[http] serving http://127.0.0.1:35617/poc.html
	/var/cache/fontconfig
	/var/cache/fontconfig
	/var/cache/fontconfig
	/var/cache/fontconfig
[poll 0] ["http://127.0.0.1:35617/poc.html","READY","object"]
[ready] ["http://127.0.0.1:35617/poc.html","READY","object"]
>>> Sending Runtime.evaluate with deep serialization (maxNodeDepth=500)…
=================================================================
==905==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b820ec4fee8 at pc 0x55f1f580a86c bp 0x7ffdd797fda0 sp 0x7ffdd797fd98
READ of size 8 at 0x7b820ec4fee8 thread T0 (chrome)
    #0 0x55f1f580a86b in v8_inspector::protocol::DictionaryValue::getString(v8_inspector::String16 const&, v8_inspector::String16*) const gen/third_party/libc++/src/include/__hash_table:532:67
    #1 0x55f1f598bc45 in v8_inspector::V8SerializationDuplicateTracker::LinkExistingOrCreate(v8::Local<v8::Value>, bool*) v8/src/inspector/v8-serialization-duplicate-tracker.cc:31:32
    #2 0x55f1f59a94b0 in v8_inspector::(anonymous namespace)::ObjectMirror::buildDeepSerializedValue(v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::DictionaryValue, std::__Cr::default_delete<v8_inspector::protocol::DictionaryValue>>*) const v8/src/inspector/value-mirror.cc:1262:32
    #3 0x55f1f5938549 in v8_inspector::(anonymous namespace)::SerializeArrayValue(v8::Local<v8::Array>, v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::ListValue, std::__Cr::default_delete<v8_inspector::protocol::ListValue>>*) v8/src/inspector/v8-deep-serializer.cc:103:31
    #4 0x55f1f5935a8a in v8_inspector::V8DeepSerializer::serializeV8Value(v8::Local<v8::Object>, v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, v8_inspector::protocol::DictionaryValue&) v8/src/inspector/v8-deep-serializer.cc:124:9
    #5 0x55f1f59a9732 in v8_inspector::(anonymous namespace)::ObjectMirror::buildDeepSerializedValue(v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::DictionaryValue, std::__Cr::default_delete<v8_inspector::protocol::DictionaryValue>>*) const v8/src/inspector/value-mirror.cc:1296:12
    #6 0x55f1f5871067 in v8_inspector::InjectedScript::wrapObjectMirror(v8_inspector::ValueMirror const&, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, v8::MaybeLocal<v8::Value>, int, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*) v8/src/inspector/injected-script.cc:649:23
    #7 0x55f1f5874338 in v8_inspector::InjectedScript::wrapObject(v8::Local<v8::Value>, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*) v8/src/inspector/injected-script.cc:619:10
    #8 0x55f1f587a657 in v8_inspector::InjectedScript::wrapEvaluateResult(v8::MaybeLocal<v8::Value>, v8::TryCatch const&, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, bool, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::ExceptionDetails, std::__Cr::default_delete<v8_inspector::protocol::Runtime::ExceptionDetails>>*) v8/src/inspector/injected-script.cc:961:9
    #9 0x55f1f5972697 in v8_inspector::V8RuntimeAgentImpl::evaluate(v8_inspector::String16 const&, std::__Cr::optional<v8_inspector::String16>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<int>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<double>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<v8_inspector::String16>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::SerializationOptions, std::__Cr::default_delete<v8_inspector::protocol::Runtime::SerializationOptions>>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::Backend::EvaluateCallback, std::__Cr::default_delete<v8_inspector::protocol::Runtime::Backend::EvaluateCallback>>) v8/src/inspector/v8-runtime-agent-impl.cc:110:39
    #10 0x55f1f5855fae in v8_inspector::protocol::Runtime::DomainDispatcherImpl::evaluate(v8_crdtp::Dispatchable const&) gen/v8/src/inspector/protocol/Runtime.cpp:1032:16
    #11 0x55f1f59ca5f0 in v8_crdtp::UberDispatcher::DispatchResult::Run() gen/third_party/libc++/src/include/__functional/function.h:502:12
    #12 0x55f1f595f41f in v8_inspector::V8InspectorSessionImpl::dispatchProtocolMessage(v8_inspector::StringView) v8/src/inspector/v8-inspector-session-impl.cc:388:39
    #13 0x55f213851921 in blink::DevToolsSession::DispatchProtocolCommandImpl(int, blink::String const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) third_party/blink/renderer/core/inspector/devtools_session.cc:272:18
    #14 0x55f213851fe4 in non-virtual thunk to blink::DevToolsSession::DispatchProtocolCommand(int, blink::String const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) third_party/blink/renderer/core/inspector/devtools_session.cc:243:10
    #15 0x55f1fd22c695 in blink::mojom::blink::DevToolsSessionStubDispatch::Accept(blink::mojom::blink::DevToolsSession*, mojo::Message*) gen/third_party/blink/public/mojom/devtools/devtools_agent.mojom-blink.cc:1542:13
    #16 0x55f204e85069 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #17 0x55f204ea2ef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #18 0x55f204e8b513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #19 0x55f208dab7dd in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #20 0x55f208dadc65 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #21 0x55f2050c5326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #22 0x55f20513c9c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #23 0x55f20513b83a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #24 0x55f204f83927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #25 0x55f20513e0d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #26 0x55f20503fca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #27 0x55f2113c91fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16
    #28 0x55f200bdd6ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14
    #29 0x55f200bdea1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12
    #30 0x55f200be1728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10
    #31 0x55f200bdb101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36
    #32 0x55f200bdb6fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10
    #33 0x55f1ed110b39 in ChromeMain chrome/app/chrome_main.cc:191:12
    #34 0x7f1210a0b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)
0x7b820ec4fee8 is located 24 bytes inside of 80-byte region [0x7b820ec4fed0,0x7b820ec4ff20)
freed by thread T0 (chrome) here:
    #0 0x55f1ed110002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e09002) (BuildId: 0440b075dbd4a9a3)
    #1 0x55f1f58116bb in std::__Cr::vector<std::__Cr::unique_ptr<v8_inspector::protocol::Value, std::__Cr::default_delete<v8_inspector::protocol::Value>>, std::__Cr::allocator<std::__Cr::unique_ptr<v8_inspector::protocol::Value, std::__Cr::default_delete<v8_inspector::protocol::Value>>>>::__destroy_vector::operator()() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x55f1f580c7a9 in v8_inspector::protocol::ListValue::~ListValue() gen/third_party/libc++/src/include/__vector/vector.h:259:67
    #3 0x55f1f593880c in v8_inspector::(anonymous namespace)::SerializeArrayValue(v8::Local<v8::Array>, v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::ListValue, std::__Cr::default_delete<v8_inspector::protocol::ListValue>>*) gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #4 0x55f1f5936f68 in v8_inspector::V8DeepSerializer::serializeV8Value(v8::Local<v8::Object>, v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, v8_inspector::protocol::DictionaryValue&) v8/src/inspector/v8-deep-serializer.cc:204:25
    #5 0x55f1f59a9732 in v8_inspector::(anonymous namespace)::ObjectMirror::buildDeepSerializedValue(v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::DictionaryValue, std::__Cr::default_delete<v8_inspector::protocol::DictionaryValue>>*) const v8/src/inspector/value-mirror.cc:1296:12
    #6 0x55f1f5938549 in v8_inspector::(anonymous namespace)::SerializeArrayValue(v8::Local<v8::Array>, v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::ListValue, std::__Cr::default_delete<v8_inspector::protocol::ListValue>>*) v8/src/inspector/v8-deep-serializer.cc:103:31
    #7 0x55f1f5935a8a in v8_inspector::V8DeepSerializer::serializeV8Value(v8::Local<v8::Object>, v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, v8_inspector::protocol::DictionaryValue&) v8/src/inspector/v8-deep-serializer.cc:124:9
    #8 0x55f1f59a9732 in v8_inspector::(anonymous namespace)::ObjectMirror::buildDeepSerializedValue(v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::DictionaryValue, std::__Cr::default_delete<v8_inspector::protocol::DictionaryValue>>*) const v8/src/inspector/value-mirror.cc:1296:12
    #9 0x55f1f5871067 in v8_inspector::InjectedScript::wrapObjectMirror(v8_inspector::ValueMirror const&, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, v8::MaybeLocal<v8::Value>, int, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*) v8/src/inspector/injected-script.cc:649:23
    #10 0x55f1f5874338 in v8_inspector::InjectedScript::wrapObject(v8::Local<v8::Value>, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*) v8/src/inspector/injected-script.cc:619:10
    #11 0x55f1f587a657 in v8_inspector::InjectedScript::wrapEvaluateResult(v8::MaybeLocal<v8::Value>, v8::TryCatch const&, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, bool, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::ExceptionDetails, std::__Cr::default_delete<v8_inspector::protocol::Runtime::ExceptionDetails>>*) v8/src/inspector/injected-script.cc:961:9
    #12 0x55f1f5972697 in v8_inspector::V8RuntimeAgentImpl::evaluate(v8_inspector::String16 const&, std::__Cr::optional<v8_inspector::String16>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<int>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<double>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<v8_inspector::String16>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::SerializationOptions, std::__Cr::default_delete<v8_inspector::protocol::Runtime::SerializationOptions>>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::Backend::EvaluateCallback, std::__Cr::default_delete<v8_inspector::protocol::Runtime::Backend::EvaluateCallback>>) v8/src/inspector/v8-runtime-agent-impl.cc:110:39
    #13 0x55f1f5855fae in v8_inspector::protocol::Runtime::DomainDispatcherImpl::evaluate(v8_crdtp::Dispatchable const&) gen/v8/src/inspector/protocol/Runtime.cpp:1032:16
    #14 0x55f1f59ca5f0 in v8_crdtp::UberDispatcher::DispatchResult::Run() gen/third_party/libc++/src/include/__functional/function.h:502:12
    #15 0x55f1f595f41f in v8_inspector::V8InspectorSessionImpl::dispatchProtocolMessage(v8_inspector::StringView) v8/src/inspector/v8-inspector-session-impl.cc:388:39
    #16 0x55f213851921 in blink::DevToolsSession::DispatchProtocolCommandImpl(int, blink::String const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) third_party/blink/renderer/core/inspector/devtools_session.cc:272:18
    #17 0x55f213851fe4 in non-virtual thunk to blink::DevToolsSession::DispatchProtocolCommand(int, blink::String const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) third_party/blink/renderer/core/inspector/devtools_session.cc:243:10
    #18 0x55f1fd22c695 in blink::mojom::blink::DevToolsSessionStubDispatch::Accept(blink::mojom::blink::DevToolsSession*, mojo::Message*) gen/third_party/blink/public/mojom/devtools/devtools_agent.mojom-blink.cc:1542:13
    #19 0x55f204e85069 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #20 0x55f204ea2ef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #21 0x55f204e8b513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #22 0x55f208dab7dd in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #23 0x55f208dadc65 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #24 0x55f2050c5326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #25 0x55f20513c9c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #26 0x55f20513b83a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #27 0x55f204f83927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #28 0x55f20513e0d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #29 0x55f20503fca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
previously allocated by thread T0 (chrome) here:
    #0 0x55f1ed10f3fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e083fd) (BuildId: 0440b075dbd4a9a3)
    #1 0x55f1f598bb22 in v8_inspector::V8SerializationDuplicateTracker::LinkExistingOrCreate(v8::Local<v8::Value>, bool*) gen/v8/src/inspector/protocol/Protocol.h:160:49
    #2 0x55f1f59a94b0 in v8_inspector::(anonymous namespace)::ObjectMirror::buildDeepSerializedValue(v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::DictionaryValue, std::__Cr::default_delete<v8_inspector::protocol::DictionaryValue>>*) const v8/src/inspector/value-mirror.cc:1262:32
    #3 0x55f1f5938549 in v8_inspector::(anonymous namespace)::SerializeArrayValue(v8::Local<v8::Array>, v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::ListValue, std::__Cr::default_delete<v8_inspector::protocol::ListValue>>*) v8/src/inspector/v8-deep-serializer.cc:103:31
    #4 0x55f1f5936f68 in v8_inspector::V8DeepSerializer::serializeV8Value(v8::Local<v8::Object>, v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, v8_inspector::protocol::DictionaryValue&) v8/src/inspector/v8-deep-serializer.cc:204:25
    #5 0x55f1f59a9732 in v8_inspector::(anonymous namespace)::ObjectMirror::buildDeepSerializedValue(v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::DictionaryValue, std::__Cr::default_delete<v8_inspector::protocol::DictionaryValue>>*) const v8/src/inspector/value-mirror.cc:1296:12
    #6 0x55f1f5938549 in v8_inspector::(anonymous namespace)::SerializeArrayValue(v8::Local<v8::Array>, v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::ListValue, std::__Cr::default_delete<v8_inspector::protocol::ListValue>>*) v8/src/inspector/v8-deep-serializer.cc:103:31
    #7 0x55f1f5935a8a in v8_inspector::V8DeepSerializer::serializeV8Value(v8::Local<v8::Object>, v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, v8_inspector::protocol::DictionaryValue&) v8/src/inspector/v8-deep-serializer.cc:124:9
    #8 0x55f1f59a9732 in v8_inspector::(anonymous namespace)::ObjectMirror::buildDeepSerializedValue(v8::Local<v8::Context>, int, v8::Local<v8::Object>, v8_inspector::V8SerializationDuplicateTracker&, std::__Cr::unique_ptr<v8_inspector::protocol::DictionaryValue, std::__Cr::default_delete<v8_inspector::protocol::DictionaryValue>>*) const v8/src/inspector/value-mirror.cc:1296:12
    #9 0x55f1f5871067 in v8_inspector::InjectedScript::wrapObjectMirror(v8_inspector::ValueMirror const&, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, v8::MaybeLocal<v8::Value>, int, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*) v8/src/inspector/injected-script.cc:649:23
    #10 0x55f1f5874338 in v8_inspector::InjectedScript::wrapObject(v8::Local<v8::Value>, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*) v8/src/inspector/injected-script.cc:619:10
    #11 0x55f1f587a657 in v8_inspector::InjectedScript::wrapEvaluateResult(v8::MaybeLocal<v8::Value>, v8::TryCatch const&, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, bool, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::ExceptionDetails, std::__Cr::default_delete<v8_inspector::protocol::Runtime::ExceptionDetails>>*) v8/src/inspector/injected-script.cc:961:9
    #12 0x55f1f5972697 in v8_inspector::V8RuntimeAgentImpl::evaluate(v8_inspector::String16 const&, std::__Cr::optional<v8_inspector::String16>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<int>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<double>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<v8_inspector::String16>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::SerializationOptions, std::__Cr::default_delete<v8_inspector::protocol::Runtime::SerializationOptions>>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::Backend::EvaluateCallback, std::__Cr::default_delete<v8_inspector::protocol::Runtime::Backend::EvaluateCallback>>) v8/src/inspector/v8-runtime-agent-impl.cc:110:39
    #13 0x55f1f5855fae in v8_inspector::protocol::Runtime::DomainDispatcherImpl::evaluate(v8_crdtp::Dispatchable const&) gen/v8/src/inspector/protocol/Runtime.cpp:1032:16
    #14 0x55f1f59ca5f0 in v8_crdtp::UberDispatcher::DispatchResult::Run() gen/third_party/libc++/src/include/__functional/function.h:502:12
    #15 0x55f1f595f41f in v8_inspector::V8InspectorSessionImpl::dispatchProtocolMessage(v8_inspector::StringView) v8/src/inspector/v8-inspector-session-impl.cc:388:39
    #16 0x55f213851921 in blink::DevToolsSession::DispatchProtocolCommandImpl(int, blink::String const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) third_party/blink/renderer/core/inspector/devtools_session.cc:272:18
    #17 0x55f213851fe4 in non-virtual thunk to blink::DevToolsSession::DispatchProtocolCommand(int, blink::String const&, base::span<unsigned char const, 18446744073709551615ul, unsigned char const*>) third_party/blink/renderer/core/inspector/devtools_session.cc:243:10
    #18 0x55f1fd22c695 in blink::mojom::blink::DevToolsSessionStubDispatch::Accept(blink::mojom::blink::DevToolsSession*, mojo::Message*) gen/third_party/blink/public/mojom/devtools/devtools_agent.mojom-blink.cc:1542:13
    #19 0x55f204e85069 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #20 0x55f204ea2ef1 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #21 0x55f204e8b513 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #22 0x55f208dab7dd in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #23 0x55f208dadc65 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #24 0x55f2050c5326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #25 0x55f20513c9c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #26 0x55f20513b83a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40
    #27 0x55f204f83927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55
    #28 0x55f20513e0d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12
    #29 0x55f20503fca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__hash_table:532:67 in v8_inspector::protocol::DictionaryValue::getString(v8_inspector::String16 const&, v8_inspector::String16*) const
Shadow bytes around the buggy address:
  0x7b820ec4fc00: fd fa fa fa f7 fa fd fd fd fd fd fd fd fd fd fd
  0x7b820ec4fc80: fa fa f7 fa 00 00 00 00 00 00 00 00 00 fa fa fa
  0x7b820ec4fd00: f7 fa fd fd fd fd fd fd fd fd fd fa fa fa f7 fa
  0x7b820ec4fd80: fd fd fd fd fd fd fd fd fd fd fa fa f7 fa 00 00
  0x7b820ec4fe00: 00 00 00 00 00 00 00 00 fa fa f7 fa 00 00 00 00
=>0x7b820ec4fe80: 00 00 00 00 00 00 fa fa f7 fa fd fd fd[fd]fd fd
  0x7b820ec4ff00: fd fd fd fd fa fa f7 fa fd fd fd fd fd fd fd fd
  0x7b820ec4ff80: fd fd fa fa f7 fa fd fd fd fd fd fd fd fd fd fd
  0x7b820ec50000: fa fa f7 fa fd fd fd fd fd fd fd fd fd fa fa fa
  0x7b820ec50080: f7 fa fd fd fd fd fd fd fd fd fd fa fa fa f7 fa
  0x7b820ec50100: fd fd fd fd fd fd fd fd fd fd fa fa f7 fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==905==ADDITIONAL INFO
==905==Note: Please include this section with the ASan report.
Task trace:
    #0 0x55f208da4df7 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13
Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=830 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --remote-debugging-pipe --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1775927720986130 --launch-time-ticks=473991183183 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,14593583118221158229,814896815760958174,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,6784771862406822119,1499943019768354045,4 --trace-process-track-uuid=3190708990997080739`
MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.
==905==END OF ADDITIONAL INFO
==905==ABORTING
[cdp] error: timeout waiting for Runtime.evaluate