[2245:2245:0403/014233.737938:ERROR:third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:3186] [POC] kPointerDown received inside HandleTouchEvent dispatch. Simulating Delete IPC: destroying WidgetBase. WebFrameWidgetImpl=0x7b5402035410 widget_base_=0x7cf793616680
[2245:2245:0403/014233.742355:ERROR:third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:3193] [POC] WidgetBase destroyed. Returning to WidgetBaseInputHandler::HandleTouchEvent. Next access to this->widget_ at line 288 should UAF.
=================================================================
==2245==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cf793616770 at pc 0x55ce523c29c4 bp 0x7fffaaf2b6b0 sp 0x7fffaaf2b6a8
READ of size 8 at 0x7cf793616770 thread T0 (chrome)
    #0 0x55ce523c29c3 in blink::WidgetBaseInputHandler::HandleTouchEvent(blink::WebCoalescedInputEvent const&) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1012:48
    #1 0x55ce523c36bf in blink::WidgetBaseInputHandler::HandleInputEvent(blink::WebCoalescedInputEvent const&, std::__Cr::unique_ptr<cc::EventMetrics, std::__Cr::default_delete<cc::EventMetrics>>, base::OnceCallback<void (blink::mojom::InputEventResultState, ui::LatencyInfo const&, std::__Cr::unique_ptr<blink::InputHandlerProxy::DidOverscrollParams, std::__Cr::default_delete<blink::InputHandlerProxy::DidOverscrollParams>>, std::__Cr::optional<cc::TouchAction>)>) third_party/blink/renderer/platform/widget/input/widget_base_input_handler.cc:415:21
    #2 0x55ce523cfde1 in blink::WidgetInputHandlerManager::HandleInputEvent(blink::WebCoalescedInputEvent const&, std::__Cr::unique_ptr<cc::EventMetrics, std::__Cr::default_delete<cc::EventMetrics>>, base::OnceCallback<void (blink::mojom::InputEventResultState, ui::LatencyInfo const&, mojo::StructPtr<blink::mojom::blink::DidOverscrollParams>, std::__Cr::optional<cc::TouchAction>)>) third_party/blink/renderer/platform/widget/input/widget_input_handler_manager.cc:451:28
    #3 0x55ce523d00a2 in non-virtual thunk to blink::WidgetInputHandlerManager::HandleInputEvent(blink::WebCoalescedInputEvent const&, std::__Cr::unique_ptr<cc::EventMetrics, std::__Cr::default_delete<cc::EventMetrics>>, base::OnceCallback<void (blink::mojom::InputEventResultState, ui::LatencyInfo const&, mojo::StructPtr<blink::mojom::blink::DidOverscrollParams>, std::__Cr::optional<cc::TouchAction>)>) third_party/blink/renderer/platform/widget/input/widget_input_handler_manager.cc
    #4 0x55ce5239ff86 in blink::MainThreadEventQueue::HandleEventOnMainThread(blink::WebCoalescedInputEvent const&, blink::WebInputEventAttribution const&, std::__Cr::unique_ptr<cc::EventMetrics, std::__Cr::default_delete<cc::EventMetrics>>, base::OnceCallback<void (blink::mojom::InputEventResultState, ui::LatencyInfo const&, mojo::StructPtr<blink::mojom::blink::DidOverscrollParams>, std::__Cr::optional<cc::TouchAction>)>) third_party/blink/renderer/platform/widget/input/main_thread_event_queue.cc:910:24
    #5 0x55ce523a4064 in blink::QueuedWebInputEvent::Dispatch(blink::MainThreadEventQueue*) third_party/blink/renderer/platform/widget/input/main_thread_event_queue.cc:198:17
    #6 0x55ce5239e065 in blink::MainThreadEventQueue::DispatchEvents() third_party/blink/renderer/platform/widget/input/main_thread_event_queue.cc:638:11
    #7 0x55ce523aabb0 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::MainThreadEventQueue::*&&)(), blink::MainThreadEventQueue*&&>, base::internal::BindState<true, true, false, void (blink::MainThreadEventQueue::*)(), scoped_refptr<blink::MainThreadEventQueue>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #8 0x55ce4186ebf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #9 0x55ce418e6299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #10 0x55ce418e510a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #11 0x55ce4172d1f7 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #12 0x55ce418e79a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #13 0x55ce417e9570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #14 0x55ce4db72dcb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #15 0x55ce3d386a2f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #16 0x55ce3d387d5f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #17 0x55ce3d38aa68 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #18 0x55ce3d384441 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #19 0x55ce3d384a3c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #20 0x55ce298b9b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #21 0x7f679542b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7cf793616770 is located 240 bytes inside of 1008-byte region [0x7cf793616680,0x7cf793616a70)
freed by thread T0 (chrome) here:
    #0 0x55ce298b9002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e14002) (BuildId: 28515504ae66b083)
    #1 0x55ce4f40019c in blink::WebFrameWidgetImpl::HandleInputEvent(blink::WebCoalescedInputEvent const&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x55ce523c2671 in blink::WidgetBaseInputHandler::HandleTouchEvent(blink::WebCoalescedInputEvent const&) third_party/blink/renderer/platform/widget/input/widget_base_input_handler.cc:285:26
    #3 0x55ce523c36bf in blink::WidgetBaseInputHandler::HandleInputEvent(blink::WebCoalescedInputEvent const&, std::__Cr::unique_ptr<cc::EventMetrics, std::__Cr::default_delete<cc::EventMetrics>>, base::OnceCallback<void (blink::mojom::InputEventResultState, ui::LatencyInfo const&, std::__Cr::unique_ptr<blink::InputHandlerProxy::DidOverscrollParams, std::__Cr::default_delete<blink::InputHandlerProxy::DidOverscrollParams>>, std::__Cr::optional<cc::TouchAction>)>) third_party/blink/renderer/platform/widget/input/widget_base_input_handler.cc:415:21
    #4 0x55ce523cfde1 in blink::WidgetInputHandlerManager::HandleInputEvent(blink::WebCoalescedInputEvent const&, std::__Cr::unique_ptr<cc::EventMetrics, std::__Cr::default_delete<cc::EventMetrics>>, base::OnceCallback<void (blink::mojom::InputEventResultState, ui::LatencyInfo const&, mojo::StructPtr<blink::mojom::blink::DidOverscrollParams>, std::__Cr::optional<cc::TouchAction>)>) third_party/blink/renderer/platform/widget/input/widget_input_handler_manager.cc:451:28
    #5 0x55ce523d00a2 in non-virtual thunk to blink::WidgetInputHandlerManager::HandleInputEvent(blink::WebCoalescedInputEvent const&, std::__Cr::unique_ptr<cc::EventMetrics, std::__Cr::default_delete<cc::EventMetrics>>, base::OnceCallback<void (blink::mojom::InputEventResultState, ui::LatencyInfo const&, mojo::StructPtr<blink::mojom::blink::DidOverscrollParams>, std::__Cr::optional<cc::TouchAction>)>) third_party/blink/renderer/platform/widget/input/widget_input_handler_manager.cc
    #6 0x55ce5239ff86 in blink::MainThreadEventQueue::HandleEventOnMainThread(blink::WebCoalescedInputEvent const&, blink::WebInputEventAttribution const&, std::__Cr::unique_ptr<cc::EventMetrics, std::__Cr::default_delete<cc::EventMetrics>>, base::OnceCallback<void (blink::mojom::InputEventResultState, ui::LatencyInfo const&, mojo::StructPtr<blink::mojom::blink::DidOverscrollParams>, std::__Cr::optional<cc::TouchAction>)>) third_party/blink/renderer/platform/widget/input/main_thread_event_queue.cc:910:24
    #7 0x55ce523a4064 in blink::QueuedWebInputEvent::Dispatch(blink::MainThreadEventQueue*) third_party/blink/renderer/platform/widget/input/main_thread_event_queue.cc:198:17
    #8 0x55ce5239e065 in blink::MainThreadEventQueue::DispatchEvents() third_party/blink/renderer/platform/widget/input/main_thread_event_queue.cc:638:11
    #9 0x55ce523aabb0 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::MainThreadEventQueue::*&&)(), blink::MainThreadEventQueue*&&>, base::internal::BindState<true, true, false, void (blink::MainThreadEventQueue::*)(), scoped_refptr<blink::MainThreadEventQueue>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #10 0x55ce4186ebf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #11 0x55ce418e6299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #12 0x55ce418e510a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #13 0x55ce4172d1f7 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #14 0x55ce418e79a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #15 0x55ce417e9570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #16 0x55ce4db72dcb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #17 0x55ce3d386a2f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #18 0x55ce3d387d5f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #19 0x55ce3d38aa68 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #20 0x55ce3d384441 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #21 0x55ce3d384a3c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #22 0x55ce298b9b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #23 0x7f679542b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 (chrome) here:
    #0 0x55ce298b83fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e133fd) (BuildId: 28515504ae66b083)
    #1 0x55ce4f3d95db in std::__Cr::unique_ptr<blink::WidgetBase, std::__Cr::default_delete<blink::WidgetBase>> std::__Cr::make_unique<blink::WidgetBase, blink::WebFrameWidgetImpl*, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>, scoped_refptr<base::SingleThreadTaskRunner>&, bool&, bool&, bool, bool&, 0>(blink::WebFrameWidgetImpl*&&, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>&&, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>&&, scoped_refptr<base::SingleThreadTaskRunner>&, bool&, bool&, bool&&, bool&) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x55ce4f3d8033 in blink::WebFrameWidgetImpl::WebFrameWidgetImpl(base::PassKey<blink::WebLocalFrame>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::FrameWidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::FrameWidgetInterfaceBase>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>, scoped_refptr<base::SingleThreadTaskRunner>, viz::FrameSinkId const&, bool, bool, bool, bool, bool) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:388:20
    #3 0x55ce4f4b4758 in blink::WebFrameWidgetImpl* cppgc::MakeGarbageCollectedTrait<blink::WebFrameWidgetImpl>::Call<base::PassKey<blink::WebLocalFrame>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::FrameWidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::FrameWidgetInterfaceBase>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>, scoped_refptr<base::SingleThreadTaskRunner>, viz::FrameSinkId const&, bool&, bool&, bool&, bool&, bool&>(cppgc::AllocationHandle&, base::PassKey<blink::WebLocalFrame>&&, blink::CrossVariantMojoAssociatedRemote<blink::mojom::FrameWidgetHostInterfaceBase>&&, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::FrameWidgetInterfaceBase>&&, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>&&, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>&&, scoped_refptr<base::SingleThreadTaskRunner>&&, viz::FrameSinkId const&, bool&, bool&, bool&, bool&, bool&) v8/include/cppgc/allocation.h:239:32
    #4 0x55ce4f4a37af in blink::WebLocalFrameImpl::CreateFrameWidgetInternal(base::PassKey<blink::WebLocalFrame>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::FrameWidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::FrameWidgetInterfaceBase>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>, viz::FrameSinkId const&, bool, bool, bool) v8/include/cppgc/allocation.h:277:7
    #5 0x55ce4f4826af in blink::WebLocalFrame::InitializeFrameWidget(blink::CrossVariantMojoAssociatedRemote<blink::mojom::FrameWidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::FrameWidgetInterfaceBase>, blink::CrossVariantMojoAssociatedRemote<blink::mojom::WidgetHostInterfaceBase>, blink::CrossVariantMojoAssociatedReceiver<blink::mojom::WidgetInterfaceBase>, viz::FrameSinkId const&, bool, bool, bool) third_party/blink/renderer/core/frame/web_local_frame_impl.cc:696:3
    #6 0x55ce4d98a98e in content::RenderFrameImpl::CreateMainFrame(content::AgentSchedulingGroup&, blink::WebView*, blink::WebFrame*, bool, bool, mojo::StructPtr<blink::mojom::FrameReplicationState>, base::UnguessableToken const&, mojo::StructPtr<content::mojom::CreateLocalMainFrameParams>, blink::WebURL const&) content/renderer/render_frame_impl.cc:1632:56
    #7 0x55ce4da7be61 in content::AgentSchedulingGroup::CreateWebView(mojo::StructPtr<content::mojom::CreateViewParams>, bool, blink::WebURL const&) content/renderer/agent_scheduling_group.cc:276:7
    #8 0x55ce4da7b018 in content::AgentSchedulingGroup::CreateView(mojo::StructPtr<content::mojom::CreateViewParams>) content/renderer/agent_scheduling_group.cc:219:3
    #9 0x55ce2f392248 in content::mojom::AgentSchedulingGroupStubDispatch::Accept(content::mojom::AgentSchedulingGroup*, mojo::Message*) gen/content/common/agent_scheduling_group.mojom.cc:672:13
    #10 0x55ce4162e939 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #11 0x55ce4164c7c1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #12 0x55ce41634de3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #13 0x55ce4555509d in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #14 0x55ce45557525 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #15 0x55ce4186ebf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #16 0x55ce418e6299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #17 0x55ce418e510a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #18 0x55ce4172d1f7 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #19 0x55ce418e79a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #20 0x55ce417e9570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #21 0x55ce4db72dcb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #22 0x55ce3d386a2f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #23 0x55ce3d387d5f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #24 0x55ce3d38aa68 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #25 0x55ce3d384441 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #26 0x55ce3d384a3c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #27 0x55ce298b9b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #28 0x7f679542b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1012:48 in blink::WidgetBaseInputHandler::HandleTouchEvent(blink::WebCoalescedInputEvent const&)
Shadow bytes around the buggy address:
  0x7cf793616480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7cf793616500: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7cf793616580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7cf793616600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x7cf793616680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7cf793616700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
  0x7cf793616780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cf793616800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cf793616880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cf793616900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7cf793616980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2245==ADDITIONAL INFO

==2245==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55ce5239cf5c in blink::MainThreadEventQueue::PostTaskToMainThread() third_party/blink/renderer/platform/widget/input/main_thread_event_queue.cc:763:7


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=2163 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --remote-debugging-port=19222 --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1775028800899199 --launch-time-ticks=151739273338 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,4601950686463309838,14089170723332350579,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,3751410233275949635,6195532632876455338,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr --v=0`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==2245==END OF ADDITIONAL INFO

==2245==ABORTING