start(void*) asan_interceptors.cpp

    #0 0x5d5edde127d9 in base::internal::Invoker<base::internal::FunctorTraits<void (storage::FileChangeObserver::*&&)(storage::FileSystemURL const&), storage::FileChangeObserver*, storage::FileSystemURL&&>, base::internal::BindState<true, true, false, void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), base::internal::UnretainedWrapper<storage::FileChangeObserver, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, storage::FileSystemURL>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #1 0x5d5ee9d4f623 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #2 0x5d5ee9dc072c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #3 0x5d5ee9dbf5ca in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #4 0x5d5ee9f6f308 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #5 0x5d5ee9f728c8 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #6 0x77d6785f3584  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d584) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #7 0x77d678652976  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xbc976) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #8 0x77d6785f2a22 in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ca22) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #9 0x5d5ee9f6f923 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:770:30
    #10 0x5d5ee9dc1e14 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #11 0x5d5ee9cc9990 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #12 0x5d5edd6cc03c in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18
    #13 0x5d5edd6d470c in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15
    #14 0x5d5edd6c2dbc in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28
    #15 0x5d5ee5f7fa8f in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10
    #16 0x5d5ee5f83ce8 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1332:10
    #17 0x5d5ee5f8317a in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12
    #18 0x5d5ee5f7c89e in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:359:36
    #19 0x5d5ee5f7ce9c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:372:10
    #20 0x5d5ed1ae02a9 in ChromeMain chrome/app/chrome_main.cc:194:12
    #21 0x77d67702a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #22 0x77d67702a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #23 0x5d5ed1a05029 in _start (/home/ab/code/chromium/src/out/asan_nodcheck/chrome+0x10f98029) (BuildId: ce979aaffb8be006)

0x7556754703e0 is located 864 bytes inside of 888-byte region [0x755675470080,0x7556754703f8)
freed by thread T0 (chrome) here:
    #0 0x5d5ed1adeddd in operator delete(void*) (/home/ab/code/chromium/src/out/asan_nodcheck/chrome+0x11071ddd) (BuildId: ce979aaffb8be006)
    #1 0x5d5eddeae3c7 in content::FileSystemAccessWatcherManager::~FileSystemAccessWatcherManager() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5d5edde42e3a in content::FileSystemAccessManagerImpl::~FileSystemAccessManagerImpl() content/browser/file_system_access/file_system_access_manager_impl.cc:459:1
    #3 0x5d5edde43813 in content::FileSystemAccessManagerImpl::~FileSystemAccessManagerImpl() content/browser/file_system_access/file_system_access_manager_impl.cc:457:61
    #4 0x5d5edde70f5a in void content::BrowserThread::DeleteOnThread<(content::BrowserThread::ID)0>::Destruct<content::FileSystemAccessEntryFactory>(content::FileSystemAccessEntryFactory const*) content/public/browser/browser_thread.h:145:9
    #5 0x5d5edf42d34c in content::StoragePartitionImpl::~StoragePartitionImpl() base/memory/ref_counted.h:427:7
    #6 0x5d5edf42ece3 in content::StoragePartitionImpl::~StoragePartitionImpl() content/browser/storage_partition_impl.cc:1153:47
    #7 0x5d5edf4a559b in void std::__Cr::__destroy_at<std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>>(std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #8 0x5d5edf4a54db in std::__Cr::__tree<std::__Cr::__value_type<content::StoragePartitionConfig, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>, std::__Cr::__map_value_compare<content::StoragePartitionConfig, std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>, std::__Cr::less<content::StoragePartitionConfig>>, std::__Cr::allocator<std::__Cr::pair<content::StoragePartitionConfig const, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>>>::__tree_deleter::operator()(std::__Cr::__tree_node<std::__Cr::__value_type<content::StoragePartitionConfig, std::__Cr::unique_ptr<content::StoragePartitionImpl, std::__Cr::default_delete<content::StoragePartitionImpl>>>, void*>*) gen/third_party/libc++/src/include/__memory/allocator_traits.h:313:5
    #9 0x5d5edf49e58e in content::StoragePartitionImplMap::~StoragePartitionImplMap() gen/third_party/libc++/src/include/__tree:1361:64
    #10 0x5d5edd6110d2 in content::BrowserContextImpl::ShutdownStoragePartitions() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #11 0x5d5ee98199c1 in OffTheRecordProfileImpl::~OffTheRecordProfileImpl() chrome/browser/profiles/off_the_record_profile_impl.cc:278:3
    #12 0x5d5ee9819d73 in OffTheRecordProfileImpl::~OffTheRecordProfileImpl() chrome/browser/profiles/off_the_record_profile_impl.cc:252:53
    #13 0x5d5ee98177e5 in std::__Cr::__tree<std::__Cr::__value_type<Profile::OTRProfileID, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, std::__Cr::__map_value_compare<Profile::OTRProfileID, std::__Cr::pair<Profile::OTRProfileID const, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, std::__Cr::less<Profile::OTRProfileID>>, std::__Cr::allocator<std::__Cr::pair<Profile::OTRProfileID const, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>>>::erase(std::__Cr::__tree_const_iterator<std::__Cr::__value_type<Profile::OTRProfileID, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, std::__Cr::__tree_node<std::__Cr::__value_type<Profile::OTRProfileID, std::__Cr::unique_ptr<Profile, std::__Cr::default_delete<Profile>>>, void*>*, long>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #14 0x5d5ee9811b1d in ProfileImpl::DestroyOffTheRecordProfile(Profile*) gen/third_party/libc++/src/include/__tree:2077:3
    #15 0x5d5ee7d21acd in ProfileDestroyer::DestroyOffTheRecordProfileNow(Profile*) chrome/browser/profiles/profile_destroyer.cc:251:34
    #16 0x5d5ee7d20270 in ProfileDestroyer::Start(std::__Cr::set<content::RenderProcessHost*, std::__Cr::less<content::RenderProcessHost*>, std::__Cr::allocator<content::RenderProcessHost*>> const&) chrome/browser/profiles/profile_destroyer.cc:452:3
    #17 0x5d5ee7d20a81 in ProfileDestroyer::DestroyOTRProfileWhenAppropriateWithTimeout(Profile*, base::TimeDelta) chrome/browser/profiles/profile_destroyer.cc:221:22
    #18 0x5d5f028bedc4 in BrowserManagerService::DeleteBrowser(Browser*) chrome/browser/ui/browser_manager_service.cc:129:5
    #19 0x5d5f0284e6c0 in base::internal::Invoker<base::internal::FunctorTraits<void (Browser::*&&)(), base::WeakPtr<Browser>&&>, base::internal::BindState<true, true, false, void (Browser::*)(), base::WeakPtr<Browser>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #20 0x5d5ee9d4f623 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #21 0x5d5ee9dc072c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #22 0x5d5ee9dbf5ca in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #23 0x5d5ee9f6f308 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #24 0x5d5ee9f728c8 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #25 0x77d6785f3584  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d584) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #26 0x77d678652976  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xbc976) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #27 0x77d6785f2a22 in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ca22) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #28 0x5d5ee9f6f923 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:770:30
    #29 0x5d5ee9dc1e14 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12

previously allocated by thread T0 (chrome) here:
    #0 0x5d5ed1ade59d in operator new(unsigned long) (/home/ab/code/chromium/src/out/asan_nodcheck/chrome+0x1107159d) (BuildId: ce979aaffb8be006)
    #1 0x5d5eddead8c4 in content::FileSystemAccessWatcherManager::FileSystemAccessWatcherManager(content::FileSystemAccessManagerImpl*, base::PassKey<content::FileSystemAccessManagerImpl>) content/browser/file_system_access/file_system_access_bucket_path_watcher.h:27:3
    #2 0x5d5edde421ae in content::FileSystemAccessManagerImpl::FileSystemAccessManagerImpl(scoped_refptr<storage::FileSystemContext>, scoped_refptr<content::ChromeBlobStorageContext>, content::FileSystemAccessPermissionContext*, bool) content/browser/file_system_access/file_system_access_manager_impl.cc:450:7
    #3 0x5d5edf43799f in scoped_refptr<content::FileSystemAccessManagerImpl> base::MakeRefCounted<content::FileSystemAccessManagerImpl, scoped_refptr<storage::FileSystemContext>&, scoped_refptr<content::ChromeBlobStorageContext>&, content::FileSystemAccessPermissionContext*, bool>(scoped_refptr<storage::FileSystemContext>&, scoped_refptr<content::ChromeBlobStorageContext>&, content::FileSystemAccessPermissionContext*&&, bool&&) base/memory/scoped_refptr.h:151:16
    #4 0x5d5edf4326f5 in content::StoragePartitionImpl::Initialize(content::StoragePartitionImpl*) content/browser/storage_partition_impl.cc:1369:7
    #5 0x5d5edf49ec79 in content::StoragePartitionImplMap::Get(content::StoragePartitionConfig const&, bool) content/browser/storage_partition_impl_map.cc:355:14
    #6 0x5d5edd608a3e in content::BrowserContext::GetDefaultStoragePartition() content/browser/browser_context.cc:151:52
    #7 0x5d5ee7bda775 in OptimizationGuideKeyedService::InitializeModelExecution(Profile*) chrome/browser/optimization_guide/optimization_guide_keyed_service.cc:366:38
    #8 0x5d5ee7bd8ca5 in OptimizationGuideKeyedService::Initialize() chrome/browser/optimization_guide/optimization_guide_keyed_service.cc:345:3
    #9 0x5d5ee7be0717 in OptimizationGuideKeyedServiceFactory::BuildServiceInstanceForBrowserContext(content::BrowserContext*) const gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #10 0x5d5eeeddf175 in KeyedServiceTemplatedFactory<KeyedService>::GetServiceForContext(void*, bool) components/keyed_service/core/keyed_service_templated_factory.cc:149:22
    #11 0x5d5eeedd0b80 in DependencyManager::CreateContextServices(void*, bool) components/keyed_service/core/dependency_manager.cc:125:16
    #12 0x5d5ef023ee74 in BrowserContextDependencyManager::DoCreateBrowserContextServices(content::BrowserContext*, bool) components/keyed_service/content/browser_context_dependency_manager.cc:36:22
    #13 0x5d5ee9818d58 in OffTheRecordProfileImpl::Init() chrome/browser/profiles/off_the_record_profile_impl.cc:194:51
    #14 0x5d5ee981b448 in Profile::CreateOffTheRecordProfile(Profile*, Profile::OTRProfileID const&) chrome/browser/profiles/off_the_record_profile_impl.cc:642:12
    #15 0x5d5ee981149b in ProfileImpl::GetOffTheRecordProfile(Profile::OTRProfileID const&, bool) chrome/browser/profiles/profile_impl.cc:1015:7
    #16 0x5d5ed3187156 in Profile::GetPrimaryOTRProfile(bool) chrome/browser/profiles/profile.cc:547:10
    #17 0x5d5ee5f5889b in (anonymous namespace)::GetPrivateProfileIfRequested(base::CommandLine const&, StartupProfileInfo) chrome/browser/ui/startup/startup_browser_creator.cc:302:21
    #18 0x5d5ee5f568a4 in StartupBrowserCreator::ProcessCmdLineImpl(base::CommandLine const&, base::FilePath const&, chrome::startup::IsProcessStartup, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&) chrome/browser/ui/startup/startup_browser_creator.cc:614:7
    #19 0x5d5ee5f5611e in StartupBrowserCreator::Start(base::CommandLine const&, base::FilePath const&, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&) chrome/browser/ui/startup/startup_browser_creator.cc:681:10
    #20 0x5d5ee96d2322 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:2064:25
    #21 0x5d5ee96d099c in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1463:18
    #22 0x5d5edd6c981c in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1003:28
    #23 0x5d5edd6d0a01 in base::internal::Invoker<base::internal::FunctorTraits<int (content::BrowserMainLoop::*&&)(), content::BrowserMainLoop*>, base::internal::BindState<true, true, false, int (content::BrowserMainLoop::*)(), base::internal::UnretainedWrapper<content::BrowserMainLoop, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #24 0x5d5edf422b4d in content::StartupTaskRunner::RunAllTasksNow(bool) base/functional/callback.h:155:12
    #25 0x5d5edd6c8655 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:909:25
    #26 0x5d5edd6d3e0f in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams) content/browser/browser_main_runner_impl.cc:138:15
    #27 0x5d5edd6c2d1a in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:28:32
    #28 0x5d5ee5f7fa8f in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10
    #29 0x5d5ee5f83ce8 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1332:10

SUMMARY: AddressSanitizer: heap-use-after-free base/functional/bind_internal.h:740:12 in base::internal::Invoker<base::internal::FunctorTraits<void (storage::FileChangeObserver::*&&)(storage::FileSystemURL const&), storage::FileChangeObserver*, storage::FileSystemURL&&>, base::internal::BindState<true, true, false, void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), base::internal::UnretainedWrapper<storage::FileChangeObserver, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, storage::FileSystemURL>, void ()>::RunOnce(base::internal::BindStateBase*)
Shadow bytes around the buggy address:
  0x755675470100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x755675470180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x755675470200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x755675470280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x755675470300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x755675470380: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fa
  0x755675470400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x755675470480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x755675470500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x755675470580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x755675470600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==4176923==ADDITIONAL INFO

==4176923==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5d5edde110d1 in void storage::TaskRunnerBoundObserverList<storage::FileChangeObserver>::Notify<void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), storage::FileSystemURL const&>(void (storage::FileChangeObserver::*)(storage::FileSystemURL const&), storage::FileSystemURL const&) const storage/browser/file_system/task_runner_bound_observer_list.h:74:11
    #1 0x5d5ef03a8706 in storage::AsyncFileUtilAdapter::DeleteFile(std::__Cr::unique_ptr<storage::FileSystemOperationContext, std::__Cr::default_delete<storage::FileSystemOperationContext>>, storage::FileSystemURL const&, base::OnceCallback<void (base::File::Error)>) storage/browser/file_system/async_file_util_adapter.cc:323:7
    #2 0x5d5edde1382a in content::FileSystemAccessFileWriterImpl::~FileSystemAccessFileWriterImpl() content/browser/file_system_access/file_system_access_file_writer_impl.cc:63:9
    #3 0x5d5f0282e929 in Browser::OnWindowClosing() chrome/browser/ui/browser.cc:1345:9


Command line: `/home/ab/code/chromium/src/out/asan_nodcheck/chrome --no-sandbox --headless=new --disable-gpu --disable-crashpad-for-testing --disable-breakpad --disable-crash-reporter --disable-in-process-stack-traces --disable-dev-shm-usage --enable-logging=stderr --v=0 --user-data-dir=/tmp/chrome-bug-a.aWht5O --incognito --enable-blink-features=FileSystemObserver --enable-features=NetworkServiceInProcess --disable-features=HttpsUpgrades,HttpsFirstModeIncognito --no-first-run --no-default-browser-check --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl --flag-switches-begin --flag-switches-end http://127.0.0.1:8765/poc.html`


MiraclePtr Status: PROTECTED
This crash occurred inside a callback where a raw_ptr<T> pointing to the same region was bound to one of the arguments.
MiraclePtr is expected to make this crash non-exploitable once fully enabled.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==4176923==END OF ADDITIONAL INFO

==4176923==ABORTING
[4176988:4177035:0421/135043.893577:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.
[4176988:4177035:0421/135043.893630:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.