Note: Google Test filter = CFWLCaretTimerUAFTest.TimerFiresOnSweptOuter
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from CFWLCaretTimerUAFTest
[ RUN      ] CFWLCaretTimerUAFTest.TimerFiresOnSweptOuter
=================================================================
==1287==ERROR: AddressSanitizer: use-after-poison on address 0x7b9c02040890 at pc 0x55b2902f9e84 bp 0x7ffc9e720e20 sp 0x7ffc9e720e18
READ of size 4 at 0x7b9c02040890 thread T0
    #0 0x55b2902f9e83 in pdfium::CFWL_WidgetMgr::RepaintWidget(pdfium::CFWL_Widget*, CFX_RectF const&) v8/include/cppgc/internal/member-storage.h:92:58
    #1 0x55b2902b9be8 in non-virtual thunk to pdfium::CFWL_Caret::OnTimerFired() third_party/pdfium/xfa/fwl/cfwl_caret.cpp:91:3
    #2 0x55b28983845b in pdfium::CFWLCaretTimerUAFTest_TimerFiresOnSweptOuter_Test::TestBody() third_party/pdfium/xfa/fwl/cfwl_caret_timer_uaf_unittest.cpp:52:7
    #3 0x55b29046101b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #4 0x55b290463cc7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #5 0x55b290465c33 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #6 0x55b29049589a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #7 0x55b2904942fe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x55b288e158d9 in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73
    #9 0x7fad3ea71249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Address 0x7b9c02040890 is a wild pointer inside of access range of size 0x000000000004.
SUMMARY: AddressSanitizer: use-after-poison v8/include/cppgc/internal/member-storage.h:92:58 in pdfium::CFWL_WidgetMgr::RepaintWidget(pdfium::CFWL_Widget*, CFX_RectF const&)
Shadow bytes around the buggy address:
  0x7b9c02040600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b9c02040680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b9c02040700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b9c02040780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b9c02040800: 00 00 00 00 00 00 00 00 00 00 00 f7 f7 f7 f7 f7
=>0x7b9c02040880: f7 f7[f7]f7 f7 00 00 00 00 00 00 00 00 00 00 00
  0x7b9c02040900: 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7b9c02040980: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7b9c02040a00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7b9c02040a80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7b9c02040b00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

NOTE: the stack trace above identifies the code that *accessed* the poisoned memory.
To identify the code that *poisoned* the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=<size>.
==1287==ABORTING