================================================================= ==14276==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x11e5e36f8548 at pc 0x7ffd572bdfb9 bp 0x003870bfd040 sp 0x003870bfd088 READ of size 1 at 0x11e5e36f8548 thread T0 #0 0x7ffd572bdfb8 in TabDragController::AttachToNewContext C:\chromium\src\chrome\browser\ui\views\tabs\dragging\tab_drag_controller.cc:1387 #1 0x7ffd572b92e4 in TabDragController::DetachIntoNewBrowserAndRunMoveLoop C:\chromium\src\chrome\browser\ui\views\tabs\dragging\tab_drag_controller.cc:1637 #2 0x7ffd572b7524 in TabDragController::DragBrowserToNewTabStrip C:\chromium\src\chrome\browser\ui\views\tabs\dragging\tab_drag_controller.cc:1009 #3 0x7ffd572b2f1e in TabDragController::ContinueDragging C:\chromium\src\chrome\browser\ui\views\tabs\dragging\tab_drag_controller.cc:983 #4 0x7ffd572ac898 in TabDragController::Drag C:\chromium\src\chrome\browser\ui\views\tabs\dragging\tab_drag_controller.cc:731 #5 0x7ffd5b894752 in TabStrip::TabDragContextImpl::OnMouseDragged C:\chromium\src\chrome\browser\ui\views\tabs\tab_strip.cc:204 #6 0x7ffd9bee36d4 in views::View::ProcessMouseDragged C:\chromium\src\ui\views\view.cc:3859 #7 0x7ffd9bee2a3d in views::View::OnMouseEvent C:\chromium\src\ui\views\view.cc:1763 #8 0x7ffddde9b7b2 in ui::EventDispatcher::DispatchEvent C:\chromium\src\ui\events\event_dispatcher.cc:189 #9 0x7ffddde9a1ff in ui::EventDispatcher::ProcessEvent C:\chromium\src\ui\events\event_dispatcher.cc:138 #10 0x7ffddde9955e in ui::EventDispatcherDelegate::DispatchEventToTarget C:\chromium\src\ui\events\event_dispatcher.cc:84 #11 0x7ffddde98ebd in ui::EventDispatcherDelegate::DispatchEvent C:\chromium\src\ui\events\event_dispatcher.cc:56 #12 0x7ffd9bf27d80 in views::internal::RootView::OnMouseDragged C:\chromium\src\ui\views\widget\root_view.cc:601 #13 0x7ffd9bf606f5 in views::Widget::OnMouseEvent C:\chromium\src\ui\views\widget\widget.cc:2229 #14 0x7ffd9c0870d8 in views::DesktopNativeWidgetAura::OnMouseEvent C:\chromium\src\ui\views\widget\desktop_aura\desktop_native_widget_aura.cc:1448 #15 0x7ffddde9b7b2 in ui::EventDispatcher::DispatchEvent C:\chromium\src\ui\events\event_dispatcher.cc:189 #16 0x7ffddde9a1ff in ui::EventDispatcher::ProcessEvent C:\chromium\src\ui\events\event_dispatcher.cc:138 #17 0x7ffddde9955e in ui::EventDispatcherDelegate::DispatchEventToTarget C:\chromium\src\ui\events\event_dispatcher.cc:84 #18 0x7ffddde98ebd in ui::EventDispatcherDelegate::DispatchEvent C:\chromium\src\ui\events\event_dispatcher.cc:56 #19 0x7ffdddea2ab1 in ui::EventProcessor::OnEventFromSource C:\chromium\src\ui\events\event_processor.cc:72 #20 0x7ffdddea6a30 in ui::EventSource::DeliverEventToSink C:\chromium\src\ui\events\event_source.cc:119 #21 0x7ffdddea6310 in ui::EventSource::SendEventToSinkFromRewriter C:\chromium\src\ui\events\event_source.cc:134 #22 0x7ffd9c0a6f76 in views::DesktopWindowTreeHostWin::HandleMouseEvent C:\chromium\src\ui\views\widget\desktop_aura\desktop_window_tree_host_win.cc:1232 #23 0x7ffd9bfcca99 in views::HWNDMessageHandler::HandleMouseEventInternal C:\chromium\src\ui\views\win\hwnd_message_handler.cc:3433 #24 0x7ffd9bfc5f12 in views::HWNDMessageHandler::_ProcessWindowMessage C:\chromium\src\ui\views\win\hwnd_message_handler.h:413 #25 0x7ffd9bfc564d in views::HWNDMessageHandler::OnWndProc C:\chromium\src\ui\views\win\hwnd_message_handler.cc:1179 #26 0x7ffdb4c3bd1e in gfx::WindowImpl::WndProc C:\chromium\src\ui\gfx\win\window_impl.cc:309 #27 0x7ffdb4c3a32e in base::win::WrappedWindowProc<&gfx::WindowImpl::WndProc> C:\chromium\src\base\win\wrapped_window_proc.h:74 #28 0x7ffe8f9fc395 in UserCallWinProcCheckWow+0x355 (C:\WINDOWS\System32\USER32.dll+0x18000c395) #29 0x7ffe8f9fa7ec in DispatchMessageWorker+0x1dc (C:\WINDOWS\System32\USER32.dll+0x18000a7ec) #30 0x7ffd9f8eeb63 in base::MessagePumpForUI::ProcessMessageHelper C:\chromium\src\base\message_loop\message_pump_win.cc:661 #31 0x7ffd9f8ecb2c in base::MessagePumpForUI::ProcessNextWindowsMessage C:\chromium\src\base\message_loop\message_pump_win.cc:622 #32 0x7ffd9f8ebec6 in base::MessagePumpForUI::DoRunLoop C:\chromium\src\base\message_loop\message_pump_win.cc:266 #33 0x7ffd9f8e97b7 in base::MessagePumpWin::Run C:\chromium\src\base\message_loop\message_pump_win.cc:90 #34 0x7ffd9f7466bb in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:640 #35 0x7ffd9f60a51d in base::RunLoop::Run C:\chromium\src\base\run_loop.cc:135 #36 0x7ffd328f102b in content::BrowserMainLoop::RunMainMessageLoop C:\chromium\src\content\browser\browser_main_loop.cc:1103 #37 0x7ffd328f9af9 in content::BrowserMainRunnerImpl::Run C:\chromium\src\content\browser\browser_main_runner_impl.cc:151 #38 0x7ffd328e75fc in content::BrowserMain C:\chromium\src\content\browser\browser_main.cc:32 #39 0x7ffd3648c34f in content::RunBrowserProcessMain C:\chromium\src\content\app\content_main_runner_impl.cc:696 #40 0x7ffd364900bd in content::ContentMainRunnerImpl::RunBrowser C:\chromium\src\content\app\content_main_runner_impl.cc:1320 #41 0x7ffd3648f767 in content::ContentMainRunnerImpl::Run C:\chromium\src\content\app\content_main_runner_impl.cc:1150 #42 0x7ffd3648a538 in content::RunContentProcess C:\chromium\src\content\app\content_main.cc:356 #43 0x7ffd3648ac70 in content::ContentMain C:\chromium\src\content\app\content_main.cc:369 #44 0x7ffd49b62c13 in ChromeMain C:\chromium\src\chrome\app\chrome_main.cc:194 #45 0x7ff69585478b in MainDllLoader::Launch C:\chromium\src\chrome\app\main_dll_loader_win.cc:244 #46 0x7ff69585210d in main C:\chromium\src\chrome\app\chrome_exe_main_win.cc:341 #47 0x7ff695a0eb23 in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #48 0x7ffe90c4e956 in BaseThreadInitThunk+0x16 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e956) #49 0x7ffe9164427b in RtlUserThreadStart+0x2b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18000427b) 0x11e5e36f8548 is located 32 bytes after 104-byte region [0x11e5e36f84c0,0x11e5e36f8528) allocated by thread T0 here: #0 0x7ffd9d05e3df in operator new C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_new_delete.cpp:109 #1 0x7ffd572ccb0a in std::__Cr::vector >::__emplace_back_slow_path &,TabSlotView *&> C:\chromium\src\third_party\libc++\src\include\__vector\vector.h:1105 #2 0x7ffd572cc950 in std::__Cr::__if_likely_else<`lambda at C:\chromium\src\out\asan\..\..\third_party\libc++\src\include\__vector\vector.h:1144:7',`lambda at C:\chromium\src\out\asan\..\..\third_party\libc++\src\include\__vector\vector.h:1148:7'> C:\chromium\src\third_party\libc++\src\include\__vector\vector.h:1128 #3 0x7ffd572a9237 in TabDragController::Init C:\chromium\src\chrome\browser\ui\views\tabs\dragging\tab_drag_controller.cc:495 #4 0x7ffd5b88c736 in TabStrip::TabDragContextImpl::MaybeStartDrag C:\chromium\src\chrome\browser\ui\views\tabs\tab_strip.cc:362 #5 0x7ffd5b88b543 in TabStrip::MaybeStartDrag C:\chromium\src\chrome\browser\ui\views\tabs\tab_strip.cc:1926 #6 0x7ffd5b85bd7f in Tab::OnMousePressed C:\chromium\src\chrome\browser\ui\views\tabs\tab.cc:626 #7 0x7ffd9bee30f8 in views::View::ProcessMousePressed C:\chromium\src\ui\views\view.cc:3817 #8 0x7ffd9bee2835 in views::View::OnMouseEvent C:\chromium\src\ui\views\view.cc:1749 #9 0x7ffddde9b7b2 in ui::EventDispatcher::DispatchEvent C:\chromium\src\ui\events\event_dispatcher.cc:189 #10 0x7ffddde9a1ff in ui::EventDispatcher::ProcessEvent C:\chromium\src\ui\events\event_dispatcher.cc:138 #11 0x7ffddde9955e in ui::EventDispatcherDelegate::DispatchEventToTarget C:\chromium\src\ui\events\event_dispatcher.cc:84 #12 0x7ffddde98ebd in ui::EventDispatcherDelegate::DispatchEvent C:\chromium\src\ui\events\event_dispatcher.cc:56 #13 0x7ffd9bf26d13 in views::internal::RootView::OnMousePressed C:\chromium\src\ui\views\widget\root_view.cc:554 #14 0x7ffd9bf60960 in views::Widget::OnMouseEvent C:\chromium\src\ui\views\widget\widget.cc:2187 #15 0x7ffd9c0870d8 in views::DesktopNativeWidgetAura::OnMouseEvent C:\chromium\src\ui\views\widget\desktop_aura\desktop_native_widget_aura.cc:1448 #16 0x7ffddde9b7b2 in ui::EventDispatcher::DispatchEvent C:\chromium\src\ui\events\event_dispatcher.cc:189 #17 0x7ffddde9a1ff in ui::EventDispatcher::ProcessEvent C:\chromium\src\ui\events\event_dispatcher.cc:138 #18 0x7ffddde9955e in ui::EventDispatcherDelegate::DispatchEventToTarget C:\chromium\src\ui\events\event_dispatcher.cc:84 #19 0x7ffddde98ebd in ui::EventDispatcherDelegate::DispatchEvent C:\chromium\src\ui\events\event_dispatcher.cc:56 #20 0x7ffdddea2ab1 in ui::EventProcessor::OnEventFromSource C:\chromium\src\ui\events\event_processor.cc:72 #21 0x7ffdddea6a30 in ui::EventSource::DeliverEventToSink C:\chromium\src\ui\events\event_source.cc:119 #22 0x7ffdddea6310 in ui::EventSource::SendEventToSinkFromRewriter C:\chromium\src\ui\events\event_source.cc:134 #23 0x7ffd9c0a6f76 in views::DesktopWindowTreeHostWin::HandleMouseEvent C:\chromium\src\ui\views\widget\desktop_aura\desktop_window_tree_host_win.cc:1232 #24 0x7ffd9bfcca99 in views::HWNDMessageHandler::HandleMouseEventInternal C:\chromium\src\ui\views\win\hwnd_message_handler.cc:3433 #25 0x7ffd9bfc5f12 in views::HWNDMessageHandler::_ProcessWindowMessage C:\chromium\src\ui\views\win\hwnd_message_handler.h:413 #26 0x7ffd9bfc564d in views::HWNDMessageHandler::OnWndProc C:\chromium\src\ui\views\win\hwnd_message_handler.cc:1179 #27 0x7ffdb4c3bd1e in gfx::WindowImpl::WndProc C:\chromium\src\ui\gfx\win\window_impl.cc:309 SUMMARY: AddressSanitizer: heap-buffer-overflow C:\chromium\src\chrome\browser\ui\views\tabs\dragging\tab_drag_controller.cc:1387 in TabDragController::AttachToNewContext Shadow bytes around the buggy address: 0x11e5e36f8280: fa fa fa fa f7 fa fd fd fd fd fd fd fd fd fd fd 0x11e5e36f8300: fd fd fd fd fa fa fa fa fa fa f7 fa fd fd fd fd 0x11e5e36f8380: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x11e5e36f8400: f7 fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x11e5e36f8480: fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 00 00 =>0x11e5e36f8500: 00 00 00 00 00 fa fa fa fa[fa]fa fa f7 fa fd fd 0x11e5e36f8580: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa 0x11e5e36f8600: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd 0x11e5e36f8680: fd fa fa fa fa fa fa fa f7 fa fd fd fd fd fd fd 0x11e5e36f8700: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa 0x11e5e36f8780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==14276==ADDITIONAL INFO ==14276==Note: Please include this section with the ASan report. Task trace: Command line: `"out\asan\chrome.exe" --flag-switches-begin --enable-experimental-web-platform-features --javascript-harmony --enable-features=FedCmMetricsEndpoint,FedCmWithoutWellKnownEnforcement,NtpSharepointModule:NtpSharepointModuleDataParam/fake-trending,Prerender2 --disable-features=PdfOopif --flag-switches-end --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors` ==14276==END OF ADDITIONAL INFO ==14276==ABORTING