[1700:1715:0403/101046.833127:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [1700:1715:0403/101046.848260:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [1700:1715:0403/101046.848517:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [1700:1715:0403/101046.848725:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig Fontconfig error: No writable cache directories /var/cache/fontconfig /usr/local/google/home/vmiura/.cache/fontconfig /usr/local/google/home/vmiura/.fontconfig [1700:1715:0403/101046.983035:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [1733:1733:0403/101046.987560:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [1700:1700:0403/101047.018310:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [1700:1700:0403/101047.019591:WARNING:components/os_crypt/sync/key_storage_linux.cc:166] OSCrypt tried Libsecret but couldn't initialise. [1700:1715:0403/101047.149603:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [1700:1715:0403/101047.252545:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [1700:1700:0403/101047.266503:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1700:1700:0403/101047.266745:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [1700:1715:0403/101047.266985:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [1700:1700:0403/101047.267961:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1700:1700:0403/101047.287552:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1700:1700:0403/101047.300256:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1700:1715:0403/101047.300815:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory (localhost:8443:1700): dbind-WARNING **: 10:10:47.443: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/229127/at-spi/bus_20: No such file or directory [1700:1700:0403/101047.922065:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1700:1715:0403/101047.922088:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [1700:1715:0403/101047.922416:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [1700:1700:0403/101047.935113:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1700:1715:0403/101047.935616:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [1700:1700:0403/101047.980858:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [1700:1700:0403/101047.984451:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [1700:1700:0403/101047.984535:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [1700:1700:0403/101048.000988:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1700:1715:0403/101048.001811:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [1700:1723:0403/101048.057416:ERROR:crypto/nss_util.cc:79] Failed to create /usr/local/google/home/vmiura/.local/share/pki/nssdb directory. [1700:1700:0403/101048.061639:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1700:1715:0403/101048.062379:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [1700:1700:0403/101048.133184:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [1700:1700:0403/101048.133320:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. [1700:1700:0403/101048.306357:INFO:CONSOLE:7] "Opening wss://localhost:8443/ws over HTTP/2 (RFC 8441)...", source: https://localhost:8443/ (7) [1700:1700:0403/101048.385788:INFO:CONSOLE:7] "ws open -> server will now send DATA frame", source: https://localhost:8443/ (7) [1736:1765:0403/101048.874555:ERROR:net/websockets/websocket_basic_stream_adapters.cc:179] [POC] OnDataReceived: read_callback_ set, this=0x7c7b53273e80. Entering std::move(read_callback_).Run(CopySavedReadDataIntoBuffer()). The argument is evaluated AFTER the postfix expression (C++17 [expr.call]/8) but BEFORE .Run() body executes. read_callback_.holder_ stays populated throughout the argument evaluation. [1736:1765:0403/101048.874724:ERROR:net/spdy/spdy_session.cc:3338] [POC] OnReadBufferConsumed(DISCARD) reached from inside pop_front() destructor chain. Simulating cap-exceeded drain. active_streams=1 [1736:1765:0403/101048.874822:ERROR:net/websockets/websocket_basic_stream_adapters.cc:222] [POC] OnClose: read_callback_ is non-null inside reentrant OnClose called from DoDrainSession. this=0x7c7b53273e80 read_data_.IsEmpty()=0 (should be false: begin_ not yet advanced). Running callback with status=-100 -> will synchronously delete adapter via channel_.reset() [1736:1765:0403/101048.875424:ERROR:net/websockets/websocket_basic_stream_adapters.cc:232] [POC] OnClose: !self after running read_callback_ -> adapter was destroyed. Returning. Next stop: unwinding through ConsumeHelper, ~SpdyBuffer, ~unique_ptr, DestructRange, then pop_front:1003 begin_++ on FREED memory. [1736:1765:0403/101048.875524:ERROR:net/spdy/spdy_session.cc:3343] [POC] DoDrainSession returned. Unwinding to pop_front()... ================================================================= ==1736==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c7b53273ec8 at pc 0x55fac1585281 bp 0x7b8b48991830 sp 0x7b8b48991828 READ of size 8 at 0x7c7b53273ec8 thread T7 (Chrome_ChildIOT) [1700:1700:0403/101048.877639:INFO:CONSOLE:7] "ws close code=1006 clean=false", source: https://localhost:8443/ (7) #0 0x55fac1585280 in net::SpdyReadQueue::Dequeue(base::span) base/containers/circular_deque.h:1003:11 #1 0x55fac176eef5 in net::WebSocketSpdyStreamAdapter::CopySavedReadDataIntoBuffer() net/websockets/websocket_basic_stream_adapters.cc:265:23 #2 0x55fac1770203 in net::WebSocketSpdyStreamAdapter::OnDataReceived(std::__Cr::unique_ptr>) net/websockets/websocket_basic_stream_adapters.cc:186:35 #3 0x55fac15f1d13 in net::SpdyStream::OnDataReceived(std::__Cr::unique_ptr>) net/spdy/spdy_stream.cc:476:14 #4 0x55fac15acd1d in net::SpdySession::OnStreamFrameData(unsigned int, char const*, unsigned long) net/spdy/spdy_session.cc:2983:11 #5 0x55fac19a0ab9 in http2::DataPayloadDecoder::StartDecodingPayload(http2::FrameDecoderState*, http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/payload_decoders/data_payload_decoder.cc:66:28 #6 0x55fac199c86e in http2::Http2FrameDecoder::StartDecodingPayload(http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/http2_frame_decoder.cc:293:32 #7 0x55fac199c1c5 in http2::Http2FrameDecoder::DecodeFrame(http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/http2_frame_decoder.cc:57:16 #8 0x55fac19782bc in http2::Http2DecoderAdapter::ProcessInputFrame(char const*, unsigned long) net/third_party/quiche/src/quiche/http2/core/http2_frame_decoder_adapter.cc:800:40 #9 0x55fac19780c2 in http2::Http2DecoderAdapter::ProcessInput(char const*, unsigned long) net/third_party/quiche/src/quiche/http2/core/http2_frame_decoder_adapter.cc:272:30 #10 0x55fac15a40af in net::SpdySession::DoReadComplete(int) net/spdy/spdy_session.cc:2050:53 #11 0x55fac15a296c in net::SpdySession::DoReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1968:18 #12 0x55fac159f0f2 in net::SpdySession::PumpReadLoop(net::SpdySession::ReadState, int) net/spdy/spdy_session.cc:1944:17 #13 0x55fac15b8721 in base::internal::Invoker&&, net::SpdySession::ReadState&&>, base::internal::BindState, net::SpdySession::ReadState>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #14 0x55fac14cc804 in net::SSLClientSocketImpl::DoReadCallback(int) base/functional/callback.h:155:12 #15 0x55fac14cbc58 in net::SSLClientSocketImpl::RetryAllOperations() net/socket/ssl_client_socket_impl.cc:1501:5 #16 0x55fac14d91b0 in net::SocketBIOAdapter::OnSocketReadIfReadyComplete(int) net/socket/socket_bio_adapter.cc:212:14 #17 0x55fac14dc724 in base::internal::Invoker&&>, base::internal::BindState>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #18 0x55fac1500728 in net::TCPClientSocket::DidCompleteRead(int) base/functional/callback.h:155:12 #19 0x55fac1503966 in base::internal::Invoker, base::internal::BindState>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #20 0x55fac16ce01c in net::TCPSocketPosix::ReadIfReadyCompleted(base::OnceCallback, int) base/functional/callback.h:155:12 #21 0x55fac16d1170 in base::internal::Invoker, int), net::TCPSocketPosix*, base::OnceCallback&&>, base::internal::BindState, int), base::internal::UnretainedWrapper, base::OnceCallback>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #22 0x55fac16d6c9d in net::SocketPosix::OnFileCanReadWithoutBlocking(int) base/functional/callback.h:155:12 #23 0x55fac03ec73d in base::MessagePumpEpoll::HandleEvent(int, bool, bool, base::MessagePumpEpoll::FdWatchController*) base/message_loop/message_pump_epoll.cc:760:13 #24 0x55fac03eb707 in base::MessagePumpEpoll::OnEpollEvent(base::MessagePumpEpoll::EpollEventEntry&, unsigned int) base/message_loop/message_pump_epoll.cc:614:7 #25 0x55fac03e98a3 in base::MessagePumpEpoll::WaitForEpollEvents(base::TimeDelta) base/message_loop/message_pump_epoll.cc:506:7 #26 0x55fac03e8408 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:285:5 #27 0x55fac02639a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #28 0x55fac0165570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #29 0x55fac02f01cc in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:355:13 #30 0x55facc2c7853 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19 #31 0x55fac02f0767 in base::Thread::ThreadMain() base/threading/thread.cc:425:3 #32 0x55fac03544be in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #33 0x55faa81f8c46 in asan_thread_start(void*) asan_interceptors.cpp 0x7c7b53273ec8 is located 72 bytes inside of 176-byte region [0x7c7b53273e80,0x7c7b53273f30) freed by thread T7 (Chrome_ChildIOT) here: #0 0x55faa8235002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e15002) (BuildId: 72a0a95693868884) #1 0x55fac6d47e6c in net::WebSocketBasicStream::~WebSocketBasicStream() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x55fac6d48083 in net::WebSocketBasicStream::~WebSocketBasicStream() net/websockets/websocket_basic_stream.cc:187:47 #3 0x55fac6d2a12d in net::WebSocketChannel::~WebSocketChannel() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #4 0x55fac6d2a623 in net::WebSocketChannel::~WebSocketChannel() net/websockets/websocket_channel.cc:266:39 #5 0x55fac6d0eda0 in network::WebSocket::Reset() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #6 0x55fac6d30992 in net::WebSocketChannel::OnReadDone(bool, int) net/websockets/websocket_channel.cc:1015:21 #7 0x55fac6d3577d in base::internal::Invoker&&, net::WebSocketChannel*, bool&&>, base::internal::BindState, base::internal::UnretainedWrapper, bool>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #8 0x55fac6d4ae4e in net::WebSocketBasicStream::OnReadComplete(std::__Cr::vector>, std::__Cr::allocator>>>*, int) base/functional/callback.h:155:12 #9 0x55fac6d4c91b in void base::internal::Invoker>, std::__Cr::allocator>>>*, int), net::WebSocketBasicStream*, std::__Cr::vector>, std::__Cr::allocator>>>*>, base::internal::BindState>, std::__Cr::allocator>>>*, int), base::internal::UnretainedWrapper, base::internal::UnretainedWrapper>, std::__Cr::allocator>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (int)>::RunImpl>, std::__Cr::allocator>>>*, int), std::__Cr::tuple, base::internal::UnretainedWrapper>, std::__Cr::allocator>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul, 1ul>(void (net::WebSocketBasicStream::*&&)(std::__Cr::vector>, std::__Cr::allocator>>>*, int), std::__Cr::tuple, base::internal::UnretainedWrapper>, std::__Cr::allocator>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence, int&&) base/functional/bind_internal.h:740:12 #10 0x55fac6d4c664 in base::internal::Invoker>, std::__Cr::allocator>>>*, int), net::WebSocketBasicStream*, std::__Cr::vector>, std::__Cr::allocator>>>*>, base::internal::BindState>, std::__Cr::allocator>>>*, int), base::internal::UnretainedWrapper, base::internal::UnretainedWrapper>, std::__Cr::allocator>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:982:12 #11 0x55fac1770eb9 in net::WebSocketSpdyStreamAdapter::OnClose(int) base/functional/callback.h:155:12 #12 0x55fac15f4c3a in net::SpdyStream::OnClose(int) net/spdy/spdy_stream.cc:585:15 #13 0x55fac15a12f8 in net::SpdySession::DeleteStream(std::__Cr::unique_ptr>, int) net/spdy/spdy_session.cc:2626:11 #14 0x55fac1597d45 in net::SpdySession::CloseActiveStreamIterator(std::__Cr::__map_iterator, std::__Cr::__tree_node, void*>*, long>>, int) net/spdy/spdy_session.cc:1849:3 #15 0x55fac159a3b0 in net::SpdySession::StartGoingAway(unsigned int, net::Error) net/spdy/spdy_session.cc:1390:5 #16 0x55fac15932d8 in net::SpdySession::DoDrainSession(net::Error, std::__Cr::basic_string, std::__Cr::allocator> const&, bool) net/spdy/spdy_session.cc:2725:5 #17 0x55fac15adb53 in net::SpdySession::OnReadBufferConsumed(unsigned long, net::SpdyBuffer::ConsumeSource) net/spdy/spdy_session.cc:3341:5 #18 0x55fac15bad0e in base::internal::Invoker const&>, base::internal::BindState>, void (unsigned long, net::SpdyBuffer::ConsumeSource)>::Run(base::internal::BindStateBase*, unsigned long, net::SpdyBuffer::ConsumeSource) base/functional/bind_internal.h:740:12 #19 0x55fac1583141 in base::RepeatingCallback::Run(unsigned long, net::SpdyBuffer::ConsumeSource) const & base/functional/callback.h:346:12 #20 0x55fac158245f in net::SpdyBuffer::~SpdyBuffer() net/spdy/spdy_buffer.cc:109:9 #21 0x55fac1585f14 in base::internal::VectorBuffer>>::DestructRange(base::span>, 18446744073709551615ul, std::__Cr::unique_ptr>*>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #22 0x55fac15857f3 in base::circular_deque>>::DestructRange(unsigned long, unsigned long) base/containers/circular_deque.h #23 0x55fac15850b7 in net::SpdyReadQueue::Dequeue(base::span) base/containers/circular_deque.h:1002:5 #24 0x55fac176eef5 in net::WebSocketSpdyStreamAdapter::CopySavedReadDataIntoBuffer() net/websockets/websocket_basic_stream_adapters.cc:265:23 #25 0x55fac1770203 in net::WebSocketSpdyStreamAdapter::OnDataReceived(std::__Cr::unique_ptr>) net/websockets/websocket_basic_stream_adapters.cc:186:35 #26 0x55fac15f1d13 in net::SpdyStream::OnDataReceived(std::__Cr::unique_ptr>) net/spdy/spdy_stream.cc:476:14 #27 0x55fac15acd1d in net::SpdySession::OnStreamFrameData(unsigned int, char const*, unsigned long) net/spdy/spdy_session.cc:2983:11 #28 0x55fac19a0ab9 in http2::DataPayloadDecoder::StartDecodingPayload(http2::FrameDecoderState*, http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/payload_decoders/data_payload_decoder.cc:66:28 #29 0x55fac199c86e in http2::Http2FrameDecoder::StartDecodingPayload(http2::DecodeBuffer*) net/third_party/quiche/src/quiche/http2/decoder/http2_frame_decoder.cc:293:32 previously allocated by thread T7 (Chrome_ChildIOT) here: #0 0x55faa82343fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e143fd) (BuildId: 72a0a95693868884) #1 0x55fac6d5ead4 in net::WebSocketHttp2HandshakeStream::StartRequestCallback(int) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x55fac6d5e541 in net::WebSocketHttp2HandshakeStream::SendRequest(net::HttpRequestHeaders const&, net::HttpResponseInfo*, base::OnceCallback) net/websockets/websocket_http2_handshake_stream.cc:150:5 #3 0x55fac699884a in net::HttpNetworkTransaction::DoSendRequest() net/http/http_network_transaction.cc:1475:19 #4 0x55fac698a51b in net::HttpNetworkTransaction::DoLoop(int) net/http/http_network_transaction.cc:1066:14 #5 0x55fac6986b7f in net::HttpNetworkTransaction::OnIOComplete(int) net/http/http_network_transaction.cc:1002:12 #6 0x55fac6990451 in net::HttpNetworkTransaction::OnStreamReady(net::ProxyInfo const&, std::__Cr::unique_ptr>) net/http/http_network_transaction.cc:884:3 #7 0x55fac1248360 in base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #8 0x55fac01eabf6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #9 0x55fac0262299 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #10 0x55fac026110a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #11 0x55fac03e8476 in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55 #12 0x55fac02639a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #13 0x55fac0165570 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #14 0x55fac02f01cc in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:355:13 #15 0x55facc2c7853 in content::(anonymous namespace)::ChildIOThread::Run(base::RunLoop*) content/child/child_process.cc:69:19 #16 0x55fac02f0767 in base::Thread::ThreadMain() base/threading/thread.cc:425:3 #17 0x55fac03544be in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #18 0x55faa81f8c46 in asan_thread_start(void*) asan_interceptors.cpp Thread T7 (Chrome_ChildIOT) created by T0 (chrome) here: #0 0x55faa81dea71 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x10dbea71) (BuildId: 72a0a95693868884) #1 0x55fac0353b12 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x55fac02ef408 in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:231:26 #3 0x55facc2c65d1 in content::ChildProcess::ChildProcess(base::ThreadType, std::__Cr::unique_ptr>, bool) content/child/child_process.cc:152:21 #4 0x55fab9002537 in content::UtilityMain(content::MainFunctionParams) content/utility/utility_main.cc:459:16 #5 0x55fabbd03bb5 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:762:14 #6 0x55fabbd06a68 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10 #7 0x55fabbd00441 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #8 0x55fabbd00a3c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 #9 0x55faa8235b39 in ChromeMain chrome/app/chrome_main.cc:191:12 #10 0x7f8b5522b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free base/containers/circular_deque.h:1003:11 in net::SpdyReadQueue::Dequeue(base::span) Shadow bytes around the buggy address: 0x7c7b53273c00: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa 0x7c7b53273c80: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd 0x7c7b53273d00: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x7c7b53273d80: f7 fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c7b53273e00: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa =>0x7c7b53273e80: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd 0x7c7b53273f00: fd fd fd fd fd fd fa fa fa fa fa fa f7 fa fd fd 0x7c7b53273f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c7b53274000: fd fd fd fa fa fa fa fa fa fa f7 fa fd fd fd fd 0x7c7b53274080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c7b53274100: fd fa fa fa fa fa fa fa f7 fa 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1736==ADDITIONAL INFO ==1736==Note: Please include this section with the ASan report. Task trace: Command line: `/proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=network --no-sandbox --ignore-certificate-errors --use-angle=swiftshader-webgl --ignore-certificate-errors --crashpad-handler-pid=1702 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --shared-files=network_parent_dirs_pipe:100,v8_context_snapshot_data:101 --field-trial-handle=3,i,11475351596113571003,8373632697946445254,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,14395117341840198293,8077575605325575993,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=stderr --v=0` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==1736==END OF ADDITIONAL INFO ==1736==ABORTING [1700:1700:0403/101051.650162:ERROR:content/browser/network_service_instance_impl.cc:703] Network service crashed or was terminated, restarting service. Created TensorFlow Lite XNNPACK delegate for CPU. Created TensorFlow Lite XNNPACK delegate for CPU.