=================================================================
==424011==ERROR: AddressSanitizer: use-after-poison on address 0x7edc02142c2c at pc 0x5597d335f15d bp 0x7fffdd898770 sp 0x7fffdd898768
READ of size 4 at 0x7edc02142c2c thread T0 (chrome)
    #0 0x5597d335f15c in blink::ViewTransitionSupplement::OnTransitionCaptured(blink::ViewTransition*) v8/include/cppgc/member.h:59:55
    #1 0x5597d32ea927 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::ViewTransition::*&&)(std::__Cr::unordered_map<viz::ViewTransitionElementResourceId, gfx::RectF, std::__Cr::hash<viz::ViewTransitionElementResourceId>, std::__Cr::equal_to<viz::ViewTransitionElementResourceId>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId const, gfx::RectF>>> const&), blink::ViewTransition*>, base::internal::BindState<true, true, false, void (blink::ViewTransition::*)(std::__Cr::unordered_map<viz::ViewTransitionElementResourceId, gfx::RectF, std::__Cr::hash<viz::ViewTransitionElementResourceId>, std::__Cr::equal_to<viz::ViewTransitionElementResourceId>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId const, gfx::RectF>>> const&), blink::internal::BasicUnwrappingCrossThreadHandle<blink::ViewTransition, blink::internal::WeakCrossThreadHandleWeaknessPolicy>>, void (std::__Cr::unordered_map<viz::ViewTransitionElementResourceId, gfx::RectF, std::__Cr::hash<viz::ViewTransitionElementResourceId>, std::__Cr::equal_to<viz::ViewTransitionElementResourceId>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId const, gfx::RectF>>> const&)>::RunOnce(base::internal::BindStateBase*, std::__Cr::unordered_map<viz::ViewTransitionElementResourceId, gfx::RectF, std::__Cr::hash<viz::ViewTransitionElementResourceId>, std::__Cr::equal_to<viz::ViewTransitionElementResourceId>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId const, gfx::RectF>>> const&) base/functional/bind_internal.h:740:12
    #2 0x5597cbaa0366 in base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (std::__Cr::unordered_map<viz::ViewTransitionElementResourceId, gfx::RectF, std::__Cr::hash<viz::ViewTransitionElementResourceId>, std::__Cr::equal_to<viz::ViewTransitionElementResourceId>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId const, gfx::RectF>>> const&)>&&, std::__Cr::unordered_map<viz::ViewTransitionElementResourceId, gfx::RectF, std::__Cr::hash<viz::ViewTransitionElementResourceId>, std::__Cr::equal_to<viz::ViewTransitionElementResourceId>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId const, gfx::RectF>>>&&>, base::internal::BindState<false, true, true, base::OnceCallback<void (std::__Cr::unordered_map<viz::ViewTransitionElementResourceId, gfx::RectF, std::__Cr::hash<viz::ViewTransitionElementResourceId>, std::__Cr::equal_to<viz::ViewTransitionElementResourceId>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId const, gfx::RectF>>> const&)>, std::__Cr::unordered_map<viz::ViewTransitionElementResourceId, gfx::RectF, std::__Cr::hash<viz::ViewTransitionElementResourceId>, std::__Cr::equal_to<viz::ViewTransitionElementResourceId>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId const, gfx::RectF>>>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/callback.h:155:12
    #3 0x5597c5d38c83 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #4 0x5597c5da82dc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #5 0x5597c5da717a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #6 0x5597c5bf74b2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #7 0x5597c5da99c4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #8 0x5597c5cb3280 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #9 0x5597d253dba4 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16
    #10 0x5597c26d6083 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #11 0x5597c26d738b in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #12 0x5597c26da2c1 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #13 0x5597c26d3a9b in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #14 0x5597c26d408c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #15 0x5597ad84c02b in ChromeMain chrome/app/chrome_main.cc:221:12
    #16 0x7614b9c2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #17 0x7614b9c2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #18 0x5597ad76e029 in _start (/home/tranquac/chromium/src/out/chrome-asan/chrome+0x10e94029) (BuildId: 93567e3ccc55e15b)

Address 0x7edc02142c2c is a wild pointer inside of access range of size 0x000000000004.
SUMMARY: AddressSanitizer: use-after-poison v8/include/cppgc/member.h:59:55 in blink::ViewTransitionSupplement::OnTransitionCaptured(blink::ViewTransition*)
Shadow bytes around the buggy address:
  0x7edc02142980: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7edc02142a00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7edc02142a80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7edc02142b00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7edc02142b80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x7edc02142c00: f7 f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7edc02142c80: f7 f7 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7edc02142d00: 00 00 00 00 00 00 00 00 00 00 00 04 fc fc fc fc
  0x7edc02142d80: fc f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7edc02142e00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x7edc02142e80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

NOTE: the stack trace above identifies the code that *accessed* the poisoned memory.
To identify the code that *poisoned* the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=<size>.

==424011==ADDITIONAL INFO

==424011==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5597cba85b80 in cc::LayerTreeHost::NotifyTransitionRequestsFinished(unsigned int, std::__Cr::unordered_map<viz::ViewTransitionElementResourceId, gfx::RectF, std::__Cr::hash<viz::ViewTransitionElementResourceId>, std::__Cr::equal_to<viz::ViewTransitionElementResourceId>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId const, gfx::RectF>>> const&) cc/trees/layer_tree_host.cc:605:7
    #1 0x5597cbdbe3d5 in cc::ProxyImpl::NotifyTransitionRequestFinished(unsigned int, std::__Cr::unordered_map<viz::ViewTransitionElementResourceId, gfx::RectF, std::__Cr::hash<viz::ViewTransitionElementResourceId>, std::__Cr::equal_to<viz::ViewTransitionElementResourceId>, std::__Cr::allocator<std::__Cr::pair<viz::ViewTransitionElementResourceId const, gfx::RectF>>> const&) cc/trees/proxy_impl.cc:648:7
    #2 0x5597cbddb90e in cc::Scheduler::ScheduleBeginImplFrameDeadline() cc/scheduler/scheduler.cc:878:9
    #3 0x5597cba01341 in cc::UniqueNotifier::Schedule() cc/base/unique_notifier.cc:37:7


Command line: `/proc/self/exe --type=renderer --gpu-client-id=6 --crashpad-handler-pid=423836 --enable-crash-reporter=, --user-data-dir=/tmp/vt_run_final --change-stack-guard-on-fork=enable --no-sandbox --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1779861277787244 --gpu-channel-request-start-time-ticks=31754510282 --launch-time-ticks=31754527926 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,15512022713338239068,12856611572686716307,2097152 --field-trial-handle=3,i,8394943616608094781,3418293475105948233,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,8451961727551539416,11300624953453389852,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=stderr`


==424011==END OF ADDITIONAL INFO

==424011==ABORTING