[1233:1233:0405/012310.499154:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [1268:1268:0405/012311.295876:FATAL:third_party/blink/renderer/core/html/html_frame_element_base.cc:185] Security CHECK failed: !ContentFrame() || GetDocument().StatePreservingAtomicMoveInProgress(). #0 0x5653bf2179f6 in ___interceptor_backtrace ??:0:0 #1 0x5653d742ba98 in base::debug::CollectStackTrace(base::span) ./../../base/debug/stack_trace_posix.cc:1050:7 #2 0x5653d73e9327 in base::debug::StackTrace::StackTrace() ./../../base/debug/stack_trace.cc:280:20 #3 0x5653d70f0dd5 in logging::LogMessage::Flush() ./../../base/logging.cc:708:29 #4 0x5653d70f2939 in logging::LogMessageFatal::~LogMessageFatal() ./../../base/logging.cc:1052:3 #5 0x5653e552ffd4 in blink::HTMLFrameElementBase::InsertedInto(blink::ContainerNode&) ./../../third_party/blink/renderer/core/html/html_frame_element_base.cc:184:3 #6 0x5653e552642b in blink::HTMLIFrameElement::InsertedInto(blink::ContainerNode&) ./../../third_party/blink/renderer/core/html/html_iframe_element.cc:532:29 #7 0x5653e81af5d3 in blink::ContainerNode::NotifyNodeInsertedInternal(blink::Node&, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember, 11u>&) ./../../third_party/blink/renderer/core/dom/container_node.cc:1396:18 #8 0x5653e81a923f in void blink::ContainerNode::InsertNodeVector(blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember, 11u> const&, blink::Node*, blink::ContainerNode::AdoptAndAppendChild const&, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember, 11u>&) ./../../third_party/blink/renderer/core/dom/container_node.cc:407:9 #9 0x5653e81a468e in blink::ContainerNode::AppendChild(blink::Node*, blink::ExceptionState&) ./../../third_party/blink/renderer/core/dom/container_node.cc:1223:5 #10 0x5653e920049a in blink::(anonymous namespace)::v8_node::AppendChildOperationCallbackForMainWorld(v8::FunctionCallbackInfo const&) ./gen/third_party/blink/renderer/bindings/core/v8/v8_node.cc:523:39 #11 0x5653ca1ba6e4 in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc:0:0 Task trace: #0 0x5653e9b21bf2 in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool) ./../../third_party/blink/renderer/core/scheduler/dom_timer.cc:343:27 #1 0x5653e856cd58 in blink::HTMLDocumentParser::SchedulePumpTokenizer(bool) ./../../third_party/blink/renderer/core/html/parser/html_document_parser.cc:864:7 #2 0x5653e856cd58 in blink::HTMLDocumentParser::SchedulePumpTokenizer(bool) ./../../third_party/blink/renderer/core/html/parser/html_document_parser.cc:864:7 #3 0x5653daf3edf8 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ./../../ipc/ipc_mojo_bootstrap.cc:1138:13 Crash keys: "view-count" = "1" "loaded-origin-0" = "http://127.0.0.1:17321" "web-frame-count" = "2" "gpu-generation-intel" = "0" "gpu_count" = "0" "gpu-devid" = "0x0000" "gpu-venid" = "0x0000" "renderer_foreground" = "true" "v8_ro_space_firstpage_address" = "0x79d400000000" "v8_isolate_address" = "0x7e4388e45000" "num-experiments" = "21" "reentry_guard_tls_slot" = "unused" "switch-19" = "--trace-process-track-uuid=3190708990997080739" "switch-18" = "--pseudonymization-salt-handle=7,i,1080813493876198840,961084722" "switch-17" = "--variations-seed-version" "switch-16" = "--field-trial-handle=3,i,7519031517090448194,1826332992514247372" "switch-15" = "--shared-files=v8_context_snapshot_data:100" "switch-14" = "--launch-time-ticks=323390014099" "switch-13" = "--time-ticks-at-unix-epoch=-1775028800899199" "switch-12" = "--renderer-client-id=5" "commandline-disabled-feature-1" = "PaintHolding" "osarch" = "x86_64" "pid" = "1268" "ptype" = "renderer" "switch-11" = "--enable-main-frame-before-activation" "switch-10" = "--num-raster-threads=4" "switch-9" = "--lang=en-US" "switch-8" = "--disable-gpu-compositing" "switch-7" = "--ozone-platform=headless" "switch-6" = "--no-sandbox" "switch-5" = "--change-stack-guard-on-fork=enable" "switch-4" = "--user-data-dir=/tmp/chrome-poc-profile" "switch-3" = "--noerrdialogs" "switch-2" = "--enable-crash-reporter=," "switch-1" = "--crashpad-handler-pid=1206" "num-switches" = "23" [1203:1203:0405/012311.308234:INFO:CONSOLE:19] "[POC] hasFocus=true activeElement=", source: http://127.0.0.1:17321/poc.html (19) [1203:1203:0405/012311.310299:INFO:CONSOLE:19] "[POC] after victim.focus(): activeElement=victim", source: http://127.0.0.1:17321/poc.html (19) [1203:1203:0405/012311.311591:INFO:CONSOLE:19] "[POC] blur handler entered; inMoveBefore=true", source: http://127.0.0.1:17321/poc.html (19) [1203:1203:0405/012311.312628:INFO:CONSOLE:19] "[POC] frame1 removed; isConnected=false contentWindow=LIVE", source: http://127.0.0.1:17321/poc.html (19) [1203:1203:0405/012311.314094:INFO:CONSOLE:19] "[POC] moveBefore returned; blurFiredDuringMove=true", source: http://127.0.0.1:17321/poc.html (19) [1203:1203:0405/012311.315113:INFO:CONSOLE:19] "[POC] zombie iframe: isConnected=false contentWindow=LIVE contentDocument=LIVE", source: http://127.0.0.1:17321/poc.html (19) [1203:1203:0405/012311.316120:INFO:CONSOLE:19] "[POC] Re-inserting zombie iframe — expect SECURITY_CHECK crash...", source: http://127.0.0.1:17321/poc.html (19) Received signal 6 #0 0x5653bf2179f6 in ___interceptor_backtrace ??:0:0 #1 0x5653d742ba98 in base::debug::CollectStackTrace(base::span) ./../../base/debug/stack_trace_posix.cc:1050:7 #2 0x5653d73e9327 in base::debug::StackTrace::StackTrace() ./../../base/debug/stack_trace.cc:280:20 #3 0x5653d742ae9f in base::debug::(anonymous namespace)::StackDumpSignalHandler(int, siginfo_t*, void*) ./../../base/debug/stack_trace_posix.cc:483:3 #4 0x7f338ac40050 in __sigaction ??:? #5 0x7f338ac8eeec in pthread_key_delete ??:? #6 0x7f338ac3ffb2 in raise ??:0:0 #7 0x7f338ac2a472 in abort ??:0:0 #8 0x5653d73bfcca in base::debug::BreakDebuggerAsyncSafe() ./../../base/debug/debugger_posix.cc:330:3 #9 0x5653ee0c7bfb in base::internal::Invoker>, std::__Cr::basic_string_view>)>, base::internal::BindState>, std::__Cr::basic_string_view>)>, void (char const*, int, std::__Cr::basic_string_view>, std::__Cr::basic_string_view>)>::Run(base::internal::BindStateBase*, char const*, int, std::__Cr::basic_string_view>&&, std::__Cr::basic_string_view>&&) ./../../base/functional/bind_internal.h:673:12 #10 0x5653d70f27aa in base::RepeatingCallback>, std::__Cr::basic_string_view>)>::Run(char const*, int, std::__Cr::basic_string_view>, std::__Cr::basic_string_view>) const & ./../../base/functional/callback.h:346:12 #11 0x5653d70f2401 in logging::LogMessage::HandleFatal(unsigned long, std::__Cr::basic_string, std::__Cr::allocator> const&) const ./../../base/logging.cc:1023:26 #12 0x5653d70f19cd in logging::LogMessage::Flush() ./../../base/logging.cc:743:7 #13 0x5653d70f2939 in logging::LogMessageFatal::~LogMessageFatal() ./../../base/logging.cc:1052:3 #14 0x5653e552ffd4 in blink::HTMLFrameElementBase::InsertedInto(blink::ContainerNode&) ./../../third_party/blink/renderer/core/html/html_frame_element_base.cc:184:3 #15 0x5653e552642b in blink::HTMLIFrameElement::InsertedInto(blink::ContainerNode&) ./../../third_party/blink/renderer/core/html/html_iframe_element.cc:532:29 #16 0x5653e81af5d3 in blink::ContainerNode::NotifyNodeInsertedInternal(blink::Node&, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember, 11u>&) ./../../third_party/blink/renderer/core/dom/container_node.cc:1396:18 #17 0x5653e81a923f in void blink::ContainerNode::InsertNodeVector(blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember, 11u> const&, blink::Node*, blink::ContainerNode::AdoptAndAppendChild const&, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember, 11u>&) ./../../third_party/blink/renderer/core/dom/container_node.cc:407:9 #18 0x5653e81a468e in blink::ContainerNode::AppendChild(blink::Node*, blink::ExceptionState&) ./../../third_party/blink/renderer/core/dom/container_node.cc:1223:5 #19 0x5653e920049a in blink::(anonymous namespace)::v8_node::AppendChildOperationCallbackForMainWorld(v8::FunctionCallbackInfo const&) ./gen/third_party/blink/renderer/bindings/core/v8/v8_node.cc:523:39 #20 0x5653ca1ba6e4 in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc:0:0 r8: 00005653f82b1ff0 r9: 00007fffffffff01 r10: 0000000000000008 r11: 0000000000000246 r12: 0000000000000006 r13: 00007b3387ab9a00 r14: 00000f6670f57340 r15: 00007b7388dec130 di: 00000000000004f4 si: 00000000000004f4 bp: 00007f3389a9e700 bx: 00000000000004f4 dx: 0000000000000006 ax: 0000000000000000 cx: 00007f338ac8eeec sp: 00007ffcda0bf7c0 ip: 00007f338ac8eeec efl: 0000000000000246 cgf: 002b000000000033 erf: 0000000000000000 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000 [end of stack trace]