Note: Google Test filter = CFFLCheckBoxOnCharUAFTest.*
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from CFFLCheckBoxOnCharUAFTest
[ RUN      ] CFFLCheckBoxOnCharUAFTest.ReentrantPageCloseDuringButtonUp
=================================================================
==1906==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c8aea9e1308 at pc 0x558d3e5079bb bp 0x7ffd1fd37a90 sp 0x7ffd1fd37a88
READ of size 8 at 0x7c8aea9e1308 thread T0
    #0 0x558d3e5079ba in CFFL_CheckBox::OnChar(CPDFSDK_Widget*, unsigned int, fxcrt::Mask<FWL_EVENTFLAG>) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:547:29
    #1 0x558d38a2cd0e in CPDFSDK_PageView::OnChar(unsigned int, fxcrt::Mask<FWL_EVENTFLAG>) third_party/pdfium/fpdfsdk/cpdfsdk_pageview.cpp:530:20
    #2 0x558d38a79cdc in FORM_OnChar third_party/pdfium/fpdfsdk/fpdf_formfill.cpp:562:21
    #3 0x558d37805120 in CFFLCheckBoxOnCharUAFTest_ReentrantPageCloseDuringButtonUp_Test::TestBody() third_party/pdfium/fpdfsdk/fpdf_formfill_embeddertest.cpp:3730:3
    #4 0x558d3e83ed5b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #5 0x558d3e840f57 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #6 0x558d3e842ec3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #7 0x558d3e872b2a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #8 0x558d3e87158e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #9 0x558d373428c8 in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73
    #10 0x7fdaeba2d249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7c8aea9e1308 is located 56 bytes inside of 104-byte region [0x7c8aea9e12d0,0x7c8aea9e1338)
freed by thread T0 here:
    #0 0x558d37342002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/pdfium_embeddertests+0x2bab002) (BuildId: 67f8b9015e16e091)
    #1 0x558d3e513627 in CFFL_InteractiveFormFiller::UnregisterFormField(CPDFSDK_Widget*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x558d38a306b3 in CPDFSDK_Widget::~CPDFSDK_Widget() third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp:53:31
    #3 0x558d38a308c3 in CPDFSDK_Widget::~CPDFSDK_Widget() third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp:52:35
    #4 0x558d38a2714f in CPDFSDK_PageView::~CPDFSDK_PageView() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #5 0x558d38a1a2f5 in std::__Cr::__tree<std::__Cr::__value_type<IPDF_Page*, std::__Cr::unique_ptr<CPDFSDK_PageView, std::__Cr::default_delete<CPDFSDK_PageView>>>, std::__Cr::__map_value_compare<IPDF_Page*, std::__Cr::pair<IPDF_Page* const, std::__Cr::unique_ptr<CPDFSDK_PageView, std::__Cr::default_delete<CPDFSDK_PageView>>>, std::__Cr::less<IPDF_Page*>>, std::__Cr::allocator<std::__Cr::pair<IPDF_Page* const, std::__Cr::unique_ptr<CPDFSDK_PageView, std::__Cr::default_delete<CPDFSDK_PageView>>>>>::erase(std::__Cr::__tree_const_iterator<std::__Cr::__value_type<IPDF_Page*, std::__Cr::unique_ptr<CPDFSDK_PageView, std::__Cr::default_delete<CPDFSDK_PageView>>>, std::__Cr::__tree_node<std::__Cr::__value_type<IPDF_Page*, std::__Cr::unique_ptr<CPDFSDK_PageView, std::__Cr::default_delete<CPDFSDK_PageView>>>, void*>*, long>) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #6 0x558d37856743 in CFFLCheckBoxOnCharUAFTest::ClosePageDelegate::Alert(unsigned short const*, unsigned short const*, int, int) third_party/pdfium/fpdfsdk/fpdf_formfill_embeddertest.cpp:3698:9
    #7 0x558d38a0f431 in CPDFSDK_FormFillEnvironment::JS_appAlert(fxcrt::WideString const&, fxcrt::WideString const&, int, int) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:204:10
    #8 0x558d38fd6113 in CJS_App::alert(CJS_Runtime*, pdfium::span<v8::Local<v8::Value>, 18446744073709551615ul, v8::Local<v8::Value>*>) third_party/pdfium/fxjs/cjs_app.cpp:274:21
    #9 0x558d38fddec4 in void JSMethod<CJS_App, &CJS_App::alert(CJS_Runtime*, pdfium::span<v8::Local<v8::Value>, 18446744073709551615ul, v8::Local<v8::Value>*>)>(char const*, char const*, v8::FunctionCallbackInfo<v8::Value> const&) third_party/pdfium/fxjs/js_define.h:141:35
    #10 0x558d3e2bd6e3 in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc
    #11 0x558d3e2bb902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc
    #12 0x558d3e2b869b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc
    #13 0x558d3e2b83ea in Builtins_JSEntry setup-isolate-deserialize.cc
    #14 0x558d39571e4d in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12
    #15 0x558d395745f4 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) v8/src/execution/execution.cc:574:10
    #16 0x558d39135f78 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) v8/src/api/api.cc:2042:7
    #17 0x558d38fcdd6b in CFXJS_Engine::Execute(fxcrt::WideString const&) third_party/pdfium/fxjs/cfxjs_engine.cpp:611:25
    #18 0x558d390250d0 in CJS_EventContext::RunScript(fxcrt::WideString const&) third_party/pdfium/fxjs/cjs_event_context.cpp:49:21
    #19 0x558d38a19b14 in CPDFSDK_FormFillEnvironment::RunScript(fxcrt::WideString const&, std::__Cr::function<void (IJS_EventContext*)> const&) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:1279:12
    #20 0x558d38a18ddd in CPDFSDK_FormFillEnvironment::ExecuteFieldAction(CPDF_Action const&, CPDF_AAction::AActionType, CPDF_FormField*, CFFL_FieldAction*, std::__Cr::set<CPDF_Dictionary const*, std::__Cr::less<CPDF_Dictionary const*>, std::__Cr::allocator<CPDF_Dictionary const*>>*) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:1170:3
    #21 0x558d38a189e2 in CPDFSDK_FormFillEnvironment::DoActionField(CPDF_Action const&, CPDF_AAction::AActionType, CPDF_FormField*, CFFL_FieldAction*) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:984:10
    #22 0x558d38a3c51b in CPDFSDK_Widget::OnAAction(CPDF_AAction::AActionType, CFFL_FieldAction*, CPDFSDK_PageView const*) third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp:1097:19
    #23 0x558d3e515ab5 in CFFL_InteractiveFormFiller::OnButtonUp(fxcrt::ObservedPtr<CPDFSDK_Widget>&, CPDFSDK_PageView const*, fxcrt::Mask<FWL_EVENTFLAG>) third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp:278:14
    #24 0x558d3e5076f1 in CFFL_CheckBox::OnChar(CPDFSDK_Widget*, unsigned int, fxcrt::Mask<FWL_EVENTFLAG>) third_party/pdfium/fpdfsdk/formfiller/cffl_checkbox.cpp:55:25
    #25 0x558d38a2cd0e in CPDFSDK_PageView::OnChar(unsigned int, fxcrt::Mask<FWL_EVENTFLAG>) third_party/pdfium/fpdfsdk/cpdfsdk_pageview.cpp:530:20
    #26 0x558d38a79cdc in FORM_OnChar third_party/pdfium/fpdfsdk/fpdf_formfill.cpp:562:21
    #27 0x558d37805120 in CFFLCheckBoxOnCharUAFTest_ReentrantPageCloseDuringButtonUp_Test::TestBody() third_party/pdfium/fpdfsdk/fpdf_formfill_embeddertest.cpp:3730:3
    #28 0x558d3e83ed5b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #29 0x558d3e840f57 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11

previously allocated by thread T0 here:
    #0 0x558d373413fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/pdfium_embeddertests+0x2baa3fd) (BuildId: 67f8b9015e16e091)
    #1 0x558d3e513fff in CFFL_InteractiveFormFiller::GetOrCreateFormField(CPDFSDK_Widget*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x558d3e5176dd in CFFL_InteractiveFormFiller::OnSetFocus(fxcrt::ObservedPtr<CPDFSDK_Widget>&, fxcrt::Mask<FWL_EVENTFLAG>) third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp:417:36
    #3 0x558d38a39689 in CPDFSDK_Widget::OnSetFocus(fxcrt::Mask<FWL_EVENTFLAG>) third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp:874:38
    #4 0x558d38a1683a in CPDFSDK_FormFillEnvironment::SetFocusAnnot(fxcrt::ObservedPtr<CPDFSDK_Annot>&) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:822:8
    #5 0x558d38a7a9dc in FORM_SetFocusedAnnot third_party/pdfium/fpdfsdk/fpdf_formfill.cpp:749:25
    #6 0x558d378050c9 in CFFLCheckBoxOnCharUAFTest_ReentrantPageCloseDuringButtonUp_Test::TestBody() third_party/pdfium/fpdfsdk/fpdf_formfill_embeddertest.cpp:3723:17
    #7 0x558d3e83ed5b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x558d3e840f57 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #9 0x558d3e842ec3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #10 0x558d3e872b2a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #11 0x558d3e87158e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #12 0x558d373428c8 in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73
    #13 0x7fdaeba2d249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:547:29 in CFFL_CheckBox::OnChar(CPDFSDK_Widget*, unsigned int, fxcrt::Mask<FWL_EVENTFLAG>)
Shadow bytes around the buggy address:
  0x7c8aea9e1080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x7c8aea9e1100: 00 00 00 00 00 fa fa fa fa fa fa fa fa fa 00 00
  0x7c8aea9e1180: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
  0x7c8aea9e1200: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x7c8aea9e1280: fd fd fa fa fa fa fa fa fa fa fd fd fd fd fd fd
=>0x7c8aea9e1300: fd[fd]fd fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x7c8aea9e1380: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa
  0x7c8aea9e1400: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
  0x7c8aea9e1480: 00 00 00 fa fa fa fa fa fa fa fa fa 00 00 00 00
  0x7c8aea9e1500: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
  0x7c8aea9e1580: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1906==ABORTING