[.] Sanitizer coverage enabled. Counter map size: 8173140, Cmp map size: 262144
Note: Google Test filter = All/ServiceWorkerVersionTest.RemoveLiveVersionReentrantDoubleFree/FirstPartyStorageKey
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from All/ServiceWorkerVersionTest
[ RUN      ] All/ServiceWorkerVersionTest.RemoveLiveVersionReentrantDoubleFree/FirstPartyStorageKey
=================================================================
==3802==ERROR: AddressSanitizer: heap-use-after-free on address 0x75fdac066a58 at pc 0x55f4494ed22b bp 0x7ffde39e99a0 sp 0x7ffde39e9998
READ of size 8 at 0x75fdac066a58 thread T0
    #0 0x55f4494ed22a in std::__Cr::__tree<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__map_value_compare<long, std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::less<long>>, std::__Cr::allocator<std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>>>::erase(std::__Cr::__tree_const_iterator<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__tree_node<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, void*>*, long>) gen/third_party/libc++/src/include/__tree:208:12
    #1 0x55f4494cb09e in content::ServiceWorkerContextCore::RemoveLiveVersion(long) gen/third_party/libc++/src/include/map:1261:71
    #2 0x55f4496e0c97 in content::ServiceWorkerVersion::~ServiceWorkerVersion() content/browser/service_worker/service_worker_version.cc:354:15
    #3 0x55f4496e1ef3 in content::ServiceWorkerVersion::~ServiceWorkerVersion() content/browser/service_worker/service_worker_version.cc:332:47
    #4 0x55f43947e315 in content::service_worker_version_unittest::ServiceWorkerVersionTest_RemoveLiveVersionReentrantDoubleFree_Test::TestBody() base/memory/ref_counted.h:375:5
    #5 0x55f43da9542b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #6 0x55f43da984a7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #7 0x55f43da9a523 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #8 0x55f43dac96a4 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #9 0x55f43dac821a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #10 0x55f44d926570 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #11 0x55f44d3e8525 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23
    #12 0x55f44cfe7961 in base::internal::Invoker<base::internal::FunctorTraits<int (content::UnitTestTestSuite::*&&)(), content::UnitTestTestSuite*>, base::internal::BindState<true, true, false, int (content::UnitTestTestSuite::*)(), base::internal::UnretainedWrapper<content::UnitTestTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #13 0x55f44d97b23b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #14 0x55f44d97ab5b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #15 0x55f44cfe74d4 in main content/test/run_all_unittests.cc:17:10
    #16 0x79bdadc2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x75fdac066a58 is located 8 bytes inside of 48-byte region [0x75fdac066a50,0x75fdac066a80)
freed by thread T0 here:
    #0 0x55f433740012 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/content_unittests+0xf6b4012) (BuildId: 52ed249518b728f7)
    #1 0x55f4494ed1dc in std::__Cr::__tree<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__map_value_compare<long, std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::less<long>>, std::__Cr::allocator<std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>>>::erase(std::__Cr::__tree_const_iterator<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__tree_node<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, void*>*, long>) gen/third_party/libc++/src/include/__new/allocate.h:62:10
    #2 0x55f4494cb09e in content::ServiceWorkerContextCore::RemoveLiveVersion(long) gen/third_party/libc++/src/include/map:1261:71
    #3 0x55f4496e0c97 in content::ServiceWorkerVersion::~ServiceWorkerVersion() content/browser/service_worker/service_worker_version.cc:354:15
    #4 0x55f4496e1ef3 in content::ServiceWorkerVersion::~ServiceWorkerVersion() content/browser/service_worker/service_worker_version.cc:332:47
    #5 0x55f44950e8bb in content::ServiceWorkerContextWrapper::FinishedExternalRequest(long, base::Uuid const&) base/memory/ref_counted.h:375:5
    #6 0x55f4494cace1 in content::ServiceWorkerContextCore::RemoveLiveVersion(long) content/browser/service_worker/service_worker_context_core.cc:959:16
    #7 0x55f4496e0c97 in content::ServiceWorkerVersion::~ServiceWorkerVersion() content/browser/service_worker/service_worker_version.cc:354:15
    #8 0x55f4496e1ef3 in content::ServiceWorkerVersion::~ServiceWorkerVersion() content/browser/service_worker/service_worker_version.cc:332:47
    #9 0x55f43947e315 in content::service_worker_version_unittest::ServiceWorkerVersionTest_RemoveLiveVersionReentrantDoubleFree_Test::TestBody() base/memory/ref_counted.h:375:5
    #10 0x55f43da9542b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #11 0x55f43da984a7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #12 0x55f43da9a523 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #13 0x55f43dac96a4 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #14 0x55f43dac821a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #15 0x55f44d926570 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #16 0x55f44d3e8525 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23
    #17 0x55f44cfe7961 in base::internal::Invoker<base::internal::FunctorTraits<int (content::UnitTestTestSuite::*&&)(), content::UnitTestTestSuite*>, base::internal::BindState<true, true, false, int (content::UnitTestTestSuite::*)(), base::internal::UnretainedWrapper<content::UnitTestTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #18 0x55f44d97b23b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #19 0x55f44d97ab5b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #20 0x55f44cfe74d4 in main content/test/run_all_unittests.cc:17:10
    #21 0x79bdadc2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)
    #22 0x79bdadc2b304 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x27304) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)
    #23 0x55f433666029 in _start (/chromium/chromium/src/out/asan/content_unittests+0xf5da029) (BuildId: 52ed249518b728f7)

previously allocated by thread T0 here:
    #0 0x55f43373f40d in operator new(unsigned long) (/chromium/chromium/src/out/asan/content_unittests+0xf6b340d) (BuildId: 52ed249518b728f7)
    #1 0x55f4494eb11a in std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__tree_node<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, void*>*, long>, bool> std::__Cr::__try_key_extraction_impl<long, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__tree_node<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, void*>*, long>, bool>, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__tree_node<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__map_value_compare<long, std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::less<long>>, std::__Cr::allocator<std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>, std::__Cr::tuple<>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>&&, std::__Cr::tuple<>&&)::'lambda'(long const&, std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>&&, std::__Cr::tuple<>&&), std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__tree_node<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__map_value_compare<long, std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::less<long>>, std::__Cr::allocator<std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>, std::__Cr::tuple<>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>&&, std::__Cr::tuple<>&&)::'lambda'(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>&&, std::__Cr::tuple<>&&), std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>, std::__Cr::tuple<>, 0>(std::__Cr::__priority_tag<1ul>, std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__tree_node<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__map_value_compare<long, std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::less<long>>, std::__Cr::allocator<std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>, std::__Cr::tuple<>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>&&, std::__Cr::tuple<>&&)::'lambda'(long const&, std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>&&, std::__Cr::tuple<>&&), std::__Cr::pair<std::__Cr::__tree_iterator<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__tree_node<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, void*>*, long>, bool> std::__Cr::__tree<std::__Cr::__value_type<long, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::__map_value_compare<long, std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>, std::__Cr::less<long>>, std::__Cr::allocator<std::__Cr::pair<long const, base::raw_ptr<content::ServiceWorkerVersion, (partition_alloc::internal::RawPtrTraits)1>>>>::__emplace_unique<std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>, std::__Cr::tuple<>>(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>&&, std::__Cr::tuple<>&&)::'lambda'(std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>&&, std::__Cr::tuple<>&&), std::__Cr::piecewise_construct_t const&, std::__Cr::tuple<long&&>&&, std::__Cr::tuple<>&&) gen/third_party/libc++/src/include/__new/allocate.h:42:28
    #2 0x55f4494c9477 in content::ServiceWorkerContextCore::AddLiveVersion(content::ServiceWorkerVersion*) gen/third_party/libc++/src/include/__utility/try_key_extraction.h:108:10
    #3 0x55f4496e0318 in content::ServiceWorkerVersion::ServiceWorkerVersion(content::ServiceWorkerRegistration*, GURL const&, blink::mojom::ScriptType, long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>, base::WeakPtr<content::ServiceWorkerContextCore>) content/browser/service_worker/service_worker_version.cc:329:13
    #4 0x55f44965b86d in scoped_refptr<content::ServiceWorkerVersion> base::MakeRefCounted<content::ServiceWorkerVersion, content::ServiceWorkerRegistration*, GURL const&, blink::mojom::ScriptType&, long&, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>, base::WeakPtr<content::ServiceWorkerContextCore>>(content::ServiceWorkerRegistration*&&, GURL const&, blink::mojom::ScriptType&, long&, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>&&, base::WeakPtr<content::ServiceWorkerContextCore>&&) base/memory/scoped_refptr.h:151:16
    #5 0x55f44962a806 in content::ServiceWorkerRegistry::DidGetNewVersionId(scoped_refptr<content::ServiceWorkerRegistration>, GURL const&, blink::mojom::ScriptType, base::OnceCallback<void (scoped_refptr<content::ServiceWorkerVersion>)>, long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>) content/browser/service_worker/service_worker_registry.cc:1898:18
    #6 0x55f449660c98 in void base::internal::DecayedFunctorTraits<void (content::ServiceWorkerRegistry::*)(scoped_refptr<content::ServiceWorkerRegistration>, GURL const&, blink::mojom::ScriptType, base::OnceCallback<void (scoped_refptr<content::ServiceWorkerVersion>)>, long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>), base::WeakPtr<content::ServiceWorkerRegistry>&&, scoped_refptr<content::ServiceWorkerRegistration>&&, GURL&&, blink::mojom::ScriptType&&, base::OnceCallback<void (scoped_refptr<content::ServiceWorkerVersion>)>&&>::Invoke<void (content::ServiceWorkerRegistry::*)(scoped_refptr<content::ServiceWorkerRegistration>, GURL const&, blink::mojom::ScriptType, base::OnceCallback<void (scoped_refptr<content::ServiceWorkerVersion>)>, long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>), base::WeakPtr<content::ServiceWorkerRegistry> const&, scoped_refptr<content::ServiceWorkerRegistration>, GURL, blink::mojom::ScriptType, base::OnceCallback<void (scoped_refptr<content::ServiceWorkerVersion>)>, long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>>(void (content::ServiceWorkerRegistry::*)(scoped_refptr<content::ServiceWorkerRegistration>, GURL const&, blink::mojom::ScriptType, base::OnceCallback<void (scoped_refptr<content::ServiceWorkerVersion>)>, long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>), base::WeakPtr<content::ServiceWorkerRegistry> const&, scoped_refptr<content::ServiceWorkerRegistration>&&, GURL&&, blink::mojom::ScriptType&&, base::OnceCallback<void (scoped_refptr<content::ServiceWorkerVersion>)>&&, long&&, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>&&) base/functional/bind_internal.h:740:12
    #7 0x55f4496609a9 in base::internal::Invoker<base::internal::FunctorTraits<void (content::ServiceWorkerRegistry::*&&)(scoped_refptr<content::ServiceWorkerRegistration>, GURL const&, blink::mojom::ScriptType, base::OnceCallback<void (scoped_refptr<content::ServiceWorkerVersion>)>, long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>), base::WeakPtr<content::ServiceWorkerRegistry>&&, scoped_refptr<content::ServiceWorkerRegistration>&&, GURL&&, blink::mojom::ScriptType&&, base::OnceCallback<void (scoped_refptr<content::ServiceWorkerVersion>)>&&>, base::internal::BindState<true, true, false, void (content::ServiceWorkerRegistry::*)(scoped_refptr<content::ServiceWorkerRegistration>, GURL const&, blink::mojom::ScriptType, base::OnceCallback<void (scoped_refptr<content::ServiceWorkerVersion>)>, long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>), base::WeakPtr<content::ServiceWorkerRegistry>, scoped_refptr<content::ServiceWorkerRegistration>, GURL, blink::mojom::ScriptType, base::OnceCallback<void (scoped_refptr<content::ServiceWorkerVersion>)>>, void (long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>)>::RunOnce(base::internal::BindStateBase*, long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>&&) base/functional/bind_internal.h:956:5
    #8 0x55f4496707d8 in content::InflightCallWithInvoker<long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>>::DidReply(long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>) base/functional/callback.h:155:12
    #9 0x55f449670c9d in base::internal::Invoker<base::internal::FunctorTraits<void (content::InflightCallWithInvoker<long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>>::*&&)(long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>), content::InflightCallWithInvoker<long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>>*>, base::internal::BindState<true, true, false, void (content::InflightCallWithInvoker<long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>>::*)(long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>), base::internal::UnretainedWrapper<content::InflightCallWithInvoker<long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>)>::RunOnce(base::internal::BindStateBase*, long, mojo::PendingRemote<storage::mojom::ServiceWorkerLiveVersionRef>&&) base/functional/bind_internal.h:740:12
    #10 0x55f4474c2524 in storage::mojom::ServiceWorkerStorageControl_GetNewVersionId_ForwardToCallback::Accept(mojo::Message*) base/functional/callback.h:155:12
    #11 0x55f44ebe6409 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1079:41
    #12 0x55f44ec03981 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #13 0x55f44ebec063 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #14 0x55f44ec13858 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42
    #15 0x55f44ec11d38 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7
    #16 0x55f44ec03981 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #17 0x55f44ebdc8bc in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase<mojo::MessageHandle>) mojo/public/cpp/bindings/lib/connector.cc:567:49
    #18 0x55f44ebddf40 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14
    #19 0x55f44ebdd999 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3
    #20 0x55f44ebdf7f4 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::Connector::* const&)(char const*, unsigned int), mojo::Connector*, char const* const&>, base::internal::BindState<true, true, false, void (mojo::Connector::*)(char const*, unsigned int), base::internal::UnretainedWrapper<mojo::Connector, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<char const, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12
    #21 0x55f43774e1ce in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & base/functional/callback.h:346:12
    #22 0x55f43774df6a in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&>, base::internal::BindState<false, true, false, void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12
    #23 0x55f450e895a0 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12
    #24 0x55f450e88ee0 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14
    #25 0x55f450e8a0a7 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #26 0x55f44d675e43 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #27 0x55f44d6e52bc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5

Shadow bytes around the buggy address:
  0x75fdac066780: fa fa fc fc fc fc fc fc fa fa 00 00 00 00 00 fa
  0x75fdac066800: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fd
  0x75fdac066880: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
  0x75fdac066900: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x75fdac066980: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
=>0x75fdac066a00: fa fa fd fd fd fd fd fd fa fa fd[fd]fd fd fd fd
  0x75fdac066a80: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x75fdac066b00: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x75fdac066b80: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x75fdac066c00: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x75fdac066c80: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
E0000 00:00:1778827176.579559    3802 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==3802==ADDITIONAL INFO
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778827176.579759    3802 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==3802==Note: Please include this section with the ASan report.
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778827176.579861    3802 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace:
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778827176.579953    3802 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778827176.580044    3802 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==3802==END OF ADDITIONAL INFO
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1778827176.580145    3802 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==3802==ABORTING
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31