================================================================= ==56817==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040012b8fe8 at pc 0x0001221fdc54 bp 0x00016f281470 sp 0x00016f281468 READ of size 8 at 0x6040012b8fe8 thread T0 ==56817==WARNING: invalid path to external symbolizer! ==56817==WARNING: Failed to use and restart external symbolizer! #0 0x0001221fdc50 in autofill::FormFiller::UndoAutofill(autofill::mojom::ActionPersistence, autofill::FormData, autofill::FormStructure&, autofill::FormFieldData const&, autofill::FillingProduct)+0x1844 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x7f59c50) #1 0x000122236a30 in autofill::BrowserAutofillManager::UndoAutofill(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::FormFieldData const&)+0x1dc (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x7f92a30) #2 0x0001224a68f4 in autofill::AutofillExternalDelegate::DidAcceptSuggestion(autofill::Suggestion const&, autofill::AutofillSuggestionDelegate::SuggestionMetadata const&)+0xaa8 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x82028f4) #3 0x00011da3b008 in autofill::AutofillPopupControllerImpl::AcceptSuggestion(int, autofill::AutofillMetrics::SuggestionAcceptedMethod)+0x520 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x3797008) #4 0x0001251fc514 in autofill::PopupRowView::OnMouseReleased(ui::MouseEvent const&)+0x224 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0xaf58514) #5 0x000106000d74 in ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*)+0x22c (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x18d74) #6 0x000105fff9dc in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*)+0x57c (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x179dc) #7 0x000105fff0b8 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*)+0x1b0 (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x170b8) #8 0x000105ffec10 in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)+0x1dc (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x16c10) #9 0x00013c7f69b0 in views::internal::RootView::OnMouseReleased(ui::MouseEvent const&)+0x218 (/Users/test/chromium/src/out/asan-release/libui_views.dylib:arm64+0x4569b0) #10 0x00013c826428 in views::Widget::OnMouseEvent(ui::MouseEvent*)+0x39c (/Users/test/chromium/src/out/asan-release/libui_views.dylib:arm64+0x486428) #11 0x0001251f1378 in autofill::PopupBaseView::Widget::OnMouseEvent(ui::MouseEvent*)+0x3f4 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0xaf4d378) #12 0x00013c887d78 in views::NativeWidgetMacNSWindowHost::OnMouseEvent(std::__Cr::unique_ptr>)+0xf0 (/Users/test/chromium/src/out/asan-release/libui_views.dylib:arm64+0x4e7d78) #13 0x00013da6fa80 in -[BridgedContentView mouseEvent:]+0x1dc (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0xfa80) #14 0x00013da6d724 in -[BridgedContentView processCapturedMouseEvent:]+0x29c (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0xd724) #15 0x00013dab6b00 in non-virtual thunk to remote_cocoa::NativeWidgetNSWindowBridge::PostCapturedEvent(NSEvent*)+0x34 (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x56b00) #16 0x00013da8c468 in invocation function for block in remote_cocoa::CocoaMouseCapture::ActiveEventTap::Init()+0x160 (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x2c468) #17 0x00019ea33094 in _NSSendEventToObservers+0xf8 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x160094) #18 0x00019f2ab150 in -[NSApplication(NSEventRouting) sendEvent:]+0x70 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x9d8150) #19 0x00011fc333d4 in __34-[BrowserCrApplication sendEvent:]_block_invoke+0x270 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x598f3d4) #20 0x0001032c8df8 in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x3f0df8) #21 0x00011fc32bf8 in -[BrowserCrApplication sendEvent:]+0x868 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x598ebf8) #22 0x00019eeaa428 in -[NSApplication _handleEvent:]+0x38 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x5d7428) #23 0x00019e900c08 in -[NSApplication run]+0x204 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x2dc08) #24 0x0001032e0468 in base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)+0x328 (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x408468) #25 0x0001032db334 in base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)+0x290 (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x403334) #26 0x000103154240 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x32c (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x27c240) #27 0x000103040b08 in base::RunLoop::Run(base::Location const&)+0x430 (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x168b08) #28 0x0001336e99c8 in content::BrowserMainLoop::RunMainMessageLoop()+0x268 (/Users/test/chromium/src/out/asan-release/libcontent.dylib:arm64+0xf759c8) #29 0x0001336f08d4 in content::BrowserMainRunnerImpl::Run()+0x30 (/Users/test/chromium/src/out/asan-release/libcontent.dylib:arm64+0xf7c8d4) #30 0x0001336e2148 in content::BrowserMain(content::MainFunctionParams)+0x1c0 (/Users/test/chromium/src/out/asan-release/libcontent.dylib:arm64+0xf6e148) #31 0x000136506ed4 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*)+0x1b0 (/Users/test/chromium/src/out/asan-release/libcontent.dylib:arm64+0x3d92ed4) #32 0x00013650a3f8 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool)+0xb8c (/Users/test/chromium/src/out/asan-release/libcontent.dylib:arm64+0x3d963f8) #33 0x0001365095d0 in content::ContentMainRunnerImpl::Run()+0x568 (/Users/test/chromium/src/out/asan-release/libcontent.dylib:arm64+0x3d955d0) #34 0x000136504eb4 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*)+0x858 (/Users/test/chromium/src/out/asan-release/libcontent.dylib:arm64+0x3d90eb4) #35 0x0001365053a4 in content::ContentMain(content::ContentMainParams)+0x190 (/Users/test/chromium/src/out/asan-release/libcontent.dylib:arm64+0x3d913a4) #36 0x00011a2af724 in ChromeMain+0x490 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0xb724) #37 0x000100b7ca80 in main+0x1f8 (/Users/test/chromium/src/out/asan-release/Chromium.app/Contents/MacOS/Chromium:arm64+0x100000a80) #38 0x00019a55eb94 in start+0x17b8 (/usr/lib/dyld:arm64e+0x6b94) 0x6040012b8fe8 is located 24 bytes inside of 40-byte region [0x6040012b8fd0,0x6040012b8ff8) freed by thread T0 here: #0 0x0001014155a8 in __sanitizer_finish_switch_fiber+0xa04 (/Users/test/chromium/src/out/asan-release/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x655a8) #1 0x0001221df288 in std::__Cr::list, autofill::FormAutofillHistory::FieldFillingEntry, std::__Cr::less>, std::__Cr::allocator const, autofill::FormAutofillHistory::FieldFillingEntry>>>, std::__Cr::allocator, autofill::FormAutofillHistory::FieldFillingEntry, std::__Cr::less>, std::__Cr::allocator const, autofill::FormAutofillHistory::FieldFillingEntry>>>>>::erase(std::__Cr::__list_const_iterator, autofill::FormAutofillHistory::FieldFillingEntry, std::__Cr::less>, std::__Cr::allocator const, autofill::FormAutofillHistory::FieldFillingEntry>>>, void*>)+0xc4 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x7f3b288) #2 0x0001221fd29c in autofill::FormFiller::UndoAutofill(autofill::mojom::ActionPersistence, autofill::FormData, autofill::FormStructure&, autofill::FormFieldData const&, autofill::FillingProduct)+0xe90 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x7f5929c) #3 0x000122236a30 in autofill::BrowserAutofillManager::UndoAutofill(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::FormFieldData const&)+0x1dc (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x7f92a30) #4 0x0001224a68f4 in autofill::AutofillExternalDelegate::DidAcceptSuggestion(autofill::Suggestion const&, autofill::AutofillSuggestionDelegate::SuggestionMetadata const&)+0xaa8 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x82028f4) #5 0x00011da3b008 in autofill::AutofillPopupControllerImpl::AcceptSuggestion(int, autofill::AutofillMetrics::SuggestionAcceptedMethod)+0x520 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x3797008) #6 0x0001251fc514 in autofill::PopupRowView::OnMouseReleased(ui::MouseEvent const&)+0x224 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0xaf58514) #7 0x000106000d74 in ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*)+0x22c (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x18d74) #8 0x000105fff9dc in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*)+0x57c (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x179dc) #9 0x000105fff0b8 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*)+0x1b0 (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x170b8) #10 0x000105ffec10 in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)+0x1dc (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x16c10) #11 0x00013c7f69b0 in views::internal::RootView::OnMouseReleased(ui::MouseEvent const&)+0x218 (/Users/test/chromium/src/out/asan-release/libui_views.dylib:arm64+0x4569b0) #12 0x00013c826428 in views::Widget::OnMouseEvent(ui::MouseEvent*)+0x39c (/Users/test/chromium/src/out/asan-release/libui_views.dylib:arm64+0x486428) #13 0x0001251f1378 in autofill::PopupBaseView::Widget::OnMouseEvent(ui::MouseEvent*)+0x3f4 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0xaf4d378) #14 0x00013c887d78 in views::NativeWidgetMacNSWindowHost::OnMouseEvent(std::__Cr::unique_ptr>)+0xf0 (/Users/test/chromium/src/out/asan-release/libui_views.dylib:arm64+0x4e7d78) #15 0x00013da6fa80 in -[BridgedContentView mouseEvent:]+0x1dc (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0xfa80) #16 0x00013da6d724 in -[BridgedContentView processCapturedMouseEvent:]+0x29c (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0xd724) #17 0x00013dab6b00 in non-virtual thunk to remote_cocoa::NativeWidgetNSWindowBridge::PostCapturedEvent(NSEvent*)+0x34 (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x56b00) #18 0x00013da8c468 in invocation function for block in remote_cocoa::CocoaMouseCapture::ActiveEventTap::Init()+0x160 (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x2c468) #19 0x00019ea33094 in _NSSendEventToObservers+0xf8 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x160094) #20 0x00019f2ab150 in -[NSApplication(NSEventRouting) sendEvent:]+0x70 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x9d8150) #21 0x00011fc333d4 in __34-[BrowserCrApplication sendEvent:]_block_invoke+0x270 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x598f3d4) #22 0x0001032c8df8 in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x3f0df8) #23 0x00011fc32bf8 in -[BrowserCrApplication sendEvent:]+0x868 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x598ebf8) #24 0x00019eeaa428 in -[NSApplication _handleEvent:]+0x38 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x5d7428) #25 0x00019e900c08 in -[NSApplication run]+0x204 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x2dc08) #26 0x0001032e0468 in base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)+0x328 (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x408468) #27 0x0001032db334 in base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)+0x290 (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x403334) #28 0x000103154240 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)+0x32c (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x27c240) #29 0x000103040b08 in base::RunLoop::Run(base::Location const&)+0x430 (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x168b08) previously allocated by thread T0 here: #0 0x0001014151c0 in __sanitizer_finish_switch_fiber+0x61c (/Users/test/chromium/src/out/asan-release/Chromium.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x651c0) #1 0x0001221de10c in autofill::FormAutofillHistory::AddFormFillingEntry(base::span, base::span, autofill::FillingProduct, bool)+0x19c (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x7f3a10c) #2 0x0001222014c4 in autofill::FormFiller::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::FormStructure&, autofill::AutofillField&, autofill::AutofillTriggerSource, std::__Cr::optional)+0x2dd4 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x7f5d4c4) #3 0x000122254e94 in decltype(auto) std::__Cr::__variant_detail::__visitation::__base::__dispatcher<0ul>::__dispatch const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)::$_0, autofill::BrowserAutofillManager::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)::$_1, autofill::BrowserAutofillManager::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)::$_2, autofill::BrowserAutofillManager::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)::$_3, autofill::BrowserAutofillManager::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)::$_4>>&&, std::__Cr::__variant_detail::__base<(std::__Cr::__variant_detail::_Trait)0, autofill::AutofillProfile const*, autofill::CreditCard const*, autofill::EntityInstance const*, std::__Cr::map, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&>(std::__Cr::__variant_detail::__visitation::__variant::__value_visitor const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)::$_0, autofill::BrowserAutofillManager::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)::$_1, autofill::BrowserAutofillManager::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)::$_2, autofill::BrowserAutofillManager::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)::$_3, autofill::BrowserAutofillManager::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)::$_4>>&&, std::__Cr::__variant_detail::__base<(std::__Cr::__variant_detail::_Trait)0, autofill::AutofillProfile const*, autofill::CreditCard const*, autofill::EntityInstance const*, std::__Cr::map, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&)+0x248 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x7fb0e94) #4 0x000122235d34 in autofill::BrowserAutofillManager::FillOrPreviewForm(autofill::mojom::ActionPersistence, autofill::FormData const&, autofill::internal::GlobalId const&, std::__Cr::variant, std::__Cr::allocator>, std::__Cr::less, std::__Cr::allocator, std::__Cr::allocator>>>> const*, std::__Cr::map, std::__Cr::basic_string, std::__Cr::allocator>, std::__Cr::less>, std::__Cr::allocator const, std::__Cr::basic_string, std::__Cr::allocator>>>> const*> const&, autofill::AutofillTriggerSource)+0x3e4 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x7f91d34) #5 0x0001224a5214 in autofill::AutofillExternalDelegate::AutofillForm(autofill::SuggestionType, std::__Cr::variant, std::__Cr::allocator>>, base::StrongAlias, autofill::Suggestion::AutofillProfilePayload, GURL, autofill::Suggestion::PasswordSuggestionDetails, autofill::Suggestion::PlusAddressPayload, autofill::Suggestion::AutofillAiPayload, autofill::Suggestion::PaymentsPayload, autofill::Suggestion::IdentityCredentialPayload, autofill::AutocompleteEntry, base::StrongAlias, autofill::Suggestion::AtMemoryPayload> const&, std::__Cr::optional, bool, autofill::AutofillTriggerSource)+0x80c (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x8201214) #6 0x0001224a9cd4 in autofill::AutofillExternalDelegate::DidAcceptAddressSuggestion(autofill::Suggestion const&, autofill::AutofillSuggestionDelegate::SuggestionMetadata const&)+0xf2c (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x8205cd4) #7 0x0001224a6838 in autofill::AutofillExternalDelegate::DidAcceptSuggestion(autofill::Suggestion const&, autofill::AutofillSuggestionDelegate::SuggestionMetadata const&)+0x9ec (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x8202838) #8 0x00011da3b008 in autofill::AutofillPopupControllerImpl::AcceptSuggestion(int, autofill::AutofillMetrics::SuggestionAcceptedMethod)+0x520 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x3797008) #9 0x0001251fc514 in autofill::PopupRowView::OnMouseReleased(ui::MouseEvent const&)+0x224 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0xaf58514) #10 0x000106000d74 in ui::EventDispatcher::DispatchEvent(ui::EventHandler*, ui::Event*)+0x22c (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x18d74) #11 0x000105fff9dc in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*)+0x57c (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x179dc) #12 0x000105fff0b8 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*)+0x1b0 (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x170b8) #13 0x000105ffec10 in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*)+0x1dc (/Users/test/chromium/src/out/asan-release/libui_events.dylib:arm64+0x16c10) #14 0x00013c7f69b0 in views::internal::RootView::OnMouseReleased(ui::MouseEvent const&)+0x218 (/Users/test/chromium/src/out/asan-release/libui_views.dylib:arm64+0x4569b0) #15 0x00013c826428 in views::Widget::OnMouseEvent(ui::MouseEvent*)+0x39c (/Users/test/chromium/src/out/asan-release/libui_views.dylib:arm64+0x486428) #16 0x0001251f1378 in autofill::PopupBaseView::Widget::OnMouseEvent(ui::MouseEvent*)+0x3f4 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0xaf4d378) #17 0x00013c887d78 in views::NativeWidgetMacNSWindowHost::OnMouseEvent(std::__Cr::unique_ptr>)+0xf0 (/Users/test/chromium/src/out/asan-release/libui_views.dylib:arm64+0x4e7d78) #18 0x00013da6fa80 in -[BridgedContentView mouseEvent:]+0x1dc (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0xfa80) #19 0x00013da6d724 in -[BridgedContentView processCapturedMouseEvent:]+0x29c (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0xd724) #20 0x00013dab6b00 in non-virtual thunk to remote_cocoa::NativeWidgetNSWindowBridge::PostCapturedEvent(NSEvent*)+0x34 (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x56b00) #21 0x00013da8c468 in invocation function for block in remote_cocoa::CocoaMouseCapture::ActiveEventTap::Init()+0x160 (/Users/test/chromium/src/out/asan-release/libcomponents_remote_cocoa_app_shim.dylib:arm64+0x2c468) #22 0x00019ea33094 in _NSSendEventToObservers+0xf8 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x160094) #23 0x00019f2ab150 in -[NSApplication(NSEventRouting) sendEvent:]+0x70 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x9d8150) #24 0x00011fc333d4 in __34-[BrowserCrApplication sendEvent:]_block_invoke+0x270 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x598f3d4) #25 0x0001032c8df8 in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x3f0df8) #26 0x00011fc32bf8 in -[BrowserCrApplication sendEvent:]+0x868 (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x598ebf8) #27 0x00019eeaa428 in -[NSApplication _handleEvent:]+0x38 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x5d7428) #28 0x00019e900c08 in -[NSApplication run]+0x204 (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit:arm64e+0x2dc08) #29 0x0001032e0468 in base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)+0x328 (/Users/test/chromium/src/out/asan-release/libbase.dylib:arm64+0x408468) SUMMARY: AddressSanitizer: heap-use-after-free (/Users/test/chromium/src/out/asan-release/libchrome_dll.dylib:arm64+0x7f59c50) in autofill::FormFiller::UndoAutofill(autofill::mojom::ActionPersistence, autofill::FormData, autofill::FormStructure&, autofill::FormFieldData const&, autofill::FillingProduct)+0x1844 Shadow bytes around the buggy address: 0x6040012b8d00: f7 fa 00 00 00 00 00 fa f7 fa 00 00 00 00 00 fa 0x6040012b8d80: f7 fa 00 00 00 00 00 fa f7 fa 00 00 00 00 00 fa 0x6040012b8e00: f7 fa 00 00 00 00 00 fa f7 fa fd fd fd fd fd fa 0x6040012b8e80: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fa 0x6040012b8f00: f7 fa fd fd fd fd fd fa f7 fa fd fd fd fd fd fa =>0x6040012b8f80: f7 fa fd fd fd fd fd fa f7 fa fd fd fd[fd]fd fa 0x6040012b9000: f7 fa fd fd fd fd fd fa f7 fa fd fd fd fd fd fd 0x6040012b9080: f7 fa fd fd fd fd fd fa f7 fa fd fd fd fd fd fd 0x6040012b9100: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd 0x6040012b9180: f7 fa fd fd fd fd fd fd f7 fa 00 00 00 00 00 fa 0x6040012b9200: f7 fa 00 00 00 00 00 fa f7 fa fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==56817==ADDITIONAL INFO ==56817==Note: Please include this section with the ASan report. Task trace: Command line: `out/asan-release/Chromium.app/Contents/MacOS/Chromium --user-data-dir=/tmp/poc-1774079687 --flag-switches-begin --flag-switches-end` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==56817==END OF ADDITIONAL INFO ==56817==ABORTING