IMPORTANT DEBUGGING NOTE: batches of tests are run inside their
own process. For debugging a test inside a debugger, use the
--gtest_filter=<your_test_name> flag along with
--single-process-tests.
Using sharding settings from environment. This is shard 0/1
Using 1 parallel jobs.
Note: Google Test filter = RpcDemuxerStreamHandlerUAFTest.DelayedReadUntilTaskRunsAfterOwnerDestroyed
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from RpcDemuxerStreamHandlerUAFTest
[ RUN      ] RpcDemuxerStreamHandlerUAFTest.DelayedReadUntilTaskRunsAfterOwnerDestroyed
[1975:1975:WARNING:components/cast_streaming/browser/control/remoting/rpc_demuxer_stream_handler.cc:205] Received an audio config for a video DemuxerStream
[1975:1975:WARNING:components/cast_streaming/browser/control/remoting/rpc_demuxer_stream_handler.cc:232] Failed to process OnRpcReadUntilCallback.
[1975:1975:WARNING:components/cast_streaming/browser/control/remoting/rpc_demuxer_stream_handler.cc:205] Received an audio config for a video DemuxerStream
[1975:1975:WARNING:components/cast_streaming/browser/control/remoting/rpc_demuxer_stream_handler.cc:232] Failed to process OnRpcReadUntilCallback.
=================================================================
==1975==ERROR: AddressSanitizer: heap-use-after-free on address 0x7bbe4b1e3538 at pc 0x5610e17a1abb bp 0x7fff48a2d5d0 sp 0x7fff48a2d5c8
WRITE of size 4 at 0x7bbe4b1e3538 thread T0
    #0 0x5610e17a1aba in cast_streaming::remoting::FakeDispatcher::SendMessage(int, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>) components/cast_streaming/browser/control/remoting/rpc_demuxer_stream_handler_unittest.cc:529:18
    #1 0x5610e17a228a in base::internal::Invoker<base::internal::FunctorTraits<void (cast_streaming::remoting::FakeDispatcher::* const&)(int, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>), cast_streaming::remoting::FakeDispatcher*>, base::internal::BindState<true, true, false, void (cast_streaming::remoting::FakeDispatcher::*)(int, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>), base::internal::UnretainedWrapper<cast_streaming::remoting::FakeDispatcher, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (int, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>)>::Run(base::internal::BindStateBase*, int, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>&&) base/functional/bind_internal.h:740:12
    #2 0x5610e0c411b1 in base::RepeatingCallback<void (int, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>)>::Run(int, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>) && base/functional/callback.h:363:12
    #3 0x5610e0c40f99 in base::internal::Invoker<base::internal::FunctorTraits<base::RepeatingCallback<void (int, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>)>&&, int&&, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>&&>, base::internal::BindState<false, true, true, base::RepeatingCallback<void (int, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>)>, int, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:832:49
    #4 0x5610e1ec9c56 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #5 0x5610e1f3e719 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #6 0x5610e1f3d58a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #7 0x5610e1efd0b7 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #8 0x5610e1f3fe27 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #9 0x5610e1e8f420 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #10 0x5610e1e913ec in base::RunLoop::RunUntilIdle() base/run_loop.cc:144:3
    #11 0x5610e699ca11 in base::test::TaskEnvironment::RunUntilIdle() base/test/task_environment.cc:712:51
    #12 0x5610e699d128 in base::test::TaskEnvironment::FastForwardByInternal(base::TimeDelta, bool) base/test/task_environment.cc:820:5
    #13 0x5610e17722bf in cast_streaming::remoting::RpcDemuxerStreamHandlerUAFTest_DelayedReadUntilTaskRunsAfterOwnerDestroyed_Test::TestBody() components/cast_streaming/browser/control/remoting/rpc_demuxer_stream_handler_unittest.cc:582:20
    #14 0x5610e17efb4b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #15 0x5610e17f1d47 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #16 0x5610e17f3e53 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #17 0x5610e1823caa in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #18 0x5610e182270e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #19 0x5610e69aefdc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #20 0x5610dcff9f91 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), TestSuiteNoAtExit*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<TestSuiteNoAtExit, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #21 0x5610e69bc39b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #22 0x5610e69bbcbb in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #23 0x5610dcff9c75 in main media/test/run_all_unittests.cc:52:10
    #24 0x7f8e4cbfa249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7bbe4b1e3538 is located 24 bytes inside of 32-byte region [0x7bbe4b1e3520,0x7bbe4b1e3540)
freed by thread T0 here:
    #0 0x5610dcff91c2 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/cast_streaming_unittests+0x44ca1c2) (BuildId: 97daae786ff293fb)
    #1 0x5610e17722a6 in cast_streaming::remoting::RpcDemuxerStreamHandlerUAFTest_DelayedReadUntilTaskRunsAfterOwnerDestroyed_Test::TestBody() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5610e17efb4b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x5610e17f1d47 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x5610e17f3e53 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x5610e1823caa in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x5610e182270e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x5610e69aefdc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x5610dcff9f91 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), TestSuiteNoAtExit*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<TestSuiteNoAtExit, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x5610e69bc39b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x5610e69bbcbb in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x5610dcff9c75 in main media/test/run_all_unittests.cc:52:10
    #12 0x7f8e4cbfa249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 here:
    #0 0x5610dcff85bd in operator new(unsigned long) (/chromium/chromium/src/out/asan/cast_streaming_unittests+0x44c95bd) (BuildId: 97daae786ff293fb)
    #1 0x5610e1771efe in cast_streaming::remoting::RpcDemuxerStreamHandlerUAFTest_DelayedReadUntilTaskRunsAfterOwnerDestroyed_Test::TestBody() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x5610e17efb4b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x5610e17f1d47 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x5610e17f3e53 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x5610e1823caa in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x5610e182270e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x5610e69aefdc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x5610dcff9f91 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), TestSuiteNoAtExit*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<TestSuiteNoAtExit, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x5610e69bc39b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x5610e69bbcbb in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x5610dcff9c75 in main media/test/run_all_unittests.cc:52:10
    #12 0x7f8e4cbfa249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free components/cast_streaming/browser/control/remoting/rpc_demuxer_stream_handler_unittest.cc:529:18 in cast_streaming::remoting::FakeDispatcher::SendMessage(int, std::__Cr::unique_ptr<openscreen::cast::RpcMessage, std::__Cr::default_delete<openscreen::cast::RpcMessage>>)
Shadow bytes around the buggy address:
  0x7bbe4b1e3280: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
  0x7bbe4b1e3300: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x7bbe4b1e3380: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x7bbe4b1e3400: fd fd fd fa fa fa fd fd fd fa fa fa 00 00 00 00
  0x7bbe4b1e3480: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
=>0x7bbe4b1e3500: 00 00 fa fa fd fd fd[fd]fa fa 00 00 00 00 fa fa
  0x7bbe4b1e3580: 00 00 00 00 fa fa 00 00 00 00 fa fa fc fc fc fc
  0x7bbe4b1e3600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7bbe4b1e3680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7bbe4b1e3700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7bbe4b1e3780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==1975==ADDITIONAL INFO

==1975==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5610e0c40599 in cast_streaming::remoting::RpcDemuxerStreamHandler::MessageProcessor::OnNoBuffersAvailable() components/cast_streaming/browser/control/remoting/rpc_demuxer_stream_handler.cc:309:7


==1975==END OF ADDITIONAL INFO

==1975==ABORTING
[1/1] RpcDemuxerStreamHandlerUAFTest.DelayedReadUntilTaskRunsAfterOwnerDestroyed (CRASHED)
1 test crashed:
    RpcDemuxerStreamHandlerUAFTest.DelayedReadUntilTaskRunsAfterOwnerDestroyed (../../components/cast_streaming/browser/control/remoting/rpc_demuxer_stream_handler_unittest.cc:539)
Tests took 1 seconds.