==3627845==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ca70078e788 at pc 0x7f975f188313 bp 0x7b96f4d13130 sp 0x7b96f4d13128
READ of size 8 at 0x7ca70078e788 thread T5 (Chrome_ChildIOT)
==3627845==WARNING: invalid path to external symbolizer!
==3627845==WARNING: Failed to use and restart external symbolizer!
    #0 0x7f975f188312 in network::ThrottlingP2PNetworkInterceptor::OnSendNetworkTimer() ./gen/third_party/libc++/src/include/__tree:208:12
    #1 0x7f975f1898f2 in base::internal::Invoker<base::internal::FunctorTraits<void (network::ThrottlingP2PNetworkInterceptor::*&&)(), network::ThrottlingP2PNetworkInterceptor*>, base::internal::BindState<true, true, false, void (network::ThrottlingP2PNetworkInterceptor::*)(), base::internal::UnretainedWrapper<network::ThrottlingP2PNetworkInterceptor, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
    #2 0x7f977ee96e7f in base::OneShotTimer::RunUserTask() ./../../base/functional/callback.h:155:12
    #3 0x7f977ee9ab4c in base::internal::Invoker<base::internal::FunctorTraits<void (base::internal::DelayTimerBase::* const&)(), base::internal::DelayTimerBase*>, base::internal::BindState<true, true, false, void (base::internal::DelayTimerBase::*)(), base::internal::UnretainedWrapper<base::internal::DelayTimerBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
    #4 0x7f977ed614f2 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/functional/callback.h:155:12
    #5 0x7f977ede29de in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/common/task_annotator.h:112:5
    #6 0x7f977ede19b6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40
    #7 0x7f977ef8fe7b in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_epoll.cc:224:55
    #8 0x7f977ede4058 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:650:12
    #9 0x7f977eccbb52 in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:135:14
    #10 0x7f977ee7a0a2 in base::Thread::Run(base::RunLoop*) ./../../base/threading/thread.cc:361:13
    #11 0x7f976febbc11 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) ./../../content/child/child_process.cc:69:19
    #12 0x7f977ee7a672 in base::Thread::ThreadMain() ./../../base/threading/thread.cc:436:3
    #13 0x7f977eede6fc in base::(anonymous namespace)::ThreadFunc(void*) ./../../base/threading/platform_thread_posix.cc:102:13
    #14 0x5625bd1e4136 in asan_thread_start(void*) _asan_rtl_:0

0x7ca70078e788 is located 8 bytes inside of 216-byte region [0x7ca70078e780,0x7ca70078e858)
freed by thread T5 (Chrome_ChildIOT) here:
    #0 0x5625bd220bf2 in operator delete(void*, unsigned long) ??:0:0
    #1 0x7f975f18672e in network::ThrottlingP2PNetworkInterceptor::UnregisterSocket(network::P2PSocketUdp*) ./gen/third_party/libc++/src/include/__new/allocate.h:63:10
    #2 0x7f975f174f25 in network::P2PSocketUdp::~P2PSocketUdp() ./../../services/network/p2p/socket_udp.cc:232:19
    #3 0x7f975f17541d in network::P2PSocketUdp::~P2PSocketUdp() ./../../services/network/p2p/socket_udp.cc:230:31
    #4 0x7f975f157f7b in base::internal::flat_tree<network::P2PSocket*, base::internal::GetFirst, std::__Cr::less<void>, std::__Cr::vector<std::__Cr::pair<network::P2PSocket*, std::__Cr::unique_ptr<network::P2PSocket, std::__Cr::default_delete<network::P2PSocket>>>, std::__Cr::allocator<std::__Cr::pair<network::P2PSocket*, std::__Cr::unique_ptr<network::P2PSocket, std::__Cr::default_delete<network::P2PSocket>>>>>>::erase(std::__Cr::__wrap_iter<std::__Cr::pair<network::P2PSocket*, std::__Cr::unique_ptr<network::P2PSocket, std::__Cr::default_delete<network::P2PSocket>>> const*>) ./gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #5 0x7f975f158253 in non-virtual thunk to network::P2PSocketManager::DestroySocket(network::P2PSocket*) ./../../services/network/p2p/socket_manager.cc:230:12
    #6 0x7f975f152c67 in network::P2PSocket::OnError() ./../../services/network/p2p/socket.cc:175:14
    #7 0x7f975f179076 in network::P2PSocketUdp::DoSend(network::P2PPendingPacket const&) ./../../services/network/p2p/socket_udp.cc:434:7
    #8 0x7f975f187eeb in network::ThrottlingP2PNetworkInterceptor::OnSendNetworkTimer() ./../../services/network/throttling/throttling_p2p_network_interceptor.cc:158:15
    #9 0x7f975f1898f2 in base::internal::Invoker<base::internal::FunctorTraits<void (network::ThrottlingP2PNetworkInterceptor::*&&)(), network::ThrottlingP2PNetworkInterceptor*>, base::internal::BindState<true, true, false, void (network::ThrottlingP2PNetworkInterceptor::*)(), base::internal::UnretainedWrapper<network::ThrottlingP2PNetworkInterceptor, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
    #10 0x7f977ee96e7f in base::OneShotTimer::RunUserTask() ./../../base/functional/callback.h:155:12
    #11 0x7f977ee9ab4c in base::internal::Invoker<base::internal::FunctorTraits<void (base::internal::DelayTimerBase::* const&)(), base::internal::DelayTimerBase*>, base::internal::BindState<true, true, false, void (base::internal::DelayTimerBase::*)(), base::internal::UnretainedWrapper<base::internal::DelayTimerBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12
    #12 0x7f977ed614f2 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/functional/callback.h:155:12
    #13 0x7f977ede29de in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/common/task_annotator.h:112:5
    #14 0x7f977ede19b6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40
    #15 0x7f977ef8fe7b in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_epoll.cc:224:55
    #16 0x7f977ede4058 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:650:12
    #17 0x7f977eccbb52 in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:135:14
    #18 0x7f977ee7a0a2 in base::Thread::Run(base::RunLoop*) ./../../base/threading/thread.cc:361:13
    #19 0x7f976febbc11 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) ./../../content/child/child_process.cc:69:19
    #20 0x7f977ee7a672 in base::Thread::ThreadMain() ./../../base/threading/thread.cc:436:3
    #21 0x7f977eede6fc in base::(anonymous namespace)::ThreadFunc(void*) ./../../base/threading/platform_thread_posix.cc:102:13
    #22 0x5625bd1e4136 in asan_thread_start(void*) _asan_rtl_:0

previously allocated by thread T5 (Chrome_ChildIOT) here:
    #0 0x5625bd21ffed in operator new(unsigned long) ??:0:0
    #1 0x7f975f189e90 in std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool> std::__Cr::__try_key_extraction_impl<unsigned long, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool>, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__map_value_compare<unsigned long, std::__Cr::pair<unsigned long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::less<unsigned long>>, std::__Cr::allocator<std::__Cr::pair<unsigned long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&)::'lambda'(unsigned long const&, std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&), std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__map_value_compare<unsigned long, std::__Cr::pair<unsigned long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::less<unsigned long>>, std::__Cr::allocator<std::__Cr::pair<unsigned long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&)::'lambda'(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&), std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>, 0>(std::__Cr::__priority_tag<1ul>, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__map_value_compare<unsigned long, std::__Cr::pair<unsigned long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::less<unsigned long>>, std::__Cr::allocator<std::__Cr::pair<unsigned long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&)::'lambda'(unsigned long const&, std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&), std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__tree_node<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<unsigned long, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::__map_value_compare<unsigned long, std::__Cr::pair<unsigned long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>, std::__Cr::less<unsigned long>>, std::__Cr::allocator<std::__Cr::pair<unsigned long const, network::ThrottlingP2PNetworkInterceptor::StoredSendPacket>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&)::'lambda'(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&), std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<unsigned long const&>&&, std::__Cr::tuple<network::P2PSocketUdp*&, network::P2PPendingPacket&&>&&) ./gen/third_party/libc++/src/include/__new/allocate.h:43:28
    #2 0x7f975f18789f in network::ThrottlingP2PNetworkInterceptor::EnqueueSend(network::P2PPendingPacket, network::P2PSocketUdp*) ./gen/third_party/libc++/src/include/__utility/try_key_extraction.h:108:10
    #3 0x7f975f17b4df in network::P2PSocketUdp::SendPacket(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>, network::P2PPacketInfo const&) ./../../services/network/p2p/socket_udp.cc:566:19
    #4 0x7f975f17afcb in network::P2PSocketUdp::Send(base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>, network::P2PPacketInfo const&) ./../../services/network/p2p/socket_udp.cc:553:7
    #5 0x7f975f3cfcd3 in network::mojom::P2PSocketStubDispatch::Accept(network::mojom::P2PSocket*, mojo::Message*) ./gen/services/network/public/mojom/p2p.mojom.cc:1444:13
    #6 0x7f977f97f2f2 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #7 0x7f977f99669b in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #8 0x7f977f984ba4 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #9 0x7f977f9a5c7e in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42
    #10 0x7f977f9a44ad in mojo::internal::MultiplexRouter::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7
    #11 0x7f977f99669b in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #12 0x7f977f96af0f in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) ./../../mojo/public/cpp/bindings/lib/connector.cc:568:49
    #13 0x7f977f96c75e in mojo::Connector::ReadAllAvailableMessages() ./../../mojo/public/cpp/bindings/lib/connector.cc:629:14
    #14 0x7f977f96c1f7 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) ./../../mojo/public/cpp/bindings/lib/connector.cc:454:3
    #15 0x7f977f96ede1 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) ./../../base/functional/bind_internal.h:740:12
    #16 0x7f977f96e48e in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & ./../../base/functional/callback.h:343:12
    #17 0x7f977f96e244 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) ./../../base/functional/bind_internal.h:673:12
    #18 0x7f977f556490 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & ./../../base/functional/callback.h:343:12
    #19 0x7f977f555e6b in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.cc:286:14
    #20 0x7f977f556808 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) ./../../mojo/public/cpp/system/simple_watcher.cc:97:22
    #21 0x7f977f55357f in mojo::SimpleWatcher::Context::CallNotify(MojoTrapEvent const*) ./../../mojo/public/cpp/system/simple_watcher.cc:61:14
    #22 0x7f977e71d54b in mojo::core::ipcz_driver::MojoTrap::DispatchOrQueueEvent(mojo::core::ipcz_driver::MojoTrap::Trigger&, MojoTrapEvent const&) ./../../mojo/core/ipcz_driver/mojo_trap.cc:605:3
    #23 0x7f977e71f7ca in mojo::core::ipcz_driver::MojoTrap::HandleEvent(IpczTrapEvent const&) ./../../mojo/core/ipcz_driver/mojo_trap.cc:459:3
    #24 0x7f977e7ea9d2 in ipcz::TrapEventDispatcher::~TrapEventDispatcher() ./../../third_party/ipcz/src/ipcz/trap_event_dispatcher.cc:30:5
    #25 0x7f977e7d0fff in ipcz::Router::AcceptInboundParcel(std::__Cr::unique_ptr<ipcz::Parcel, std::__Cr::default_delete<ipcz::Parcel>>) ./../../third_party/ipcz/src/ipcz/router.cc:272:1
    #26 0x7f977e799697 in ipcz::NodeLink::AcceptCompleteParcel(ipcz::StrongAlias<ipcz::SublinkIdTag, unsigned long>, std::__Cr::unique_ptr<ipcz::Parcel, std::__Cr::default_delete<ipcz::Parcel>>) ./../../third_party/ipcz/src/ipcz/node_link.cc:1082:31
    #27 0x7f977e79e323 in ipcz::NodeLink::OnAcceptParcel(ipcz::msg::AcceptParcel&) ./../../third_party/ipcz/src/ipcz/node_link.cc:666:10
    #28 0x7f977e7bff61 in ipcz::msg::NodeMessageListener::OnTransportMessage(ipcz::DriverTransport::RawMessage const&, ipcz::DriverTransport const&, unsigned long) ./../../third_party/ipcz/src/ipcz/node_messages.cc:746:16
    #29 0x7f977e7641f6 in ipcz::(anonymous namespace)::NotifyTransport(unsigned long, void const*, unsigned long, unsigned long const*, unsigned long, unsigned int, IpczTransportActivityOptions const*) ./../../third_party/ipcz/src/ipcz/driver_transport.cc:129:20

Thread T5 (Chrome_ChildIOT) created by T0 (chrome) here:
    #0 0x5625bd1c9ef1 in ___interceptor_pthread_create ??:0:0
    #1 0x7f977eedddbc in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) ./../../base/threading/platform_thread_posix.cc:153:13
    #2 0x7f977ee78c20 in base::Thread::StartWithOptions(base::Thread::Options) ./../../base/threading/thread.cc:228:26
    #3 0x7f976febaae3 in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr<base::ThreadPoolInstance::InitParams, std::__Cr::default_delete<base::ThreadPoolInstance::InitParams>>, bool) ./../../content/child/child_process.cc:152:21
    #4 0x7f9774b1369c in content::UtilityMain(content::MainFunctionParams) ./../../content/utility/utility_main.cc:459:16
    #5 0x7f9774c5335d in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:762:14
    #6 0x7f9774c55a7a in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner_impl.cc:1152:10
    #7 0x7f9774c501d3 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ./../../content/app/content_main.cc:358:36
    #8 0x7f9774c5055a in content::ContentMain(content::ContentMainParams) ./../../content/app/content_main.cc:371:10
    #9 0x5625bd221a35 in ChromeMain ./../../chrome/app/chrome_main.cc:191:12
    #10 0x7f970e429d8f in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-use-after-free (/home/sakura/chromium/src/out/asan-release/libservices_network_network_service.so+0x788312) (BuildId: 472f5371585884be)
Shadow bytes around the buggy address:
  0x7ca70078e500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7ca70078e580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x7ca70078e600: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x7ca70078e680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7ca70078e700: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa
=>0x7ca70078e780: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7ca70078e800: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x7ca70078e880: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x7ca70078e900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7ca70078e980: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa
  0x7ca70078ea00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==3627845==ADDITIONAL INFO

==3627845==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7f975f18805b in network::ThrottlingP2PNetworkInterceptor::OnSendNetworkTimer() ./../../services/network/throttling/throttling_p2p_network_interceptor.cc:167:9
    #1 0x7f975f1878e6 in network::ThrottlingP2PNetworkInterceptor::EnqueueSend(network::P2PPendingPacket, network::P2PSocketUdp*) ./../../services/network/throttling/throttling_p2p_network_interceptor.cc:133:11


Command line: `/proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --use-angle=swiftshader-webgl --crashpad-handler-pid=3627811 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/poc-p2p-41m3v5cg --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,13825710828006225590,8971140582444714202,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,12712770966976079336,1376259582626618617,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=stderr --v=1`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==3627845==END OF ADDITIONAL INFO

==3627845==ABORTING