==2497007==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c1bb8d10ba8 at pc 0x7efc2bf06be6 bp 0x7afaac6c5370 sp 0x7afaac6c5368
READ of size 4 at 0x7c1bb8d10ba8 thread T12 (WebRTC_W_and_N)
    #0 0x7efc2bf06be5 in webrtc::SctpDataChannel::UpdateState() third_party/webrtc/pc/sctp_data_channel.cc:823:13
    #1 0x7efc2bdbc17f in webrtc::DataChannelController::AllocateSctpSids(webrtc::SSLRole) third_party/webrtc/pc/data_channel_controller.cc:501:16
    #2 0x7efc2bcb241f in non-virtual thunk to webrtc::DcSctpTransport::OnConnected() third_party/webrtc/media/sctp/dcsctp_transport.cc:581:25
    #3 0x7efc2bcb6866 in dcsctp::CallbackDeferrer::TriggerDeferred() third_party/webrtc/net/dcsctp/socket/callback_deferrer.cc:49:5
    #4 0x7efc2bcc5122 in dcsctp::DcSctpSocket::ReceivePacket(std::__Cr::span<unsigned char const, 18446744073709551615ul>) third_party/webrtc/net/dcsctp/socket/callback_deferrer.h:54:44
    #5 0x7efc2bae945a in webrtc::callback_list_impl::CallbackListReceivers::Foreach(webrtc::FunctionView<void (webrtc::UntypedFunction&)>) third_party/webrtc/api/function_view.h:96:12
    #6 0x7efc2b9c2f29 in webrtc::PacketTransportInternal::NotifyPacketReceived(webrtc::ReceivedIpPacket const&) third_party/webrtc/rtc_base/callback_list.h:211:16
    #7 0x7efc2be0ec0c in webrtc::DtlsTransportInternalImpl::OnDtlsEvent(int, int) third_party/webrtc/p2p/dtls/dtls_transport.cc:1019:9
    #8 0x7efc2be03b93 in webrtc::StreamInterfaceChannel::OnPacketReceived(std::__Cr::span<unsigned char const, 18446744073709551615ul>) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:766:1
    #9 0x7efc2be0dad8 in webrtc::DtlsTransportInternalImpl::OnReadPacket(webrtc::PacketTransportInternal*, webrtc::ReceivedIpPacket const&, bool) third_party/webrtc/p2p/dtls/dtls_transport.cc:1114:21
    #10 0x7efc2bae945a in webrtc::callback_list_impl::CallbackListReceivers::Foreach(webrtc::FunctionView<void (webrtc::UntypedFunction&)>) third_party/webrtc/api/function_view.h:96:12
    #11 0x7efc2b9c2f29 in webrtc::PacketTransportInternal::NotifyPacketReceived(webrtc::ReceivedIpPacket const&) third_party/webrtc/rtc_base/callback_list.h:211:16
    #12 0x7efc2b9c0f00 in void absl::internal_any_invocable::LocalInvoker<false, void, webrtc::P2PTransportChannel::AddConnection(webrtc::Connection*)::$_0&, webrtc::Connection*, webrtc::ReceivedIpPacket const&>(absl::internal_any_invocable::TypeErasedState*, absl::internal_any_invocable::ForwardedParameter<webrtc::Connection*>::type, absl::internal_any_invocable::ForwardedParameter<webrtc::ReceivedIpPacket const&>::type) third_party/webrtc/p2p/base/p2p_transport_channel.cc:2270:3
    #13 0x7efc2b98985e in webrtc::Connection::OnReadPacket(webrtc::ReceivedIpPacket const&) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:766:1
    #14 0x7efc2c0124a8 in webrtc::UDPPort::HandleIncomingPacket(webrtc::AsyncPacketSocket*, webrtc::ReceivedIpPacket const&) third_party/webrtc/p2p/base/stun_port.cc:363:3
    #15 0x7efbde87d286 in blink::(anonymous namespace)::IpcPacketSocket::OnDataReceived(net::IPEndPoint const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>, base::TimeTicks const&, webrtc::EcnMarking) third_party/blink/renderer/platform/p2p/ipc_socket_factory.cc:709:3
    #16 0x7efbde88a16a in non-virtual thunk to blink::P2PSocketClientImpl::DataReceived(blink::Vector<mojo::StructPtr<network::mojom::blink::P2PReceivedPacket>, 0u, blink::PartitionAllocator>) third_party/blink/renderer/platform/p2p/socket_client_impl.cc:187:18
    #17 0x7efbdf6d7770 in network::mojom::blink::P2PSocketClientStubDispatch::Accept(network::mojom::blink::P2PSocketClient*, mojo::Message*) gen/services/network/public/mojom/p2p.mojom-blink.cc:2039:13
    #18 0x7efc3e0f2062 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #19 0x7efc3e10942b in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #20 0x7efc3e0f7914 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #21 0x7efc3e118a0e in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42
    #22 0x7efc3e11723d in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7
    #23 0x7efc3e10942b in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #24 0x7efc3e0ddc8f in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) mojo/public/cpp/bindings/lib/connector.cc:567:49
    #25 0x7efc3e0df4de in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14
    #26 0x7efc3e0e0404 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::*&&)(), base::WeakPtr<mojo::Connector>&&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(), base::WeakPtr<mojo::Connector>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #27 0x7efc3cb61b59 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #28 0x7efc3cbdc1d0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #29 0x7efc3cbdb1a6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #30 0x7efc3ca02e24 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #31 0x7efc3cbdd823 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #32 0x7efc3caccc72 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #33 0x7efc3cc75892 in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13
    #34 0x7efc3cc75df5 in base::Thread::ThreadMain() base/threading/thread.cc:426:3
    #35 0x7efc3ccdaa4c in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #36 0x55a454fd0b36 in asan_thread_start(void*) asan_interceptors.cpp

0x7c1bb8d10ba8 is located 232 bytes inside of 312-byte region [0x7c1bb8d10ac0,0x7c1bb8d10bf8)
freed by thread T12 (WebRTC_W_and_N) here:
    #0 0x55a45500cdc2 in operator delete(void*, unsigned long) (out/asan-release/chrome+0x681cdc2) (BuildId: 436e46875e0ded00)
    #1 0x7efc2bf0e39c in webrtc::RefCountedObject<webrtc::SctpDataChannel>::Release() const third_party/webrtc/rtc_base/ref_counted_object.h:42:7
    #2 0x7efc2bdbb4bb in webrtc::DataChannelController::OnSctpDataChannelClosed(webrtc::SctpDataChannel*) third_party/webrtc/api/scoped_refptr.h:105:13
    #3 0x7efc2bdbaf32 in webrtc::DataChannelController::OnChannelStateChanged(webrtc::SctpDataChannel*, webrtc::DataChannelInterface::DataState) third_party/webrtc/pc/data_channel_controller.cc:119:5
    #4 0x7efc2bf0b244 in webrtc::SctpDataChannel::SendControlMessage(webrtc::CopyOnWriteBuffer const&) third_party/webrtc/pc/sctp_data_channel.cc:1013:5
    #5 0x7efc2bf0655c in webrtc::SctpDataChannel::UpdateState() third_party/webrtc/pc/sctp_data_channel.cc:817:11
    #6 0x7efc2bdbc17f in webrtc::DataChannelController::AllocateSctpSids(webrtc::SSLRole) third_party/webrtc/pc/data_channel_controller.cc:501:16
    #7 0x7efc2bcb241f in non-virtual thunk to webrtc::DcSctpTransport::OnConnected() third_party/webrtc/media/sctp/dcsctp_transport.cc:581:25
    #8 0x7efc2bcb6866 in dcsctp::CallbackDeferrer::TriggerDeferred() third_party/webrtc/net/dcsctp/socket/callback_deferrer.cc:49:5
    #9 0x7efc2bcc5122 in dcsctp::DcSctpSocket::ReceivePacket(std::__Cr::span<unsigned char const, 18446744073709551615ul>) third_party/webrtc/net/dcsctp/socket/callback_deferrer.h:54:44
    #10 0x7efc2bae945a in webrtc::callback_list_impl::CallbackListReceivers::Foreach(webrtc::FunctionView<void (webrtc::UntypedFunction&)>) third_party/webrtc/api/function_view.h:96:12
    #11 0x7efc2b9c2f29 in webrtc::PacketTransportInternal::NotifyPacketReceived(webrtc::ReceivedIpPacket const&) third_party/webrtc/rtc_base/callback_list.h:211:16
    #12 0x7efc2be0ec0c in webrtc::DtlsTransportInternalImpl::OnDtlsEvent(int, int) third_party/webrtc/p2p/dtls/dtls_transport.cc:1019:9
    #13 0x7efc2be03b93 in webrtc::StreamInterfaceChannel::OnPacketReceived(std::__Cr::span<unsigned char const, 18446744073709551615ul>) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:766:1
    #14 0x7efc2be0dad8 in webrtc::DtlsTransportInternalImpl::OnReadPacket(webrtc::PacketTransportInternal*, webrtc::ReceivedIpPacket const&, bool) third_party/webrtc/p2p/dtls/dtls_transport.cc:1114:21
    #15 0x7efc2bae945a in webrtc::callback_list_impl::CallbackListReceivers::Foreach(webrtc::FunctionView<void (webrtc::UntypedFunction&)>) third_party/webrtc/api/function_view.h:96:12
    #16 0x7efc2b9c2f29 in webrtc::PacketTransportInternal::NotifyPacketReceived(webrtc::ReceivedIpPacket const&) third_party/webrtc/rtc_base/callback_list.h:211:16
    #17 0x7efc2b9c0f00 in void absl::internal_any_invocable::LocalInvoker<false, void, webrtc::P2PTransportChannel::AddConnection(webrtc::Connection*)::$_0&, webrtc::Connection*, webrtc::ReceivedIpPacket const&>(absl::internal_any_invocable::TypeErasedState*, absl::internal_any_invocable::ForwardedParameter<webrtc::Connection*>::type, absl::internal_any_invocable::ForwardedParameter<webrtc::ReceivedIpPacket const&>::type) third_party/webrtc/p2p/base/p2p_transport_channel.cc:2270:3
    #18 0x7efc2b98985e in webrtc::Connection::OnReadPacket(webrtc::ReceivedIpPacket const&) third_party/abseil-cpp/absl/functional/internal/any_invocable.h:766:1
    #19 0x7efc2c0124a8 in webrtc::UDPPort::HandleIncomingPacket(webrtc::AsyncPacketSocket*, webrtc::ReceivedIpPacket const&) third_party/webrtc/p2p/base/stun_port.cc:363:3
    #20 0x7efbde87d286 in blink::(anonymous namespace)::IpcPacketSocket::OnDataReceived(net::IPEndPoint const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>, base::TimeTicks const&, webrtc::EcnMarking) third_party/blink/renderer/platform/p2p/ipc_socket_factory.cc:709:3
    #21 0x7efbde88a16a in non-virtual thunk to blink::P2PSocketClientImpl::DataReceived(blink::Vector<mojo::StructPtr<network::mojom::blink::P2PReceivedPacket>, 0u, blink::PartitionAllocator>) third_party/blink/renderer/platform/p2p/socket_client_impl.cc:187:18
    #22 0x7efbdf6d7770 in network::mojom::blink::P2PSocketClientStubDispatch::Accept(network::mojom::blink::P2PSocketClient*, mojo::Message*) gen/services/network/public/mojom/p2p.mojom-blink.cc:2039:13
    #23 0x7efc3e0f2062 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #24 0x7efc3e10942b in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #25 0x7efc3e0f7914 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #26 0x7efc3e118a0e in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42
    #27 0x7efc3e11723d in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7
    #28 0x7efc3e10942b in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #29 0x7efc3e0ddc8f in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) mojo/public/cpp/bindings/lib/connector.cc:567:49

previously allocated by thread T12 (WebRTC_W_and_N) here:
    #0 0x55a45500c1bd in operator new(unsigned long) (out/asan-release/chrome+0x681c1bd) (BuildId: 436e46875e0ded00)
    #1 0x7efc2bf04232 in webrtc::SctpDataChannel::Create(webrtc::WeakPtr<webrtc::SctpDataChannelControllerInterface>, std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, bool, webrtc::InternalDataChannelInit const&, webrtc::Thread*, webrtc::Thread*) third_party/webrtc/api/make_ref_counted.h:90:27
    #2 0x7efc2bdbf7c9 in webrtc::DataChannelController::CreateDataChannel(std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, webrtc::InternalDataChannelInit&) third_party/webrtc/pc/data_channel_controller.cc:409:44
    #3 0x7efc2bdc5081 in void webrtc::FunctionView<void ()>::CallVoidPtr<webrtc::RTCErrorOr<webrtc::scoped_refptr<webrtc::SctpDataChannel>> webrtc::Thread::BlockingCall<webrtc::DataChannelController::InternalCreateDataChannelWithProxy(std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, webrtc::InternalDataChannelInit const&)::$_0, webrtc::RTCErrorOr<webrtc::scoped_refptr<webrtc::SctpDataChannel>>, void>(webrtc::DataChannelController::InternalCreateDataChannelWithProxy(std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>, webrtc::InternalDataChannelInit const&)::$_0&&, base::Location const&)::'lambda'()>(webrtc::FunctionView<void ()>::VoidUnion) third_party/webrtc/pc/data_channel_controller.cc:444:24
    #4 0x7efbd14258e4 in webrtc::ThreadWrapper::ProcessPendingSends() third_party/webrtc/api/function_view.h:96:12
    #5 0x7efbd1428314 in base::internal::Invoker<base::internal::FunctorTraits<void (webrtc::ThreadWrapper::*&&)(), base::WeakPtr<webrtc::ThreadWrapper>&&>, base::internal::BindState<true, true, false, void (webrtc::ThreadWrapper::*)(), base::WeakPtr<webrtc::ThreadWrapper>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #6 0x7efc3cb61b59 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #7 0x7efc3cbdc1d0 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #8 0x7efc3cbdb1a6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #9 0x7efc3ca02e24 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #10 0x7efc3cbdd823 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #11 0x7efc3caccc72 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #12 0x7efc3cc75892 in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13
    #13 0x7efc3cc75df5 in base::Thread::ThreadMain() base/threading/thread.cc:426:3
    #14 0x7efc3ccdaa4c in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #15 0x55a454fd0b36 in asan_thread_start(void*) asan_interceptors.cpp

Thread T12 (WebRTC_W_and_N) created by T0 (chrome) here:
    #0 0x55a454fb69b1 in pthread_create (out/asan-release/chrome+0x67c69b1) (BuildId: 436e46875e0ded00)
    #1 0x7efc3ccda10c in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x7efc3cc7411b in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:232:26
    #3 0x7efbd065e9a6 in blink::PeerConnectionDependencyFactory::CreatePeerConnectionFactory() third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc:436:29
    #4 0x7efbd065e4de in blink::PeerConnectionDependencyFactory::GetPcFactory() third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc:738:5
    #5 0x7efbd0666fa2 in blink::PeerConnectionDependencyFactory::CreatePeerConnection(webrtc::PeerConnectionInterface::RTCConfiguration const&, blink::WebLocalFrame*, webrtc::PeerConnectionObserver*, blink::ExceptionState&) third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc:1006:8
    #6 0x7efbd073babe in blink::RTCPeerConnectionHandler::Initialize(blink::ExecutionContext*, webrtc::PeerConnectionInterface::RTCConfiguration const&, blink::WebLocalFrame*, blink::ExceptionState&) third_party/blink/renderer/modules/peerconnection/rtc_peer_connection_handler.cc:896:50
    #7 0x7efbd06f4227 in blink::RTCPeerConnection::RTCPeerConnection(blink::ExecutionContext*, webrtc::PeerConnectionInterface::RTCConfiguration, bool, blink::ExceptionState&) third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc:690:23
    #8 0x7efbd06f3698 in blink::RTCPeerConnection* blink::MakeGarbageCollected<blink::RTCPeerConnection, blink::ExecutionContext*&, webrtc::PeerConnectionInterface::RTCConfiguration, bool, blink::ExceptionState&>(blink::ExecutionContext*&, webrtc::PeerConnectionInterface::RTCConfiguration&&, bool&&, blink::ExceptionState&) v8/include/cppgc/allocation.h:239:32
    #9 0x7efbd06f0c4b in blink::RTCPeerConnection::Create(blink::ExecutionContext*, blink::RTCConfiguration const*, blink::ExceptionState&) third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc:613:40
    #10 0x7efbceca8d0f in blink::(anonymous namespace)::v8_rtc_peer_connection::ConstructorCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_rtc_peer_connection.cc:675:23
    #11 0x7efbd6c3b5ea in v8::internal::FunctionCallbackArguments::CallOrConstruct(v8::internal::Isolate*, v8::internal::Tagged<v8::internal::FunctionTemplateInfo>, bool) v8/src/api/api-arguments-inl.h:176:3
    #12 0x7efbd6c382de in v8::internal::Builtin_Impl_HandleApiConstruct(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:117:27

SUMMARY: AddressSanitizer: heap-use-after-free third_party/webrtc/pc/sctp_data_channel.cc:823:13 in webrtc::SctpDataChannel::UpdateState()
Shadow bytes around the buggy address:
  0x7c1bb8d10900: fa fa fa fa fa fa f7 fa f7 00 00 00 00 00 00 00
  0x7c1bb8d10980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1bb8d10a00: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
  0x7c1bb8d10a80: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x7c1bb8d10b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7c1bb8d10b80: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fa
  0x7c1bb8d10c00: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 01
  0x7c1bb8d10c80: fc 00 00 00 00 00 00 00 00 00 01 fc 00 00 00 00
  0x7c1bb8d10d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
  0x7c1bb8d10d80: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 01
  0x7c1bb8d10e00: fc 00 00 00 00 00 00 00 00 00 01 fc 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2497007==ADDITIONAL INFO

==2497007==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7efc3e0dff96 in mojo::Connector::ScheduleDispatchOfPendingMessagesOrWaitForMore(unsigned long) mojo/public/cpp/bindings/lib/connector.cc:588:7
    #1 0x7efc3e0dff96 in mojo::Connector::ScheduleDispatchOfPendingMessagesOrWaitForMore(unsigned long) mojo/public/cpp/bindings/lib/connector.cc:588:7
    #2 0x7efc3e0dff96 in mojo::Connector::ScheduleDispatchOfPendingMessagesOrWaitForMore(unsigned long) mojo/public/cpp/bindings/lib/connector.cc:588:7
    #3 0x7efc3e0dff96 in mojo::Connector::ScheduleDispatchOfPendingMessagesOrWaitForMore(unsigned long) mojo/public/cpp/bindings/lib/connector.cc:588:7


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=2496915 --enable-crash-reporter=, --user-data-dir=/tmp/poc-clean-1776412554 --no-sandbox --js-flags=--expose-gc --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1775882821083885 --launch-time-ticks=529737276743 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,6681352557284557697,8844214029780901967,2097152 --field-trial-handle=3,i,10529943954471948370,7509776546332689777,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,11567427300873992473,11220748498484489892,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==2497007==END OF ADDITIONAL INFO

==2497007==ABORTING