Note: Google Test filter = GpuChannelHostObserverUafTest.*
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from GpuChannelHostObserverUafTest
[ RUN      ] GpuChannelHostObserverUafTest.ToctouOnDisconnect
=================================================================
==3254==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b52664290c0 at pc 0x55fff2d53dc2 bp 0x7b22625fb5e0 sp 0x7b22625fb5d8
READ of size 8 at 0x7b52664290c0 thread T3 (PocIoThread)
    #0 0x55fff2d53dc1 in gpu::GpuChannelHost::ConnectionTracker::NotifyGpuChannelLost() gpu/ipc/client/gpu_channel_host.cc:424:15
    #1 0x55fff2d5a8f0 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannelHost::ConnectionTracker::*&&)(), scoped_refptr<gpu::GpuChannelHost::ConnectionTracker>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannelHost::ConnectionTracker::*)(), scoped_refptr<gpu::GpuChannelHost::ConnectionTracker>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #2 0x55fff280b9f6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #3 0x55fff28805f9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #4 0x55fff287f46a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #5 0x55fff29d5356 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55
    #6 0x55fff2881d07 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #7 0x55fff27d1ae0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #8 0x55fff293225c in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:355:13
    #9 0x55fff29327f7 in base::Thread::ThreadMain() base/threading/thread.cc:425:3
    #10 0x55fff297a36e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13
    #11 0x55ffec64b606 in asan_thread_start(void*) asan_interceptors.cpp

0x7b52664290c0 is located 0 bytes inside of 24-byte region [0x7b52664290c0,0x7b52664290d8)
freed by thread T0 here:
    #0 0x55ffec6879c2 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/gpu_unittests+0x4bac9c2) (BuildId: 2fc0dc0a292e56a2)
    #1 0x55ffed4b2b3d in gpu::(anonymous namespace)::GpuChannelHostObserverUafTest_ToctouOnDisconnect_Test::TestBody() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x55fff018f23b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x55fff0191ee7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x55fff0193ff3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x55fff01c3e4a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x55fff01c28ae in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x55fff2a5f51c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x55ffecbdf131 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), (anonymous namespace)::GpuTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<(anonymous namespace)::GpuTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x55fff2a6b0eb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x55fff2a6aa0b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x55ffecbdee27 in main gpu/command_buffer/common/unittest_main.cc:38:10
    #12 0x7f2267a45249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 here:
    #0 0x55ffec686dbd in operator new(unsigned long) (/chromium/chromium/src/out/asan/gpu_unittests+0x4babdbd) (BuildId: 2fc0dc0a292e56a2)
    #1 0x55ffed4b26a9 in gpu::(anonymous namespace)::GpuChannelHostObserverUafTest_ToctouOnDisconnect_Test::TestBody() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x55fff018f23b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x55fff0191ee7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x55fff0193ff3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x55fff01c3e4a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x55fff01c28ae in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x55fff2a5f51c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x55ffecbdf131 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), (anonymous namespace)::GpuTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<(anonymous namespace)::GpuTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x55fff2a6b0eb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x55fff2a6aa0b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x55ffecbdee27 in main gpu/command_buffer/common/unittest_main.cc:38:10
    #12 0x7f2267a45249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Thread T3 (PocIoThread) created by T0 here:
    #0 0x55ffec631431 in pthread_create (/chromium/chromium/src/out/asan/gpu_unittests+0x4b56431) (BuildId: 2fc0dc0a292e56a2)
    #1 0x55fff29799c2 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13
    #2 0x55fff2930db8 in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:231:26
    #3 0x55ffed4b20ad in gpu::(anonymous namespace)::GpuChannelHostObserverUafTest_ToctouOnDisconnect_Test::TestBody() gpu/ipc/client/gpu_channel_host_observer_uaf_unittest.cc:83:25
    #4 0x55fff018f23b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #5 0x55fff0191ee7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #6 0x55fff0193ff3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #7 0x55fff01c3e4a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #8 0x55fff01c28ae in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #9 0x55fff2a5f51c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #10 0x55ffecbdf131 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), (anonymous namespace)::GpuTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<(anonymous namespace)::GpuTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #11 0x55fff2a6b0eb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #12 0x55fff2a6aa0b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #13 0x55ffecbdee27 in main gpu/command_buffer/common/unittest_main.cc:38:10
    #14 0x7f2267a45249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free gpu/ipc/client/gpu_channel_host.cc:424:15 in gpu::GpuChannelHost::ConnectionTracker::NotifyGpuChannelLost()
Shadow bytes around the buggy address:
  0x7b5266428e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b5266428e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b5266428f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b5266428f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b5266429000: fd fd fd fa fa fa 00 00 00 fa fa fa 00 00 00 fa
=>0x7b5266429080: fa fa 00 00 00 00 fa fa[fd]fd fd fa fa fa 00 00
  0x7b5266429100: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b5266429180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b5266429200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b5266429280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b5266429300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==3254==ADDITIONAL INFO

==3254==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55fff2d5944f in mojo::SharedRemoteBase<mojo::Remote<gpu::mojom::GpuChannel>>::RemoteWrapper::set_disconnect_handler(base::OnceCallback<void ()>, scoped_refptr<base::SequencedTaskRunner>) mojo/public/cpp/bindings/shared_remote.h:143:47
    #1 0x55fff4abd6a7 in mojo::SimpleWatcher::ArmOrNotify() mojo/public/cpp/system/simple_watcher.cc:245:28
    #2 0x55fff2de5e16 in mojo::Connector::StartReceiving(scoped_refptr<base::SequencedTaskRunner>, bool) mojo/public/cpp/bindings/lib/connector.cc:208:9


==3254==END OF ADDITIONAL INFO

==3254==ABORTING