==3754133==ERROR: AddressSanitizer: heap-use-after-free on address 0x7bcb975c4ea0 at pc 0x7f4c078f2586 bp 0x7b4998d5aa10 sp 0x7b4998d5aa08
WRITE of size 4 at 0x7bcb975c4ea0 thread T13 (DedicatedWorker)
    #0 0x7f4c078f2585 in font_service::internal::MappedFontFile::ReleaseProc(void const*, void*) gen/third_party/libc++/src/include/__atomic/support/c11.h:207:10
    #1 0x7f4c11f09f9b in SkTypeface_Fontations::~SkTypeface_Fontations() third_party/skia/include/core/SkRefCnt.h:181:13
    #2 0x7f4c11f09ffd in SkTypeface_Fontations::~SkTypeface_Fontations() third_party/skia/src/ports/SkTypeface_fontations_priv.h:188:7
    #3 0x7f4bb5bf0f0a in cppgc::internal::HeapVisitor<cppgc::internal::(anonymous namespace)::MutatorThreadSweeper>::Traverse(cppgc::internal::BasePage&) v8/src/heap/cppgc/sweeper.cc:277:13
    #4 0x7f4bb5befd11 in cppgc::internal::(anonymous namespace)::MutatorThreadSweeper::Sweep(cppgc::internal::(anonymous namespace)::SweepingState&) v8/src/heap/cppgc/sweeper.cc:653:36
    #5 0x7f4bb5bef6f3 in cppgc::internal::Sweeper::SweeperImpl::Finish() v8/src/heap/cppgc/sweeper.cc:1311:13
    #6 0x7f4bb5be352f in cppgc::internal::Sweeper::SweeperImpl::FinishIfRunning() v8/src/heap/cppgc/sweeper.cc:1236:7
    #7 0x7f4bb5ba475e in cppgc::internal::HeapBase::Terminate() v8/src/heap/cppgc/heap-base.cc:275:15
    #8 0x7f4bb3b13d42 in v8::internal::CppHeap::~CppHeap() v8/src/heap/cppgc-js/cpp-heap.cc:551:13
    #9 0x7f4bb3b13f37 in non-virtual thunk to v8::internal::CppHeap::~CppHeap() v8/src/heap/cppgc-js/cpp-heap.cc:539:21
    #10 0x7f4bb3c6eab5 in v8::internal::Heap::TearDown() v8/src/heap/heap.cc:6512:15
    #11 0x7f4bb397c8c5 in v8::internal::Isolate::Deinit() v8/src/execution/isolate.cc:4863:9
    #12 0x7f4bb397b8cf in v8::internal::Isolate::Deinitialize(v8::internal::Isolate*) v8/src/execution/isolate.cc:4427:12
    #13 0x7f4bb397b74d in v8::internal::Isolate::Delete(v8::internal::Isolate*) v8/src/execution/isolate.cc:4408:3
    #14 0x7f4bd2dcd912 in gin::IsolateHolder::~IsolateHolder() gin/isolate_holder.cc:152:13
    #15 0x7f4bba70f042 in blink::V8PerIsolateData::~V8PerIsolateData() third_party/blink/renderer/platform/bindings/v8_per_isolate_data.cc:133:37
    #16 0x7f4bba7101cf in blink::V8PerIsolateData::Destroy(v8::Isolate*) third_party/blink/renderer/platform/bindings/v8_per_isolate_data.cc:199:3
    #17 0x7f4bc5e62eed in blink::WorkerBackingThread::ShutdownOnBackingThread() third_party/blink/renderer/core/workers/worker_backing_thread.cc:168:3
    #18 0x7f4bc5e8f163 in blink::WorkerThread::PerformShutdownOnWorkerThread() third_party/blink/renderer/core/workers/worker_thread.cc:854:30
    #19 0x7f4bc5e9452c in base::internal::Invoker<base::internal::FunctorTraits<void (blink::WorkerThread::*&&)(), blink::WorkerThread*>, base::internal::BindState<true, true, false, void (blink::WorkerThread::*)(), blink::CrossThreadUnretainedWrapper<blink::WorkerThread>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #20 0x7f4c15d614f2 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #21 0x7f4c15de29de in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #22 0x7f4c15de19b6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40
    #23 0x7f4c15c03591 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #24 0x7f4c15de4058 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:650:12
    #25 0x7f4c15ccbb52 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #26 0x7f4bbb47000c in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:178:14
    #27 0x7f4c15ede6fc in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #28 0x557c12ce4936 in asan_thread_start(void*) asan_interceptors.cpp

0x7bcb975c4ea0 is located 0 bytes inside of 88-byte region [0x7bcb975c4ea0,0x7bcb975c4ef8)
freed by thread T19 (DedicatedWorker) here:
    #0 0x557c12d213f2 in operator delete(void*, unsigned long) (/home/user/chromium/src/out/asan-release/chrome+0x68433f2) (BuildId: 6dfd570f3bcfe0bb)
    #1 0x7f4c078f2510 in font_service::internal::MappedFontFile::ReleaseProc(void const*, void*) base/memory/ref_counted.h:438:5
    #2 0x7f4c11f09f9b in SkTypeface_Fontations::~SkTypeface_Fontations() third_party/skia/include/core/SkRefCnt.h:181:13
    #3 0x7f4c11f09ffd in SkTypeface_Fontations::~SkTypeface_Fontations() third_party/skia/src/ports/SkTypeface_fontations_priv.h:188:7
    #4 0x7f4bb5bf0f0a in cppgc::internal::HeapVisitor<cppgc::internal::(anonymous namespace)::MutatorThreadSweeper>::Traverse(cppgc::internal::BasePage&) v8/src/heap/cppgc/sweeper.cc:277:13
    #5 0x7f4bb5befd11 in cppgc::internal::(anonymous namespace)::MutatorThreadSweeper::Sweep(cppgc::internal::(anonymous namespace)::SweepingState&) v8/src/heap/cppgc/sweeper.cc:653:36
    #6 0x7f4bb5bef6f3 in cppgc::internal::Sweeper::SweeperImpl::Finish() v8/src/heap/cppgc/sweeper.cc:1311:13
    #7 0x7f4bb5be352f in cppgc::internal::Sweeper::SweeperImpl::FinishIfRunning() v8/src/heap/cppgc/sweeper.cc:1236:7
    #8 0x7f4bb5ba475e in cppgc::internal::HeapBase::Terminate() v8/src/heap/cppgc/heap-base.cc:275:15
    #9 0x7f4bb3b13d42 in v8::internal::CppHeap::~CppHeap() v8/src/heap/cppgc-js/cpp-heap.cc:551:13
    #10 0x7f4bb3b13f37 in non-virtual thunk to v8::internal::CppHeap::~CppHeap() v8/src/heap/cppgc-js/cpp-heap.cc:539:21
    #11 0x7f4bb3c6eab5 in v8::internal::Heap::TearDown() v8/src/heap/heap.cc:6512:15
    #12 0x7f4bb397c8c5 in v8::internal::Isolate::Deinit() v8/src/execution/isolate.cc:4863:9
    #13 0x7f4bb397b8cf in v8::internal::Isolate::Deinitialize(v8::internal::Isolate*) v8/src/execution/isolate.cc:4427:12
    #14 0x7f4bb397b74d in v8::internal::Isolate::Delete(v8::internal::Isolate*) v8/src/execution/isolate.cc:4408:3
    #15 0x7f4bd2dcd912 in gin::IsolateHolder::~IsolateHolder() gin/isolate_holder.cc:152:13
    #16 0x7f4bba70f042 in blink::V8PerIsolateData::~V8PerIsolateData() third_party/blink/renderer/platform/bindings/v8_per_isolate_data.cc:133:37
    #17 0x7f4bba7101cf in blink::V8PerIsolateData::Destroy(v8::Isolate*) third_party/blink/renderer/platform/bindings/v8_per_isolate_data.cc:199:3
    #18 0x7f4bc5e62eed in blink::WorkerBackingThread::ShutdownOnBackingThread() third_party/blink/renderer/core/workers/worker_backing_thread.cc:168:3
    #19 0x7f4bc5e8f163 in blink::WorkerThread::PerformShutdownOnWorkerThread() third_party/blink/renderer/core/workers/worker_thread.cc:854:30
    #20 0x7f4bc5e9452c in base::internal::Invoker<base::internal::FunctorTraits<void (blink::WorkerThread::*&&)(), blink::WorkerThread*>, base::internal::BindState<true, true, false, void (blink::WorkerThread::*)(), blink::CrossThreadUnretainedWrapper<blink::WorkerThread>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #21 0x7f4c15d614f2 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #22 0x7f4c15de29de in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #23 0x7f4c15de19b6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40
    #24 0x7f4c15c03591 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #25 0x7f4c15de4058 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:650:12
    #26 0x7f4c15ccbb52 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #27 0x7f4bbb47000c in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:178:14
    #28 0x7f4c15ede6fc in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #29 0x557c12ce4936 in asan_thread_start(void*) asan_interceptors.cpp

previously allocated by thread T19 (DedicatedWorker) here:
    #0 0x557c12d207ed in operator new(unsigned long) (/home/user/chromium/src/out/asan-release/chrome+0x68427ed) (BuildId: 6dfd570f3bcfe0bb)
    #1 0x7f4c078e5cf6 in font_service::internal::FontServiceThread::OpenStream(SkFontConfigInterface::FontIdentity const&) components/services/font/public/cpp/font_service_thread.cc:178:7
    #2 0x7f4c078daab8 in font_service::FontLoader::openStream(SkFontConfigInterface::FontIdentity const&) components/services/font/public/cpp/font_loader.cc:78:16
    #3 0x7f4c078db6ac in font_service::FontLoader::makeTypeface(SkFontConfigInterface::FontIdentity const&, sk_sp<SkFontMgr>) components/services/font/public/cpp/font_loader.cc:112:44
    #4 0x7f4bba8fb055 in blink::SkTypeface_Factory::FromFontConfigInterfaceIdAndTtcIndex(int, int) third_party/blink/renderer/platform/fonts/skia/sktypeface_factory.cc:30:15
    #5 0x7f4bbb0d67b8 in blink::FontUniqueNameLookupLinux::MatchUniqueName(blink::String const&) third_party/blink/renderer/platform/fonts/linux/font_unique_name_lookup_linux.cc:34:10
    #6 0x7f4bba8f8448 in blink::FontCache::CreateFontPlatformData(blink::FontDescription const&, blink::FontFaceCreationParams const&, float, blink::AlternateFontName) third_party/blink/renderer/platform/fonts/skia/font_cache_skia.cc:323:16
    #7 0x7f4bba7efc92 in blink::FontPlatformDataCache::GetOrCreateFontPlatformData(blink::FontCache*, blink::FontDescription const&, blink::FontFaceCreationParams const&, blink::AlternateFontName) third_party/blink/renderer/platform/fonts/font_platform_data_cache.cc:68:52
    #8 0x7f4bba79bfc9 in blink::FontCache::GetFontPlatformData(blink::FontDescription const&, blink::FontFaceCreationParams const&, blink::AlternateFontName) third_party/blink/renderer/platform/fonts/font_cache.cc:144:36
    #9 0x7f4bba79cd2d in blink::FontCache::IsPlatformFontUniqueNameMatchAvailable(blink::FontDescription const&, blink::AtomicString const&) third_party/blink/renderer/platform/fonts/font_cache.cc:191:10
    #10 0x7f4bc28730fb in blink::LocalFontFaceSource::IsValid() const third_party/blink/renderer/core/css/local_font_face_source.cc:46:42
    #11 0x7f4bc24c38bb in blink::CSSFontFace::Load(blink::FontDescription const&) third_party/blink/renderer/core/css/css_font_face.cc:257:17
    #12 0x7f4bc24c0fec in blink::CSSFontFace::Load() third_party/blink/renderer/core/css/css_font_face.cc:246:3
    #13 0x7f4bc27b1cbf in blink::FontFace::load(blink::ScriptState*) third_party/blink/renderer/core/css/font_face.cc:622:21
    #14 0x7f4bc6d507cf in blink::(anonymous namespace)::v8_font_face::LoadOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_font_face.cc:716:39
    #15 0x7b4b68b106a3  (<unknown module>)
    #16 0x7b4b68b0e83b  (<unknown module>)
    #17 0x7b4b68b535ad  (<unknown module>)
    #18 0x7b4b68c41669  (<unknown module>)
    #19 0x7b4b68b41392  (<unknown module>)
    #20 0x7b4b68b0b52a  (<unknown module>)
    #21 0x7f4bb3928854 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12
    #22 0x7f4bb392a959 in v8::internal::(anonymous namespace)::InvokeWithTryCatch(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:502:18
    #23 0x7f4bb392ad5f in v8::internal::Execution::TryRunMicrotasks(v8::internal::Isolate*, v8::internal::MicrotaskQueue*) v8/src/execution/execution.cc:606:10
    #24 0x7f4bb39d36cc in v8::internal::MicrotaskQueue::RunMicrotasks(v8::internal::Isolate*) v8/src/execution/microtask-queue.cc:185:22
    #25 0x7f4bb39d3124 in v8::internal::MicrotaskQueue::PerformCheckpointInternal(v8::Isolate*) v8/src/execution/microtask-queue.cc:129:3
    #26 0x7f4bc2300803 in blink::V8ScriptRunner::CallFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:863:1
    #27 0x7f4bc21526cb in blink::bindings::CallbackInvokeHelper<blink::CallbackFunctionBase, (blink::bindings::CallbackInvokeHelperMode)2, (blink::bindings::CallbackReturnTypeIsPromise)0>::Call(int, v8::Local<v8::Value>*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:126:12
    #28 0x7f4bc6976822 in blink::V8EventHandlerNonNull::InvokeWithoutRunnabilityCheck(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_event_handler_non_null.cc:193:13
    #29 0x7f4bc217288c in blink::JSEventHandler::InvokeInternal(blink::EventTarget&, blink::Event&, v8::Local<v8::Value>) third_party/blink/renderer/bindings/core/v8/js_event_handler.cc:135:14

Thread T13 (DedicatedWorker) created by T0 (chrome) here:
    #0 0x557c12cca6f1 in pthread_create (/home/user/chromium/src/out/asan-release/chrome+0x67ec6f1) (BuildId: 6dfd570f3bcfe0bb)
    #1 0x7f4c15edddbc in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x7f4c15e709e6 in base::SimpleThread::StartAsync() base/threading/simple_thread.cc:55:13
    #3 0x7f4bbb46dbd4 in blink::NonMainThread::CreateThread(blink::ThreadCreationParams const&) third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:40:11
    #4 0x7f4bc5e62392 in blink::WorkerBackingThread::WorkerBackingThread(blink::ThreadCreationParams const&) third_party/blink/renderer/core/workers/worker_backing_thread.cc:121:23
    #5 0x7f4bc5e3b2d4 in blink::DedicatedWorkerThread::DedicatedWorkerThread(blink::ExecutionContext*, blink::DedicatedWorkerObjectProxy&, mojo::PendingRemote<blink::mojom::blink::DedicatedWorkerHost>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #6 0x7f4bc5e30b7a in blink::DedicatedWorkerMessagingProxy::CreateWorkerThread() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #7 0x7f4bc5e53a55 in blink::ThreadedMessagingProxyBase::InitializeWorkerThread(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::optional<blink::WorkerBackingThreadStartupData> const&, std::__Cr::optional<base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const> const&, std::__Cr::unique_ptr<blink::WorkerDevToolsParams, std::__Cr::default_delete<blink::WorkerDevToolsParams>>) third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc:91:20
    #8 0x7f4bc5e2b566 in blink::DedicatedWorkerMessagingProxy::StartWorkerGlobalScope(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, blink::WorkerOptions const*, blink::KURL const&, blink::FetchClientSettingsObjectSnapshot const&, v8_inspector::V8StackTraceId const&, base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const&, mojo::PendingRemote<blink::mojom::blink::DedicatedWorkerHost>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>) third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc:100:22
    #9 0x7f4bc5e152e0 in blink::DedicatedWorker::ContinueStartInternal(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>) third_party/blink/renderer/core/workers/dedicated_worker.cc:502:19
    #10 0x7f4bc5e1926d in void base::internal::DecayedFunctorTraits<void (blink::DedicatedWorker::*)(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>), cppgc::internal::BasicPersistent<blink::DedicatedWorker, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, blink::KURL&&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>&&, network::mojom::ReferrerPolicy&&, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>&&, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&>::Invoke<void (blink::DedicatedWorker::*)(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>), cppgc::internal::BasicPersistent<blink::DedicatedWorker, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> const&, blink::KURL, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>>(void (blink::DedicatedWorker::*)(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>), cppgc::internal::BasicPersistent<blink::DedicatedWorker, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> const&, blink::KURL&&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>&&, network::mojom::ReferrerPolicy&&, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>&&, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&) base/functional/bind_internal.h:740:12
    #11 0x7f4bc5e18f9b in base::internal::Invoker<base::internal::FunctorTraits<void (blink::DedicatedWorker::*&&)(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>), cppgc::internal::BasicPersistent<blink::DedicatedWorker, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, blink::KURL&&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>&&, network::mojom::ReferrerPolicy&&, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>&&, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&>, base::internal::BindState<true, true, false, void (blink::DedicatedWorker::*)(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>), cppgc::internal::BasicPersistent<blink::DedicatedWorker, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, blink::KURL, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:956:5
    #12 0x7f4c15d614f2 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #13 0x7f4c15de29de in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #14 0x7f4c15de19b6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40
    #15 0x7f4c15c03591 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #16 0x7f4c15de4058 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:650:12
    #17 0x7f4c15ccbb52 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #18 0x7f4c0b81a20e in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:364:16
    #19 0x7f4c0bc4c897 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #20 0x7f4c0bc4d9ff in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #21 0x7f4c0bc4ffea in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #22 0x7f4c0bc4a743 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #23 0x7f4c0bc4aaca in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #24 0x557c12d22235 in ChromeMain chrome/app/chrome_main.cc:191:12
    #25 0x7f4ba5629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Thread T19 (DedicatedWorker) created by T0 (chrome) here:
    #0 0x557c12cca6f1 in pthread_create (/home/user/chromium/src/out/asan-release/chrome+0x67ec6f1) (BuildId: 6dfd570f3bcfe0bb)
    #1 0x7f4c15edddbc in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x7f4c15e709e6 in base::SimpleThread::StartAsync() base/threading/simple_thread.cc:55:13
    #3 0x7f4bbb46dbd4 in blink::NonMainThread::CreateThread(blink::ThreadCreationParams const&) third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:40:11
    #4 0x7f4bc5e62392 in blink::WorkerBackingThread::WorkerBackingThread(blink::ThreadCreationParams const&) third_party/blink/renderer/core/workers/worker_backing_thread.cc:121:23
    #5 0x7f4bc5e3b2d4 in blink::DedicatedWorkerThread::DedicatedWorkerThread(blink::ExecutionContext*, blink::DedicatedWorkerObjectProxy&, mojo::PendingRemote<blink::mojom::blink::DedicatedWorkerHost>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #6 0x7f4bc5e30b7a in blink::DedicatedWorkerMessagingProxy::CreateWorkerThread() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #7 0x7f4bc5e53a55 in blink::ThreadedMessagingProxyBase::InitializeWorkerThread(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::optional<blink::WorkerBackingThreadStartupData> const&, std::__Cr::optional<base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const> const&, std::__Cr::unique_ptr<blink::WorkerDevToolsParams, std::__Cr::default_delete<blink::WorkerDevToolsParams>>) third_party/blink/renderer/core/workers/threaded_messaging_proxy_base.cc:91:20
    #8 0x7f4bc5e2b566 in blink::DedicatedWorkerMessagingProxy::StartWorkerGlobalScope(std::__Cr::unique_ptr<blink::GlobalScopeCreationParams, std::__Cr::default_delete<blink::GlobalScopeCreationParams>>, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, blink::WorkerOptions const*, blink::KURL const&, blink::FetchClientSettingsObjectSnapshot const&, v8_inspector::V8StackTraceId const&, base::TokenType<blink::DedicatedWorkerTokenTypeMarker> const&, mojo::PendingRemote<blink::mojom::blink::DedicatedWorkerHost>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>) third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc:100:22
    #9 0x7f4bc5e152e0 in blink::DedicatedWorker::ContinueStartInternal(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>) third_party/blink/renderer/core/workers/dedicated_worker.cc:502:19
    #10 0x7f4bc5e1926d in void base::internal::DecayedFunctorTraits<void (blink::DedicatedWorker::*)(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>), cppgc::internal::BasicPersistent<blink::DedicatedWorker, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, blink::KURL&&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>&&, network::mojom::ReferrerPolicy&&, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>&&, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&>::Invoke<void (blink::DedicatedWorker::*)(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>), cppgc::internal::BasicPersistent<blink::DedicatedWorker, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> const&, blink::KURL, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>>(void (blink::DedicatedWorker::*)(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>), cppgc::internal::BasicPersistent<blink::DedicatedWorker, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy> const&, blink::KURL&&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>&&, network::mojom::ReferrerPolicy&&, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>&&, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&) base/functional/bind_internal.h:740:12
    #11 0x7f4bc5e18f9b in base::internal::Invoker<base::internal::FunctorTraits<void (blink::DedicatedWorker::*&&)(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>), cppgc::internal::BasicPersistent<blink::DedicatedWorker, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>&&, blink::KURL&&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>&&, network::mojom::ReferrerPolicy&&, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>&&, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>&&>, base::internal::BindState<true, true, false, void (blink::DedicatedWorker::*)(blink::KURL const&, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>), cppgc::internal::BasicPersistent<blink::DedicatedWorker, cppgc::internal::WeakPersistentPolicy, cppgc::internal::IgnoreLocationPolicy, cppgc::internal::DisabledCheckingPolicy>, blink::KURL, std::__Cr::unique_ptr<blink::WorkerMainScriptLoadParameters, std::__Cr::default_delete<blink::WorkerMainScriptLoadParameters>>, network::mojom::ReferrerPolicy, blink::Vector<mojo::StructPtr<network::mojom::blink::ContentSecurityPolicy>, 0u, blink::PartitionAllocator>, mojo::PendingRemote<blink::mojom::blink::BackForwardCacheControllerHost>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>, mojo::PendingReceiver<blink::mojom::blink::ReportingObserver>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:956:5
    #12 0x7f4c15d614f2 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #13 0x7f4c15de29de in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #14 0x7f4c15de19b6 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40
    #15 0x7f4c15c03591 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #16 0x7f4c15de4058 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:650:12
    #17 0x7f4c15ccbb52 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #18 0x7f4c0b81a20e in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:364:16
    #19 0x7f4c0bc4c897 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #20 0x7f4c0bc4d9ff in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #21 0x7f4c0bc4ffea in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #22 0x7f4c0bc4a743 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #23 0x7f4c0bc4aaca in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #24 0x557c12d22235 in ChromeMain chrome/app/chrome_main.cc:191:12
    #25 0x7f4ba5629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__atomic/support/c11.h:207:10 in font_service::internal::MappedFontFile::ReleaseProc(void const*, void*)
Shadow bytes around the buggy address:
  0x7bcb975c4c00: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7bcb975c4c80: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7bcb975c4d00: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7bcb975c4d80: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7bcb975c4e00: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fa
=>0x7bcb975c4e80: fa fa f7 fa[fd]fd fd fd fd fd fd fd fd fd fd fa
  0x7bcb975c4f00: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7bcb975c4f80: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x7bcb975c5000: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x7bcb975c5080: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x7bcb975c5100: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==3754133==ADDITIONAL INFO

==3754133==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7f4bc5e8dbf8 in blink::WorkerThread::Terminate() third_party/blink/renderer/core/workers/worker_thread.cc:300:23
    #1 0x7f4bc5e35232 in blink::DedicatedWorkerObjectProxy::PostMessageToWorkerObject(blink::BlinkTransferableMessage) third_party/blink/renderer/core/workers/dedicated_worker_object_proxy.cc:67:7
    #2 0x7f4bc5e2bc90 in blink::DedicatedWorkerMessagingProxy::PostMessageToWorkerGlobalScope(blink::BlinkTransferableMessage) third_party/blink/renderer/core/workers/dedicated_worker_messaging_proxy.cc:161:68
    #3 0x7f4bc5e35232 in blink::DedicatedWorkerObjectProxy::PostMessageToWorkerObject(blink::BlinkTransferableMessage) third_party/blink/renderer/core/workers/dedicated_worker_object_proxy.cc:67:7


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=3754051 --enable-crash-reporter=, --user-data-dir=/tmp/poc-nopatch-1773408881 --change-stack-guard-on-fork=enable --no-sandbox --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1757352673550691 --launch-time-ticks=16056211555295 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,6449103662424987940,3704152860888866935,2097152 --field-trial-handle=3,i,12132577005914905132,5105223059466192522,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,10776148854901828819,15207750464991718272,4 --trace-process-track-uuid=3190708990997080739`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.