==5189==ERROR: AddressSanitizer: heap-use-after-free on address 0x764e2c634c50 at pc 0x62aec8df78f2 bp 0x7ffc6a01c190 sp 0x7ffc6a01c188
WRITE of size 4 at 0x764e2c634c50 thread T0 (chrome)
    #0 0x62aec8df78f1 in chrome_pdf::PDFiumEngine::CalculateVisiblePages() gen/third_party/libc++/src/include/__memory/construct_at.h:37:10
    #1 0x62aec8e21f94 in chrome_pdf::PDFiumEngine::GetMostVisiblePage() pdf/pdfium/pdfium_engine.cc:3070:3
    #2 0x62aec8e55a95 in chrome_pdf::PDFiumFormFiller::Form_GetCurrentPage(_FPDF_FORMFILLINFO*, fpdf_document_t__*) pdf/pdfium/pdfium_form_filler.cc:231:21
    #3 0x62aec968f844 in CPDFSDK_FormFillEnvironment::GetCurrentPage() const third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:138:33
    #4 0x62aec968f6c3 in CPDFSDK_FormFillEnvironment::GetCurrentView() third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:132:22
    #5 0x62aec97745a3 in CJS_Document::get_page_num(CJS_Runtime*) third_party/pdfium/fxjs/cjs_document.cpp:192:49
    #6 0x62aec97878df in void JSPropGetter<CJS_Document, &CJS_Document::get_page_num(CJS_Runtime*)>(char const*, char const*, v8::Local<v8::Name>, v8::PropertyCallbackInfo<v8::Value> const&) third_party/pdfium/fxjs/js_define.h:85:23
    #7 0x62aeb914a4a1 in v8::internal::PropertyCallbackArguments::CallAccessorGetter(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::AccessorInfo>, v8::internal::DirectHandle<v8::internal::Name>) v8/src/api/api-arguments-inl.h:604:3
    #8 0x62aeb9147b03 in v8::internal::Object::GetPropertyWithAccessor(v8::internal::LookupIterator*) v8/src/objects/objects.cc:1597:39
    #9 0x62aeb9145db7 in v8::internal::Object::GetProperty(v8::internal::LookupIterator*, bool) v8/src/objects/objects.cc:1345:16
    #10 0x62aeb8942c03 in v8::internal::LoadIC::Load(v8::internal::Handle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::Handle<v8::internal::Name>, bool, v8::internal::DirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>) v8/src/ic/ic.cc:468:32
    #11 0x62aeb8964295 in v8::internal::Runtime_LoadNoFeedbackIC_Miss(int, unsigned long*, v8::internal::Isolate*) v8/src/ic/ic.cc:3185:40
    #12 0x62aebd11a4b5 in Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit crtstuff.c
    #13 0x62aebd220ce3 in Builtins_GetNamedPropertyHandler crtstuff.c
    #14 0x62aebd068956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #15 0x62aebd0656db in Builtins_JSEntryTrampoline crtstuff.c
    #16 0x62aebd06542a in Builtins_JSEntry crtstuff.c
    #17 0x62aeb83b74d1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #18 0x62aeb83b9e32 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) v8/src/execution/execution.cc:575:10
    #19 0x62aeb7fceae3 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) v8/src/api/api.cc:2042:7
    #20 0x62aec97500ab in CFXJS_Engine::Execute(fxcrt::WideString const&) third_party/pdfium/fxjs/cfxjs_engine.cpp:612:25
    #21 0x62aec97a6cd0 in CJS_EventContext::RunScript(fxcrt::WideString const&) third_party/pdfium/fxjs/cjs_event_context.cpp:49:21
    #22 0x62aec969ac84 in CPDFSDK_FormFillEnvironment::RunScript(fxcrt::WideString const&, std::__Cr::function<void (IJS_EventContext*)> const&) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:1278:12
    #23 0x62aec9699f54 in CPDFSDK_FormFillEnvironment::ExecuteFieldAction(CPDF_Action const&, CPDF_AAction::AActionType, CPDF_FormField*, CFFL_FieldAction*, std::__Cr::set<CPDF_Dictionary const*, std::__Cr::less<CPDF_Dictionary const*>, std::__Cr::allocator<CPDF_Dictionary const*>>*) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:1169:3
    #24 0x62aec9699b72 in CPDFSDK_FormFillEnvironment::DoActionField(CPDF_Action const&, CPDF_AAction::AActionType, CPDF_FormField*, CFFL_FieldAction*) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:983:10
    #25 0x62aec96bc68b in CPDFSDK_Widget::OnAAction(CPDF_AAction::AActionType, CFFL_FieldAction*, CPDFSDK_PageView const*) third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp:1097:19
    #26 0x62aec98f3fc1 in CFFL_InteractiveFormFiller::OnKillFocus(fxcrt::ObservedPtr<CPDFSDK_Widget>&, fxcrt::Mask<FWL_EVENTFLAG>) third_party/pdfium/fpdfsdk/formfiller/cffl_interactiveformfiller.cpp:461:14
    #27 0x62aec96b9bc9 in CPDFSDK_Widget::OnKillFocus(fxcrt::Mask<FWL_EVENTFLAG>) third_party/pdfium/fpdfsdk/cpdfsdk_widget.cpp:887:38
    #28 0x62aec9695cb6 in CPDFSDK_FormFillEnvironment::KillFocusAnnot(fxcrt::Mask<FWL_EVENTFLAG>) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:843:8
    #29 0x62aec9697335 in CPDFSDK_FormFillEnvironment::RemovePageView(IPDF_Page*) third_party/pdfium/fpdfsdk/cpdfsdk_formfillenvironment.cpp:748:5
    #30 0x62aec96eefea in FPDF_ClosePage third_party/pdfium/fpdfsdk/fpdf_view.cpp:852:23
    #31 0x62aec8e5db17 in chrome_pdf::PDFiumPage::~PDFiumPage() third_party/pdfium/public/cpp/fpdf_deleters.h:59:44
    #32 0x62aec8e40422 in std::__Cr::vector<std::__Cr::unique_ptr<chrome_pdf::PDFiumPage, std::__Cr::default_delete<chrome_pdf::PDFiumPage>>, std::__Cr::allocator<std::__Cr::unique_ptr<chrome_pdf::PDFiumPage, std::__Cr::default_delete<chrome_pdf::PDFiumPage>>>>::clear() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #33 0x62aec8df59e4 in chrome_pdf::PDFiumEngine::~PDFiumEngine() gen/third_party/libc++/src/include/__vector/vector.h:247:16
    #34 0x62aec8df5ff3 in chrome_pdf::PDFiumEngine::~PDFiumEngine() pdf/pdfium/pdfium_engine.cc:768:31
    #35 0x62aee4b9a64b in chrome_pdf::PdfViewWebPlugin::Destroy() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #36 0x62aedc0e679a in blink::WebPluginContainerImpl::Dispose() third_party/blink/renderer/core/exported/web_plugin_container_impl.cc:802:18
    #37 0x62aed8670c73 in blink::HTMLFrameOwnerElement::PluginDisposeSuspendScope::PerformDeferredPluginDispose() third_party/blink/renderer/core/html/html_frame_owner_element.cc:180:13
    #38 0x62aedb6470fa in blink::Document::Shutdown() third_party/blink/renderer/core/html/html_frame_owner_element.h:101:9
    #39 0x62aed7edffed in blink::LocalDOMWindow::FrameDestroyed() third_party/blink/renderer/core/frame/local_dom_window.cc:1077:15
    #40 0x62aed7f7c9bb in blink::LocalFrame::DetachImpl(blink::FrameDetachType) third_party/blink/renderer/core/frame/local_frame.cc:750:16
    #41 0x62aed7eb4286 in blink::Frame::Detach(blink::FrameDetachType) third_party/blink/renderer/core/frame/frame.cc:124:8
    #42 0x62aed6748c6f in content::RenderFrameImpl::Delete(content::mojom::FrameDeleteIntention) content/renderer/render_frame_impl.cc:2236:11
    #43 0x62aeb7dea761 in content::mojom::FrameStubDispatch::Accept(content::mojom::Frame*, mojo::Message*) gen/content/common/frame.mojom.cc:3062:13
    #44 0x62aecb0d7541 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #45 0x62aecb0f5291 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #46 0x62aecb0dd973 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #47 0x62aece1f1833 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #48 0x62aece1f3cb5 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #49 0x62aeca31d4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #50 0x62aeca38c4ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #51 0x62aeca38b38a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #52 0x62aeca1de6e2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #53 0x62aeca38dbd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #54 0x62aeca298b70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #55 0x62aed6929043 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16
    #56 0x62aec6b19d29 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #57 0x62aec6b1afdb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #58 0x62aec6b1de55 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #59 0x62aec6b17788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #60 0x62aec6b17d8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #61 0x62aeb218e266 in ChromeMain chrome/app/chrome_main.cc:194:12
    #62 0x7a2e2e42b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x764e2c634c50 is located 0 bytes inside of 8-byte region [0x764e2c634c50,0x764e2c634c58)
freed by thread T0 (chrome) here:
    #0 0x62aeb218d1a2 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2f1a2) (BuildId: 42c52701e3eebdcb)
    #1 0x62aec8df59bd in chrome_pdf::PDFiumEngine::~PDFiumEngine() gen/third_party/libc++/src/include/__vector/vector.h:258:67
    #2 0x62aec8df5ff3 in chrome_pdf::PDFiumEngine::~PDFiumEngine() pdf/pdfium/pdfium_engine.cc:768:31
    #3 0x62aee4b9a64b in chrome_pdf::PdfViewWebPlugin::Destroy() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #4 0x62aedc0e679a in blink::WebPluginContainerImpl::Dispose() third_party/blink/renderer/core/exported/web_plugin_container_impl.cc:802:18
    #5 0x62aed8670c73 in blink::HTMLFrameOwnerElement::PluginDisposeSuspendScope::PerformDeferredPluginDispose() third_party/blink/renderer/core/html/html_frame_owner_element.cc:180:13
    #6 0x62aedb6470fa in blink::Document::Shutdown() third_party/blink/renderer/core/html/html_frame_owner_element.h:101:9
    #7 0x62aed7edffed in blink::LocalDOMWindow::FrameDestroyed() third_party/blink/renderer/core/frame/local_dom_window.cc:1077:15
    #8 0x62aed7f7c9bb in blink::LocalFrame::DetachImpl(blink::FrameDetachType) third_party/blink/renderer/core/frame/local_frame.cc:750:16
    #9 0x62aed7eb4286 in blink::Frame::Detach(blink::FrameDetachType) third_party/blink/renderer/core/frame/frame.cc:124:8
    #10 0x62aed6748c6f in content::RenderFrameImpl::Delete(content::mojom::FrameDeleteIntention) content/renderer/render_frame_impl.cc:2236:11
    #11 0x62aeb7dea761 in content::mojom::FrameStubDispatch::Accept(content::mojom::Frame*, mojo::Message*) gen/content/common/frame.mojom.cc:3062:13
    #12 0x62aecb0d7541 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54
    #13 0x62aecb0f5291 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #14 0x62aecb0dd973 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #15 0x62aece1f1833 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #16 0x62aece1f3cb5 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #17 0x62aeca31d4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #18 0x62aeca38c4ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #19 0x62aeca38b38a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #20 0x62aeca1de6e2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #21 0x62aeca38dbd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #22 0x62aeca298b70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #23 0x62aed6929043 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16
    #24 0x62aec6b19d29 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #25 0x62aec6b1afdb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #26 0x62aec6b1de55 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #27 0x62aec6b17788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #28 0x62aec6b17d8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #29 0x62aeb218e266 in ChromeMain chrome/app/chrome_main.cc:194:12

previously allocated by thread T0 (chrome) here:
    #0 0x62aeb218c59d in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e2e59d) (BuildId: 42c52701e3eebdcb)
    #1 0x62aeb226b332 in unsigned int* std::__Cr::vector<unsigned int, std::__Cr::allocator<unsigned int>>::__emplace_back_slow_path<unsigned int>(unsigned int&&) gen/third_party/libc++/src/include/__new/allocate.h:42:28
    #2 0x62aec8df7158 in chrome_pdf::PDFiumEngine::CalculateVisiblePages() gen/third_party/libc++/src/include/__vector/vector.h:1138:21
    #3 0x62aec8df642e in chrome_pdf::PDFiumEngine::PluginSizeUpdated(gfx::Size const&) pdf/pdfium/pdfium_engine.cc:820:3
    #4 0x62aee4bbd1d8 in chrome_pdf::PdfViewWebPlugin::RecalculateAreas(double, float) pdf/pdf_view_web_plugin.cc:2550:12
    #5 0x62aee4bb649c in chrome_pdf::PdfViewWebPlugin::HandleViewportMessage(base::DictValue const&) pdf/pdf_view_web_plugin.cc:2513:3
    #6 0x62aee4bb1586 in chrome_pdf::PdfViewWebPlugin::OnMessage(base::DictValue const&) pdf/pdf_view_web_plugin.cc:1875:3
    #7 0x62aee4bd659b in base::internal::Invoker<base::internal::FunctorTraits<void (chrome_pdf::PostMessageReceiver::Client::*&&)(base::DictValue const&), base::WeakPtr<chrome_pdf::PostMessageReceiver::Client>&&, base::DictValue&&>, base::internal::BindState<true, true, false, void (chrome_pdf::PostMessageReceiver::Client::*)(base::DictValue const&), base::WeakPtr<chrome_pdf::PostMessageReceiver::Client>, base::DictValue>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #8 0x62aeca31d4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #9 0x62aeca38c4ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #10 0x62aeca38b38a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #11 0x62aeca1de6e2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #12 0x62aeca38dbd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #13 0x62aeca298b70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #14 0x62aed6929043 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16
    #15 0x62aec6b19d29 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #16 0x62aec6b1afdb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #17 0x62aec6b1de55 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #18 0x62aec6b17788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #19 0x62aec6b17d8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #20 0x62aeb218e266 in ChromeMain chrome/app/chrome_main.cc:194:12
    #21 0x7a2e2e42b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__memory/construct_at.h:37:10 in chrome_pdf::PDFiumEngine::CalculateVisiblePages()
Shadow bytes around the buggy address:
  0x764e2c634980: f7 fa fd fa f7 fa fd fa f7 fa fd fd f7 fa fd fd
  0x764e2c634a00: f7 fa fd fa f7 fa fd fd f7 fa fd fd f7 fa fd fa
  0x764e2c634a80: f7 fa fd fa f7 fa fd fd f7 fa fd fa f7 fa fd fa
  0x764e2c634b00: f7 fa fd fd f7 fa fd fd f7 fa fd fa f7 fa fd fa
  0x764e2c634b80: f7 fa fd fa f7 fa fd fd f7 fa fd fa f7 fa fd fa
=>0x764e2c634c00: f7 fa fd fd f7 fa fd fa f7 fa[fd]fa f7 fa fd fd
  0x764e2c634c80: f7 fa fd fa f7 fa fd fa f7 fa fd fd f7 fa fd fa
  0x764e2c634d00: f7 fa fd fa f7 fa fd fd f7 fa fd fd f7 fa fd fa
  0x764e2c634d80: f7 fa fd fa f7 fa fd fd f7 fa fd fa f7 fa fd fa
  0x764e2c634e00: f7 fa fd fa f7 fa fd fd f7 fa fd fa f7 fa fd fd
  0x764e2c634e80: f7 fa fd fa f7 fa fd fd f7 fa fd fd f7 fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==5189==ADDITIONAL INFO

==5189==Note: Please include this section with the ASan report.
Task trace:
    #0 0x62aece1eae6d in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13


Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=5078 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile.Rmx6Vr --change-stack-guard-on-fork=enable --pdf-renderer --no-sandbox --disable-dev-shm-usage --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --js-flags=--jitless --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1778580823322105 --launch-time-ticks=663214092889 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,10977744604643229429,9013868098469912953,2097152 --field-trial-handle=3,i,11645316877754621173,1635241445794835179,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,15112136405317977941,17771418002645475883,4 --trace-process-track-uuid=3190708993808206286 --enable-logging=stderr --v=0`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==5189==END OF ADDITIONAL INFO

==5189==ABORTING