==2672==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d3266c2c358 at pc 0x5604d23d3e00 bp 0x7bb1f8ba9ad0 sp 0x7bb1f8ba9ac8
READ of size 8 at 0x7d3266c2c358 thread T76 (VizCompositorTh)
    #0 0x5604d23d3dff in cc::DamageTracker::InitializeUpdateDamageTracking(cc::LayerTreeImpl*, base::flat_map<viz::ViewTransitionElementResourceId, cc::RenderSurfaceImpl*, std::__Cr::less<void>, std::__Cr::vector<std::__Cr::pair<viz::ViewTransitionElementResourceId, cc::RenderSurfaceImpl*>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId, cc::RenderSurfaceImpl*>>>>&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:266:112
    #1 0x5604d23d3587 in cc::DamageTracker::UpdateDamageTracking(cc::LayerTreeImpl*) cc/trees/damage_tracker.cc:107:3
    #2 0x5604d24d1d7c in cc::LayerTreeHostImpl::CalculateRenderPasses(cc::FrameData*, bool) cc/trees/layer_tree_host_impl.cc:1420:3
    #3 0x5604d24d83d7 in cc::LayerTreeHostImpl::PrepareToDraw(cc::FrameData*, bool) cc/trees/layer_tree_host_impl.cc:1902:28
    #4 0x5604d88c0995 in viz::LayerContextImpl::DoDrawInternal(viz::BeginFrameArgs const&, base::TimeTicks, std::__Cr::optional<bool>) components/viz/service/layers/layer_context_impl.cc:2280:34
    #5 0x5604d88c03e4 in viz::LayerContextImpl::BeginFrame(viz::BeginFrameArgs const&) components/viz/service/layers/layer_context_impl.cc:1673:5
    #6 0x5604d83652c6 in viz::CompositorFrameSinkSupport::OnBeginFrame(viz::BeginFrameArgs const&) components/viz/service/frame_sinks/compositor_frame_sink_support.cc:1250:23
    #7 0x5604d274c075 in viz::DelayBasedBeginFrameSource::IssueBeginFrameToObserver(viz::BeginFrameObserver*, viz::BeginFrameArgs const&) components/viz/common/frame_sinks/begin_frame_source.cc:50:13
    #8 0x5604d274cc4c in viz::DelayBasedBeginFrameSource::OnTimerTick() components/viz/common/frame_sinks/begin_frame_source.cc:463:5
    #9 0x5604d2757c41 in base::internal::Invoker<base::internal::FunctorTraits<void (viz::DelayBasedTimeSource::* const&)(), viz::DelayBasedTimeSource*>, base::internal::BindState<true, true, false, void (viz::DelayBasedTimeSource::*)(), base::internal::UnretainedWrapper<viz::DelayBasedTimeSource, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #10 0x5604cca06efb in base::DeadlineTimer::OnScheduledTaskInvoked() base/functional/callback.h:155:12
    #11 0x5604cca07571 in base::internal::Invoker<base::internal::FunctorTraits<void (base::DeadlineTimer::* const&)(), base::DeadlineTimer*>, base::internal::BindState<true, true, false, void (base::DeadlineTimer::*)(), base::internal::UnretainedWrapper<base::DeadlineTimer, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #12 0x5604cc8debf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #13 0x5604cc956299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #14 0x5604cc95510a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #15 0x5604ccb03cb8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #16 0x5604ccb07278 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #17 0x7fb269f63718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)

0x7d3266c2c358 is located 728 bytes inside of 784-byte region [0x7d3266c2c080,0x7d3266c2c390)
freed by thread T76 (VizCompositorTh) here:
    #0 0x5604b4929002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e15002) (BuildId: ace85654442a70cd)
    #1 0x5604d26b841b in std::__Cr::vector<std::__Cr::unique_ptr<cc::RenderSurfaceImpl, std::__Cr::default_delete<cc::RenderSurfaceImpl>>, std::__Cr::allocator<std::__Cr::unique_ptr<cc::RenderSurfaceImpl, std::__Cr::default_delete<cc::RenderSurfaceImpl>>>>::resize(unsigned long) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5604d88c0244 in viz::LayerContextImpl::BeginFrame(viz::BeginFrameArgs const&) components/viz/service/layers/layer_context_impl.cc:1651:18
    #3 0x5604d83652c6 in viz::CompositorFrameSinkSupport::OnBeginFrame(viz::BeginFrameArgs const&) components/viz/service/frame_sinks/compositor_frame_sink_support.cc:1250:23
    #4 0x5604d274c075 in viz::DelayBasedBeginFrameSource::IssueBeginFrameToObserver(viz::BeginFrameObserver*, viz::BeginFrameArgs const&) components/viz/common/frame_sinks/begin_frame_source.cc:50:13
    #5 0x5604d274cc4c in viz::DelayBasedBeginFrameSource::OnTimerTick() components/viz/common/frame_sinks/begin_frame_source.cc:463:5
    #6 0x5604d2757c41 in base::internal::Invoker<base::internal::FunctorTraits<void (viz::DelayBasedTimeSource::* const&)(), viz::DelayBasedTimeSource*>, base::internal::BindState<true, true, false, void (viz::DelayBasedTimeSource::*)(), base::internal::UnretainedWrapper<viz::DelayBasedTimeSource, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #7 0x5604cca06efb in base::DeadlineTimer::OnScheduledTaskInvoked() base/functional/callback.h:155:12
    #8 0x5604cca07571 in base::internal::Invoker<base::internal::FunctorTraits<void (base::DeadlineTimer::* const&)(), base::DeadlineTimer*>, base::internal::BindState<true, true, false, void (base::DeadlineTimer::*)(), base::internal::UnretainedWrapper<base::DeadlineTimer, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x5604cc8debf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #10 0x5604cc956299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #11 0x5604cc95510a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #12 0x5604ccb03cb8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #13 0x5604ccb07278 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #14 0x7fb269f63718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)

previously allocated by thread T76 (VizCompositorTh) here:
    #0 0x5604b49283fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e143fd) (BuildId: ace85654442a70cd)
    #1 0x5604d26be117 in cc::EffectTree::CreateOrReuseRenderSurfaces(std::__Cr::vector<std::__Cr::unique_ptr<cc::RenderSurfaceImpl, std::__Cr::default_delete<cc::RenderSurfaceImpl>>, std::__Cr::allocator<std::__Cr::unique_ptr<cc::RenderSurfaceImpl, std::__Cr::default_delete<cc::RenderSurfaceImpl>>>>*, cc::LayerTreeImpl*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x5604d88d0a60 in viz::LayerContextImpl::DoUpdateDisplayTree(mojo::StructPtr<viz::mojom::LayerTreeUpdate>) components/viz/service/layers/layer_context_impl.cc:2211:44
    #3 0x5604d88c361d in viz::LayerContextImpl::UpdateDisplayTree(mojo::StructPtr<viz::mojom::LayerTreeUpdate>) components/viz/service/layers/layer_context_impl.cc:1901:17
    #4 0x5604b8fa12b5 in viz::mojom::LayerContextStubDispatch::Accept(viz::mojom::LayerContext*, mojo::Message*) gen/services/viz/public/mojom/compositing/layer_context.mojom.cc:1267:13
    #5 0x5604cc69e939 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #6 0x5604cc6bc7c1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #7 0x5604cc6a4de3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #8 0x5604cc6cc718 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42
    #9 0x5604cc6cabf8 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7
    #10 0x5604cc6bc7c1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #11 0x5604cc69555a in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) mojo/public/cpp/bindings/lib/connector.cc:567:49
    #12 0x5604cc696be0 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14
    #13 0x5604cc696639 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3
    #14 0x5604cc698494 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12
    #15 0x5604b9c547ae in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12
    #16 0x5604b9c5454a in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12
    #17 0x5604cd52f520 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12
    #18 0x5604cd52ee60 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14
    #19 0x5604cd530027 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #20 0x5604cc8debf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #21 0x5604cc956299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #22 0x5604cc95510a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #23 0x5604ccb03cb8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #24 0x5604ccb07278 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #25 0x7fb269f63718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)

Thread T76 (VizCompositorTh) created by T0 (chrome) here:
    #0 0x5604b48d2a71 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10dbea71) (BuildId: ace85654442a70cd)
    #1 0x5604cca47b12 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x5604cc9e3408 in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:231:26
    #3 0x5604c434a750 in viz::VizCompositorThreadRunnerImpl::VizCompositorThreadRunnerImpl() components/viz/service/main/viz_compositor_thread_runner_impl.cc:121:17
    #4 0x5604c4350fc8 in viz::VizMainImpl::VizMainImpl(viz::VizMainImpl::Delegate*, viz::VizMainImpl::ExternalDependencies, std::__Cr::unique_ptr<gpu::GpuInit, std::__Cr::default_delete<gpu::GpuInit>>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #5 0x5604d814a762 in content::GpuChildThread::GpuChildThread(base::RepeatingCallback<void ()>, content::ChildThreadImpl::Options, std::__Cr::unique_ptr<gpu::GpuInit, std::__Cr::default_delete<gpu::GpuInit>>) content/gpu/gpu_child_thread.cc:132:7
    #6 0x5604d814a4b4 in content::GpuChildThread::GpuChildThread(base::RepeatingCallback<void ()>, std::__Cr::unique_ptr<gpu::GpuInit, std::__Cr::default_delete<gpu::GpuInit>>) content/gpu/gpu_child_thread.cc:118:7
    #7 0x5604d8148ca1 in content::GpuMain(content::MainFunctionParams) content/gpu/gpu_main.cc:435:11
    #8 0x5604c83f6a2f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #9 0x5604c83f7d5f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #10 0x5604c83faa68 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #11 0x5604c83f4441 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #12 0x5604c83f4a3c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #13 0x5604b4929b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #14 0x7fb268a2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__memory/unique_ptr.h:266:112 in cc::DamageTracker::InitializeUpdateDamageTracking(cc::LayerTreeImpl*, base::flat_map<viz::ViewTransitionElementResourceId, cc::RenderSurfaceImpl*, std::__Cr::less<void>, std::__Cr::vector<std::__Cr::pair<viz::ViewTransitionElementResourceId, cc::RenderSurfaceImpl*>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId, cc::RenderSurfaceImpl*>>>>&)
Shadow bytes around the buggy address:
  0x7d3266c2c080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d3266c2c100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d3266c2c180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d3266c2c200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d3266c2c280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d3266c2c300: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
  0x7d3266c2c380: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7d3266c2c400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x7d3266c2c480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d3266c2c500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d3266c2c580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2672==ADDITIONAL INFO

==2672==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5604d275720e in viz::DelayBasedTimeSource::PostNextTickTask(base::TimeTicks) components/viz/common/frame_sinks/delay_based_time_source.cc:172:18
    #1 0x5604d275720e in viz::DelayBasedTimeSource::PostNextTickTask(base::TimeTicks) components/viz/common/frame_sinks/delay_based_time_source.cc:172:18
    #2 0x5604d275720e in viz::DelayBasedTimeSource::PostNextTickTask(base::TimeTicks) components/viz/common/frame_sinks/delay_based_time_source.cc:172:18
    #3 0x5604d275720e in viz::DelayBasedTimeSource::PostNextTickTask(base::TimeTicks) components/viz/common/frame_sinks/delay_based_time_source.cc:172:18


Command line: `/proc/self/exe --type=gpu-process --no-sandbox --ozone-platform=x11 --crashpad-handler-pid=2644 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --gpu-preferences=UAAAAAAAAAAgAQAEAAAAAAAAAAAAAMAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAYAAAAAAAAABgAAAAAAAAAAQAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --shared-files --metrics-shmem-handle=4,i,1620813260848236935,11590135155957955596,262144 --field-trial-handle=3,i,16960817880363955507,3463679845891302713,262144 --enable-features=TreesInViz,kTreeAnimationsInViz --disable-features=DialMediaRouteProvider --variations-seed-version --pseudonymization-salt-handle=7,i,1198796249106854265,4529845302955096656,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=stderr`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==2672==END OF ADDITIONAL INFO

==2672==ABORTING