Note: Google Test filter = CPDFXFAPageEmbedderTest.DrawFocusAnnotUseAfterFree [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from CPDFXFAPageEmbedderTest [ RUN ] CPDFXFAPageEmbedderTest.DrawFocusAnnotUseAfterFree ================================================================= ==2672==ERROR: AddressSanitizer: heap-use-after-free on address 0x7bcc370320a0 at pc 0x55a1a71fee33 bp 0x7ffe13d0ae10 sp 0x7ffe13d0ae08 READ of size 8 at 0x7bcc370320a0 thread T0 #0 0x55a1a71fee32 in CPDFXFA_Page::DrawFocusAnnot(CFX_RenderDevice*, CPDFSDK_Annot*, CFX_Matrix const&, FX_RECT const&) third_party/pdfium/fpdfsdk/cpdfsdk_annot.h:139:27 #1 0x55a1a141af74 in CPDFSDK_PageView::PageView_OnDraw(CFX_RenderDevice*, CFX_Matrix const&, CPDF_RenderOptions*, FX_RECT const&) third_party/pdfium/fpdfsdk/cpdfsdk_pageview.cpp:84:40 #2 0x55a1a146e91c in (anonymous namespace)::FFLCommon(fpdf_form_handle_t__*, fpdf_page_t__*, std::__Cr::variant, int, int, int, int, int, int) third_party/pdfium/fpdfsdk/fpdf_formfill.cpp:264:18 #3 0x55a1a146e31b in FPDF_FFLDraw third_party/pdfium/fpdfsdk/fpdf_formfill.cpp:770:3 #4 0x55a1a0659c1b in EmbedderTest::RenderPageWithFlags(fpdf_page_t__*, fpdf_form_handle_t__*, int) third_party/pdfium/testing/embedder_test.cpp:903:3 #5 0x55a1a057b3fe in CPDFXFAPageEmbedderTest_DrawFocusAnnotUseAfterFree_Test::TestBody() third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_page_embeddertest.cpp:98:29 #6 0x55a1a7232d5b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x55a1a7234f57 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #8 0x55a1a7236ec3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #9 0x55a1a7266b2a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #10 0x55a1a726558e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #11 0x55a19fd338c8 in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #12 0x7f6c37ca0249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7bcc370320a0 is located 0 bytes inside of 64-byte region [0x7bcc370320a0,0x7bcc370320e0) freed by thread T0 here: #0 0x55a19fd33002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/pdfium_embeddertests+0x2bac002) (BuildId: e3fc23e3ad52f01d) #1 0x55a1a141c20f in CPDFSDK_PageView::DeleteAnnotForFFWidget(CXFA_FFWidget*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x55a1a71f802b in CPDFXFA_DocEnvironment::WidgetPreRemove(CXFA_FFWidget*) third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_docenvironment.cpp:395:17 #3 0x55a1a6f9af59 in CXFA_FFNotify::OnLayoutItemRemoving(CXFA_LayoutProcessor*, CXFA_LayoutItem*) third_party/pdfium/xfa/fxfa/cxfa_ffnotify.cpp:570:9 #4 0x55a1a7108568 in (anonymous namespace)::SyncRemoveLayoutItem(CXFA_LayoutItem*, CXFA_FFNotify*, CXFA_LayoutProcessor*) third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp:261:12 #5 0x55a1a710851d in (anonymous namespace)::SyncRemoveLayoutItem(CXFA_LayoutItem*, CXFA_FFNotify*, CXFA_LayoutProcessor*) third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp:258:5 #6 0x55a1a710824b in CXFA_ViewLayoutProcessor::SaveLayoutItemChildren(CXFA_LayoutItem*) third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp:1739:9 #7 0x55a1a7108271 in CXFA_ViewLayoutProcessor::SaveLayoutItemChildren(CXFA_LayoutItem*) third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp:1747:5 #8 0x55a1a7108271 in CXFA_ViewLayoutProcessor::SaveLayoutItemChildren(CXFA_LayoutItem*) third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp:1747:5 #9 0x55a1a7108271 in CXFA_ViewLayoutProcessor::SaveLayoutItemChildren(CXFA_LayoutItem*) third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp:1747:5 #10 0x55a1a70fbcd3 in CXFA_ViewLayoutProcessor::PrepareLayout() third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp:2068:5 #11 0x55a1a70fa902 in CXFA_ViewLayoutProcessor::InitLayoutPage(CXFA_Node*) third_party/pdfium/xfa/fxfa/layout/cxfa_viewlayoutprocessor.cpp:391:3 #12 0x55a1a70f8035 in CXFA_LayoutProcessor::RestartLayout() third_party/pdfium/xfa/fxfa/layout/cxfa_layoutprocessor.cpp:67:32 #13 0x55a1a6f827a8 in CXFA_FFDocView::RunLayout() third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp:543:53 #14 0x55a1a6f7ebe8 in CXFA_FFDocView::UpdateDocView() third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp:243:7 #15 0x55a1a6f7e907 in CXFA_FFDocView::UpdateScope::~UpdateScope() third_party/pdfium/xfa/fxfa/cxfa_ffdocview.cpp:89:14 #16 0x55a1a6f99498 in CXFA_FFNotify::OpenDropDownList(CXFA_Node*) third_party/pdfium/xfa/fxfa/cxfa_ffnotify.cpp:310:1 #17 0x55a1a1aedb91 in CJX_HostPseudoModel::openList(CFXJSE_Engine*, pdfium::span, 18446744073709551615ul, v8::Local*>) third_party/pdfium/fxjs/xfa/cjx_hostpseudomodel.cpp:329:14 #18 0x55a1a1aeb912 in CJX_HostPseudoModel::openList_static(CJX_Object*, CFXJSE_Engine*, pdfium::span, 18446744073709551615ul, v8::Local*>) third_party/pdfium/fxjs/xfa/cjx_hostpseudomodel.h:32:14 #19 0x55a1a1afdf40 in CJX_Object::RunMethod(CFXJSE_Engine*, fxcrt::WideString const&, pdfium::span, 18446744073709551615ul, v8::Local*>) third_party/pdfium/fxjs/xfa/cjx_object.cpp:179:10 #20 0x55a1a1a8d171 in CFXJSE_Engine::NormalMethodCall(v8::FunctionCallbackInfo const&, fxcrt::WideString const&) third_party/pdfium/fxjs/xfa/cfxjse_engine.cpp:574:31 #21 0x55a1a1a88880 in (anonymous namespace)::DynPropGetterAdapter_MethodCallback(v8::FunctionCallbackInfo const&) third_party/pdfium/fxjs/xfa/cfxjse_class.cpp:127:7 #22 0x55a1a6cb16e3 in Builtins_CallApiCallbackGeneric setup-isolate-deserialize.cc #23 0x55a1a6caf902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc #24 0x55a1a6caf902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc #25 0x55a1a6cac69b in Builtins_JSEntryTrampoline setup-isolate-deserialize.cc #26 0x55a1a6cac3ea in Builtins_JSEntry setup-isolate-deserialize.cc #27 0x55a1a1f6553d in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12 #28 0x55a1a1f63bb2 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>) v8/src/execution/execution.cc:564:10 #29 0x55a1a1b46619 in v8::Function::Call(v8::Isolate*, v8::Local, v8::Local, int, v8::Local*) v8/src/api/api.cc:5603:27 previously allocated by thread T0 here: #0 0x55a19fd323fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/pdfium_embeddertests+0x2bab3fd) (BuildId: e3fc23e3ad52f01d) #1 0x55a1a1420c79 in CPDFSDK_PageView::LoadFXAnnots() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x55a1a14020ca in CPDFSDK_FormFillEnvironment::GetOrCreatePageView(IPDF_Page*) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:668:14 #3 0x55a1a146ed08 in FORM_OnAfterLoadPage third_party/pdfium/fpdfsdk/fpdf_formfill.cpp:179:39 #4 0x55a1a06591c3 in EmbedderTest::LoadPageCommon(int, bool) third_party/pdfium/testing/embedder_test.cpp:835:5 #5 0x55a1a0658f34 in EmbedderTest::LoadScopedPage(int) third_party/pdfium/testing/embedder_test.cpp:817:10 #6 0x55a1a0579ef0 in CPDFXFAPageEmbedderTest_DrawFocusAnnotUseAfterFree_Test::TestBody() third_party/pdfium/fpdfsdk/fpdfxfa/cpdfxfa_page_embeddertest.cpp:62:21 #7 0x55a1a7232d5b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x55a1a7234f57 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #9 0x55a1a7236ec3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #10 0x55a1a7266b2a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #11 0x55a1a726558e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #12 0x55a19fd338c8 in main third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #13 0x7f6c37ca0249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free third_party/pdfium/fpdfsdk/cpdfsdk_annot.h:139:27 in CPDFXFA_Page::DrawFocusAnnot(CFX_RenderDevice*, CPDFSDK_Annot*, CFX_Matrix const&, FX_RECT const&) Shadow bytes around the buggy address: 0x7bcc37031e00: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 0x7bcc37031e80: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 00 0x7bcc37031f00: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa 0x7bcc37031f80: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd fd 0x7bcc37032000: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd =>0x7bcc37032080: fa fa fa fa[fd]fd fd fd fd fd fd fd fa fa fa fa 0x7bcc37032100: 00 00 00 00 fc fc fc fc fa fa fa fa fd fd fd fd 0x7bcc37032180: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 fa 0x7bcc37032200: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa 0x7bcc37032280: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd 0x7bcc37032300: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2672==ABORTING