==2236494==ERROR: AddressSanitizer: heap-use-after-free on address 0x788ea36d2568 at pc 0x6418a4b29f1f bp 0x7fff1b2ff870 sp 0x7fff1b2ff868
READ of size 8 at 0x788ea36d2568 thread T0 (chrome)
    #0 0x6418a4b29f1e in base::ObserverList<OmniboxEditModel::Observer, false, (base::ObserverListReentrancyPolicy)0, base::internal::CheckedObserverAdapter>::RemoveObserver(OmniboxEditModel::Observer const*) gen/third_party/libc++/src/include/__vector/vector.h:349:57
    #1 0x6418a42ea952 in base::ScopedObservation<OmniboxEditModel, OmniboxEditModel::Observer, (partition_alloc::internal::RawPtrTraits)0>::~ScopedObservation() base/scoped_observation_traits.h:74:13
    #2 0x6418a42ea756 in WebuiOmniboxHandler::~WebuiOmniboxHandler() chrome/browser/ui/webui/searchbox/webui_omnibox_handler.cc:137:43
    #3 0x6418a42eabe3 in WebuiOmniboxHandler::~WebuiOmniboxHandler() chrome/browser/ui/webui/searchbox/webui_omnibox_handler.cc:137:43
    #4 0x6418c18bc84f in OmniboxPopupUI::~OmniboxPopupUI() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #5 0x6418c18bca73 in OmniboxPopupUI::~OmniboxPopupUI() chrome/browser/ui/webui/omnibox_popup/omnibox_popup_ui.cc:194:33
    #6 0x64189e78eef3 in content::WebUIImpl::~WebUIImpl() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #7 0x64189e78f513 in content::WebUIImpl::~WebUIImpl() content/browser/webui/web_ui_impl.cc:217:25
    #8 0x64189dbfa03a in content::RenderFrameHostImpl::OnUnloaded() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #9 0x64189dbd2c9e in content::RenderFrameHostImpl::PendingDeletionCheckCompleted() content/browser/renderer_host/render_frame_host_impl.cc:12625:7
    #10 0x64189dbe6f33 in content::RenderFrameHostImpl::PendingDeletionCheckCompletedOnSubtree() content/browser/renderer_host/render_frame_host_impl.cc:12641:5
    #11 0x64189dbf77ae in content::RenderFrameHostImpl::Unload(content::RenderFrameProxyHost*, bool) content/browser/renderer_host/render_frame_host_impl.cc:6816:3
    #12 0x64189dd2226e in content::RenderFrameHostManager::UnloadOldFrame(std::__Cr::unique_ptr<content::RenderFrameHostImpl, std::__Cr::default_delete<content::RenderFrameHostImpl>>, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1525:23
    #13 0x64189dd1ba90 in content::RenderFrameHostManager::CommitPending(std::__Cr::unique_ptr<content::RenderFrameHostImpl, std::__Cr::default_delete<content::RenderFrameHostImpl>>, std::__Cr::unique_ptr<content::StoredPage, std::__Cr::default_delete<content::StoredPage>>, bool, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:5554:3
    #14 0x64189dd18a39 in content::RenderFrameHostManager::CommitPendingIfNecessary(content::RenderFrameHostImpl*, bool, bool, bool, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1093:5
    #15 0x64189dd182fc in content::RenderFrameHostManager::DidNavigateFrame(content::RenderFrameHostImpl*, bool, bool, bool, blink::FramePolicy const&, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1038:3
    #16 0x64189db61e03 in content::Navigator::DidNavigate(content::RenderFrameHostImpl*, content::mojom::DidCommitProvisionalLoadParams const&, std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, bool, bool) content/browser/renderer_host/navigator.cc:595:38
    #17 0x64189dbf2429 in content::RenderFrameHostImpl::DidCommitNavigationInternal(std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitSameDocumentNavigationParams>, base::TimeTicks const&) content/browser/renderer_host/render_frame_host_impl.cc:16460:58
    #18 0x64189dbed577 in content::RenderFrameHostImpl::DidCommitNavigation(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>) content/browser/renderer_host/render_frame_host_impl.cc:17355:8
    #19 0x64189dcc90cf in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, void, 0ul, 1ul>::MakeItSo<void (content::RenderFrameHostImpl::*)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), std::__Cr::tuple<base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>>(void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), std::__Cr::tuple<base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>&&) base/functional/bind_internal.h:740:12
    #20 0x64189dcc8e10 in base::internal::Invoker<base::internal::FunctorTraits<void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, base::internal::BindState<true, true, false, void (content::RenderFrameHostImpl::*)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>)>::RunOnce(base::internal::BindStateBase*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>&&) base/functional/bind_internal.h:1069:14
    #21 0x64189658efee in content::mojom::NavigationClient_CommitNavigation_ForwardToCallback::Accept(mojo::Message*) base/functional/callback.h:155:12
    #22 0x6418a8b104fb in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1079:41
    #23 0x6418a8b2db11 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #24 0x6418a8b16163 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #25 0x6418aca95f1d in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #26 0x6418aca98391 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #27 0x6418a8d54543 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #28 0x6418a8dc5abc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #29 0x6418a8dc495a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #30 0x6418a8f73ea8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #31 0x6418a8f77468 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #32 0x7a9ea6507584  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d584) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #33 0x7a9ea6566976  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xbc976) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #34 0x7a9ea6506a22 in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ca22) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3)
    #35 0x6418a8f744c3 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:770:30
    #36 0x6418a8dc71a4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #37 0x6418a8cce880 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #38 0x64189c60550c in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18
    #39 0x64189c60dbec in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:151:15
    #40 0x64189c5fbe7c in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28
    #41 0x6418a4c5245f in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:696:10
    #42 0x6418a4c56460 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1320:10
    #43 0x6418a4c558ea in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1150:12
    #44 0x6418a4c4f271 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #45 0x6418a4c4f86c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #46 0x6418909582a9 in ChromeMain chrome/app/chrome_main.cc:194:12
    #47 0x7a9ea502a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #48 0x7a9ea502a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #49 0x64189087d029 in _start (/home/gevakun/chromium-asan/chrome+0x11020029) (BuildId: 7a81d95d11a57919)

0x788ea36d2568 is located 3304 bytes inside of 3376-byte region [0x788ea36d1880,0x788ea36d25b0)
freed by thread T0 (chrome) here:
    #0 0x641890956ddd in operator delete(void*) (/home/gevakun/chromium-asan/chrome+0x110f9ddd) (BuildId: 7a81d95d11a57919)
    #1 0x6418a4b253b7 in OmniboxController::~OmniboxController() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x6418a4b254f3 in OmniboxController::~OmniboxController() chrome/browser/ui/omnibox/omnibox_controller.cc:71:39
    #3 0x6418a49e6129 in LocationBarView::~LocationBarView() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #4 0x6418a49e69bd in non-virtual thunk to LocationBarView::~LocationBarView() chrome/browser/ui/views/location_bar/location_bar_view.cc:284:37
    #5 0x6418b0ed2a2b in views::View::~View() ui/views/view.cc:285:9
    #6 0x6418a565d703 in ToolbarView::~ToolbarView() chrome/browser/ui/views/toolbar/toolbar_view.cc:290:29
    #7 0x6418b0ed2a2b in views::View::~View() ui/views/view.cc:285:9
    #8 0x6418c22520b0 in TopContainerView::~TopContainerView() chrome/browser/ui/views/frame/top_container_view.cc:36:37
    #9 0x6418b0ed7504 in views::View::DoRemoveChildView(views::View*, bool, bool, views::View*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #10 0x6418b0ed780d in views::View::RemoveAllChildViews() ui/views/view.cc:358:5
    #11 0x6418c20a5d82 in BrowserView::~BrowserView() chrome/browser/ui/views/frame/browser_view.cc:1163:3
    #12 0x6418c20a7ded in non-virtual thunk to BrowserView::~BrowserView() chrome/browser/ui/views/frame/browser_view.cc:1108:29
    #13 0x6418b0ed2a2b in views::View::~View() ui/views/view.cc:285:9
    #14 0x6418c2c05b09 in BrowserFrameViewLinuxNative::~BrowserFrameViewLinuxNative() chrome/browser/ui/views/frame/browser_frame_view_linux_native.cc:51:59
    #15 0x6418b0f9d62a in views::NonClientView::~NonClientView() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #16 0x6418b0f9d7e3 in views::NonClientView::~NonClientView() ui/views/window/non_client_view.cc:36:33
    #17 0x6418b0ed7504 in views::View::DoRemoveChildView(views::View*, bool, bool, views::View*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #18 0x6418b0ed780d in views::View::RemoveAllChildViews() ui/views/view.cc:358:5
    #19 0x6418b0f376c3 in views::Widget::~Widget() ui/views/widget/widget.cc:2597:15
    #20 0x6418c216a47d in BrowserWidget::~BrowserWidget() chrome/browser/ui/views/frame/browser_widget.cc:150:1
    #21 0x6418c216a6f3 in BrowserWidget::~BrowserWidget() chrome/browser/ui/views/frame/browser_widget.cc:131:33
    #22 0x6418c20cbc5d in BrowserView::DeleteBrowserWindow() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #23 0x6418c16b6e46 in Browser::~Browser() gen/third_party/libc++/src/include/__memory/unique_ptr.h:288:7
    #24 0x6418c16b887a in non-virtual thunk to Browser::~Browser() chrome/browser/ui/browser.cc:682:21
    #25 0x6418c17466d5 in BrowserManagerService::DeleteBrowser(Browser*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #26 0x6418c16d7800 in base::internal::Invoker<base::internal::FunctorTraits<void (Browser::*&&)(), base::WeakPtr<Browser>&&>, base::internal::BindState<true, true, false, void (Browser::*)(), base::WeakPtr<Browser>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #27 0x6418a8d54543 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #28 0x6418a8dc5abc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #29 0x6418a8dc495a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40

previously allocated by thread T0 (chrome) here:
    #0 0x64189095659d in operator new(unsigned long) (/home/gevakun/chromium-asan/chrome+0x110f959d) (BuildId: 7a81d95d11a57919)
    #1 0x6418a4b24e72 in OmniboxController::OmniboxController(std::__Cr::unique_ptr<OmniboxClient, std::__Cr::default_delete<OmniboxClient>>, std::__Cr::optional<base::TimeDelta>) chrome/browser/ui/omnibox/omnibox_edit_model.h:44:3
    #2 0x6418a49e77fd in LocationBarView::Init() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:30
    #3 0x6418a56623f5 in ToolbarView::Init() chrome/browser/ui/views/toolbar/toolbar_view.cc:631:25
    #4 0x6418c20d1700 in BrowserView::AddedToWidget() chrome/browser/ui/views/frame/browser_view.cc:5121:13
    #5 0x6418b0f02a26 in views::View::PropagateAddNotifications(views::ViewHierarchyChangedDetails const&, bool) ui/views/view.cc:3403:5
    #6 0x6418b0f00bed in views::View::AddChildViewAtImpl(views::View*, unsigned long) ui/views/view.cc:3272:9
    #7 0x6418b0f9eceb in views::NonClientView::ViewHierarchyChanged(views::ViewHierarchyChangedDetails const&) ui/views/window/non_client_view.cc:181:18
    #8 0x6418b0f02972 in views::View::PropagateAddNotifications(views::ViewHierarchyChangedDetails const&, bool) ui/views/view.cc:3421:3
    #9 0x6418b0f00bed in views::View::AddChildViewAtImpl(views::View*, unsigned long) ui/views/view.cc:3272:9
    #10 0x6418b0f35e0c in views::Widget::Init(views::Widget::InitParams) ui/views/widget/widget.cc:578:17
    #11 0x6418c216afef in BrowserWidget::InitBrowserWidget() chrome/browser/ui/views/frame/browser_widget.cc:210:3
    #12 0x6418c2195b39 in BrowserWindow::CreateBrowserWindow(Browser*, bool, bool) chrome/browser/ui/views/frame/browser_window_factory.cc:60:27
    #13 0x6418c16b6073 in Browser::Browser(Browser::CreateParams const&) chrome/browser/ui/browser.cc:660:13
    #14 0x6418c16b4a2f in Browser::Create(Browser::CreateParams const&) chrome/browser/ui/browser.cc:557:59
    #15 0x6418a4c33990 in StartupBrowserCreatorImpl::OpenTabsInBrowser(Browser*, chrome::startup::IsProcessStartup, std::__Cr::vector<StartupTab, std::__Cr::allocator<StartupTab>> const&, StartupBrowserCreatorImpl::TabOverWrite) chrome/browser/ui/startup/startup_browser_creator_impl.cc:328:15
    #16 0x6418a4c363d3 in StartupBrowserCreatorImpl::RestoreOrCreateBrowser(std::__Cr::vector<StartupTab, std::__Cr::allocator<StartupTab>> const&, StartupBrowserCreatorImpl::BrowserOpenBehavior, unsigned int, chrome::startup::IsProcessStartup, bool) chrome/browser/ui/startup/startup_browser_creator_impl.cc:718:13
    #17 0x6418a4c32aa7 in StartupBrowserCreatorImpl::DetermineURLsAndLaunch(chrome::startup::IsProcessStartup, bool) chrome/browser/ui/startup/startup_browser_creator_impl.cc:539:22
    #18 0x6418a4c31905 in StartupBrowserCreatorImpl::Launch(Profile*, chrome::startup::IsProcessStartup, bool) chrome/browser/ui/startup/startup_browser_creator_impl.cc:258:3
    #19 0x6418a4c2ad94 in StartupBrowserCreator::LaunchBrowser(base::CommandLine const&, Profile*, base::FilePath const&, chrome::startup::IsProcessStartup, chrome::startup::IsFirstRun, bool) chrome/browser/ui/startup/startup_browser_creator.cc:727:9
    #20 0x6418a4c2c791 in StartupBrowserCreator::ProcessLastOpenedProfiles(base::CommandLine const&, base::FilePath const&, chrome::startup::IsProcessStartup, chrome::startup::IsFirstRun, Profile*, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&) chrome/browser/ui/startup/startup_browser_creator.cc:1393:5
    #21 0x6418a4c2b95b in StartupBrowserCreator::LaunchBrowserForLastProfiles(base::CommandLine const&, base::FilePath const&, chrome::startup::IsProcessStartup, chrome::startup::IsFirstRun, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&, bool) chrome/browser/ui/startup/startup_browser_creator.cc:838:3
    #22 0x6418a4c2a70a in StartupBrowserCreator::ProcessCmdLineImpl(base::CommandLine const&, base::FilePath const&, chrome::startup::IsProcessStartup, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&) chrome/browser/ui/startup/startup_browser_creator.cc
    #23 0x6418a4c28b1e in StartupBrowserCreator::Start(base::CommandLine const&, base::FilePath const&, StartupProfileInfo, std::__Cr::vector<Profile*, std::__Cr::allocator<Profile*>> const&) chrome/browser/ui/startup/startup_browser_creator.cc:681:10
    #24 0x6418a8207312 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:2064:25
    #25 0x6418a820598c in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1463:18
    #26 0x64189c6028dc in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1003:28
    #27 0x64189c609ee1 in base::internal::Invoker<base::internal::FunctorTraits<int (content::BrowserMainLoop::*&&)(), content::BrowserMainLoop*>, base::internal::BindState<true, true, false, int (content::BrowserMainLoop::*)(), base::internal::UnretainedWrapper<content::BrowserMainLoop, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #28 0x64189e34f5fd in content::StartupTaskRunner::RunAllTasksNow(bool) base/functional/callback.h:155:12
    #29 0x64189c601715 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:909:25

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__vector/vector.h:349:57 in base::ObserverList<OmniboxEditModel::Observer, false, (base::ObserverListReentrancyPolicy)0, base::internal::CheckedObserverAdapter>::RemoveObserver(OmniboxEditModel::Observer const*)
Shadow bytes around the buggy address:
  0x788ea36d2280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x788ea36d2300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x788ea36d2380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x788ea36d2400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x788ea36d2480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x788ea36d2500: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
  0x788ea36d2580: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa
  0x788ea36d2600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x788ea36d2680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x788ea36d2700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x788ea36d2780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2236494==ADDITIONAL INFO

==2236494==Note: Please include this section with the ASan report.
Task trace:
    #0 0x6418aca8f51b in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13
    #1 0x6418a9a5e563 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13


Command line: `./chrome --no-sandbox --enable-features=WebUIOmniboxPopup --flag-switches-begin --test-third-party-cookie-phaseout --enable-features=WebUIOmniboxPopup,AIPromptAPI,AIPromptAPIMultimodalInput,AIProofreadingAPI,AIRewriterAPI,AIWriterAPI,AllowAllSitesToInitiateMirroring,HttpsFirstDialogUi,PrerenderUntilScript,RecordWebAppDebugInfo --flag-switches-end --ozone-platform=x11 --origin-trial-disabled-features=CanvasTextNg|WebAssemblyCustomDescriptors --file-url-path-alias=/gen=/home/gevakun/chromium-asan/gen`


MiraclePtr Status: MANUAL ANALYSIS REQUIRED
A pointer to the same region was extracted from a raw_ptr<T> object prior to this crash.
To determine the protection status, enable extraction warnings and check whether the raw_ptr<T> object can be destroyed or overwritten between the extraction and use.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==2236494==END OF ADDITIONAL INFO

==2236494==ABORTING