Note: Google Test filter = TouchSelectionControllerUAFTest.AutoResetWriteAfterFree
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from TouchSelectionControllerUAFTest
[ RUN      ] TouchSelectionControllerUAFTest.AutoResetWriteAfterFree
=================================================================
==1732==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cd7149e55e8 at pc 0x55b1718aaa51 bp 0x7ffe22f88370 sp 0x7ffe22f88368
WRITE of size 4 at 0x7cd7149e55e8 thread T0
    #0 0x55b1718aaa50 in ui::TouchSelectionController::OnSelectionBoundsChanged(gfx::SelectionBound const&, gfx::SelectionBound const&) base/auto_reset.h:62:25
    #1 0x55b16d1ed947 in ui::(anonymous namespace)::TouchSelectionControllerUAFTest_AutoResetWriteAfterFree_Test::TestBody() ui/touch_selection/touch_selection_controller_unittest.cc:1984:24
    #2 0x55b17173d70b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x55b17173f907 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x55b171741a13 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x55b17177186a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x55b1717702ce in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x55b176918f6c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x55b1718b3051 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), base::(anonymous namespace)::BaseUnittestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::(anonymous namespace)::BaseUnittestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x55b176934c6b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x55b17693458b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x55b1718b2d40 in main base/test/run_all_unittests.cc:79:10
    #12 0x7fb716125249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7cd7149e55e8 is located 40 bytes inside of 288-byte region [0x7cd7149e55c0,0x7cd7149e56e0)
freed by thread T0 here:
    #0 0x55b16d120d42 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/ui_touch_selection_unittests+0x4010d42) (BuildId: a4bd8ae64f98f4b6)
    #1 0x55b1718aa899 in ui::TouchSelectionController::OnSelectionBoundsChanged(gfx::SelectionBound const&, gfx::SelectionBound const&) ui/touch_selection/touch_selection_controller.cc:136:5
    #2 0x55b16d1ed947 in ui::(anonymous namespace)::TouchSelectionControllerUAFTest_AutoResetWriteAfterFree_Test::TestBody() ui/touch_selection/touch_selection_controller_unittest.cc:1984:24
    #3 0x55b17173d70b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #4 0x55b17173f907 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #5 0x55b171741a13 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #6 0x55b17177186a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #7 0x55b1717702ce in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x55b176918f6c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #9 0x55b1718b3051 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), base::(anonymous namespace)::BaseUnittestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::(anonymous namespace)::BaseUnittestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #10 0x55b176934c6b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #11 0x55b17693458b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #12 0x55b1718b2d40 in main base/test/run_all_unittests.cc:79:10
    #13 0x7fb716125249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 here:
    #0 0x55b16d12013d in operator new(unsigned long) (/chromium/chromium/src/out/asan/ui_touch_selection_unittests+0x401013d) (BuildId: a4bd8ae64f98f4b6)
    #1 0x55b16d1ed754 in ui::(anonymous namespace)::TouchSelectionControllerUAFTest_AutoResetWriteAfterFree_Test::TestBody() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x55b17173d70b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x55b17173f907 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x55b171741a13 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x55b17177186a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x55b1717702ce in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x55b176918f6c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x55b1718b3051 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), base::(anonymous namespace)::BaseUnittestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::(anonymous namespace)::BaseUnittestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x55b176934c6b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x55b17693458b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x55b1718b2d40 in main base/test/run_all_unittests.cc:79:10
    #12 0x7fb716125249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free base/auto_reset.h:62:25 in ui::TouchSelectionController::OnSelectionBoundsChanged(gfx::SelectionBound const&, gfx::SelectionBound const&)
Shadow bytes around the buggy address:
  0x7cd7149e5300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cd7149e5380: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x7cd7149e5400: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x7cd7149e5480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cd7149e5500: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
=>0x7cd7149e5580: fa fa fa fa fa fa fa fa fd fd fd fd fd[fd]fd fd
  0x7cd7149e5600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cd7149e5680: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x7cd7149e5700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7cd7149e5780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7cd7149e5800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==1732==ADDITIONAL INFO

==1732==Note: Please include this section with the ASan report.
Task trace:


==1732==END OF ADDITIONAL INFO

==1732==ABORTING