[.] Sanitizer coverage enabled. Counter map size: 8266059, Cmp map size: 262144 Note: Google Test filter = RenderFrameHostImplTest.ExitFullscreenDestructionDuringCommit [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from RenderFrameHostImplTest [ RUN ] RenderFrameHostImplTest.ExitFullscreenDestructionDuringCommit [2442:2442:WARNING:content/browser/renderer_host/render_frame_host_impl.cc:3968] Creating unbound remote associated interface provider [2442:2442:WARNING:content/browser/renderer_host/render_frame_host_impl.cc:3968] Creating unbound remote associated interface provider ================================================================= ==2442==ERROR: AddressSanitizer: heap-use-after-free on address 0x72c467dfb778 at pc 0x5cd37196387c bp 0x7ffcda8f9770 sp 0x7ffcda8f9768 READ of size 8 at 0x72c467dfb778 thread T0 #0 0x5cd37196387b in content::NavigationRequest::~NavigationRequest() third_party/libc++/src/include/__memory/unique_ptr.h:266:112 #1 0x5cd371968f63 in content::NavigationRequest::~NavigationRequest() content/browser/renderer_host/navigation_request.cc:2286:41 #2 0x5cd371a20e03 in content::Navigator::DidNavigate(content::RenderFrameHostImpl*, content::mojom::DidCommitProvisionalLoadParams const&, std::__Cr::unique_ptr>, bool, bool) third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #3 0x5cd371ab2e38 in content::RenderFrameHostImpl::DidCommitNavigationInternal(std::__Cr::unique_ptr>, mojo::StructPtr, mojo::StructPtr, base::TimeTicks const&) content/browser/renderer_host/render_frame_host_impl.cc:16327:58 #4 0x5cd371aae04d in content::RenderFrameHostImpl::DidCommitNavigation(content::NavigationRequest*, mojo::StructPtr, mojo::StructPtr) content/browser/renderer_host/render_frame_host_impl.cc:17240:8 #5 0x5cd371b83bbf in void base::internal::InvokeHelper, mojo::StructPtr), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, void, 0ul, 1ul>::MakeItSo, mojo::StructPtr), std::__Cr::tuple, base::internal::UnretainedWrapper>, mojo::StructPtr, mojo::StructPtr>(void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr, mojo::StructPtr), std::__Cr::tuple, base::internal::UnretainedWrapper>&&, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:740:12 #6 0x5cd371b83900 in base::internal::Invoker, mojo::StructPtr), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, base::internal::BindState, mojo::StructPtr), base::internal::UnretainedWrapper, base::internal::UnretainedWrapper>, void (mojo::StructPtr, mojo::StructPtr)>::RunOnce(base::internal::BindStateBase*, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:1069:14 #7 0x5cd375d62248 in content::TestRenderFrameHost::SimulateCommitProcessed(content::NavigationRequest*, mojo::StructPtr, mojo::PendingReceiver, bool) base/functional/callback.h:155:12 #8 0x5cd375d2fbbd in content::NavigationSimulatorImpl::Commit() content/test/navigation_simulator_impl.cc:763:23 #9 0x5cd361118d8e in content::RenderFrameHostImplTest_ExitFullscreenDestructionDuringCommit_Test::TestBody() content/browser/renderer_host/render_frame_host_impl_unittest.cc:306:8 #10 0x5cd36631742b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #11 0x5cd36631a597 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #12 0x5cd36631c693 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #13 0x5cd36634c25a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #14 0x5cd36634ad2e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #15 0x5cd37623614c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #16 0x5cd375ce4675 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #17 0x5cd3758c4cb1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #18 0x5cd37628cebb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #19 0x5cd37628c7db in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #20 0x5cd3758c4824 in main content/test/run_all_unittests.cc:17:10 #21 0x74a469c0b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x72c467dfb778 is located 1656 bytes inside of 5400-byte region [0x72c467dfb100,0x72c467dfc618) freed by thread T0 here: #0 0x5cd35bc79891 in operator delete(void*) (/chromium/chromium/src/out/asan/content_unittests+0xfb2f891) (BuildId: 137735cd7ea3d1aa) #1 0x5cd361143401 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #2 0x5cd3611436b3 in content::RenderFrameHostImplTest_ExitFullscreenDestructionDuringCommit_Test::TestBody()::DestructionDelegate::ExitFullscreenModeForTab(content::WebContents*) base/functional/callback.h:155:12 #3 0x5cd37233a501 in content::WebContentsImpl::ExitFullscreenMode(bool) content/browser/web_contents/web_contents_impl.cc:4854:16 #4 0x5cd372369ce9 in content::WebContentsImpl::ExitFullscreen(bool) content/browser/web_contents/web_contents_impl.cc:7439:3 #5 0x5cd37237454e in content::WebContentsImpl::DidNavigateAnyFramePreCommit(content::NavigationHandle*, bool) content/browser/web_contents/web_contents_impl.cc:8038:5 #6 0x5cd371a1e681 in content::Navigator::DidNavigate(content::RenderFrameHostImpl*, content::mojom::DidCommitProvisionalLoadParams const&, std::__Cr::unique_ptr>, bool, bool) content/browser/renderer_host/navigator.cc:530:14 #7 0x5cd371ab2e38 in content::RenderFrameHostImpl::DidCommitNavigationInternal(std::__Cr::unique_ptr>, mojo::StructPtr, mojo::StructPtr, base::TimeTicks const&) content/browser/renderer_host/render_frame_host_impl.cc:16327:58 #8 0x5cd371aae04d in content::RenderFrameHostImpl::DidCommitNavigation(content::NavigationRequest*, mojo::StructPtr, mojo::StructPtr) content/browser/renderer_host/render_frame_host_impl.cc:17240:8 #9 0x5cd371b83bbf in void base::internal::InvokeHelper, mojo::StructPtr), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, void, 0ul, 1ul>::MakeItSo, mojo::StructPtr), std::__Cr::tuple, base::internal::UnretainedWrapper>, mojo::StructPtr, mojo::StructPtr>(void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr, mojo::StructPtr), std::__Cr::tuple, base::internal::UnretainedWrapper>&&, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:740:12 #10 0x5cd371b83900 in base::internal::Invoker, mojo::StructPtr), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, base::internal::BindState, mojo::StructPtr), base::internal::UnretainedWrapper, base::internal::UnretainedWrapper>, void (mojo::StructPtr, mojo::StructPtr)>::RunOnce(base::internal::BindStateBase*, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:1069:14 #11 0x5cd375d62248 in content::TestRenderFrameHost::SimulateCommitProcessed(content::NavigationRequest*, mojo::StructPtr, mojo::PendingReceiver, bool) base/functional/callback.h:155:12 #12 0x5cd375d2fbbd in content::NavigationSimulatorImpl::Commit() content/test/navigation_simulator_impl.cc:763:23 #13 0x5cd361118d8e in content::RenderFrameHostImplTest_ExitFullscreenDestructionDuringCommit_Test::TestBody() content/browser/renderer_host/render_frame_host_impl_unittest.cc:306:8 #14 0x5cd36631742b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #15 0x5cd36631a597 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #16 0x5cd36631c693 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #17 0x5cd36634c25a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #18 0x5cd36634ad2e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #19 0x5cd37623614c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #20 0x5cd375ce4675 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #21 0x5cd3758c4cb1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #22 0x5cd37628cebb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #23 0x5cd37628c7db in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #24 0x5cd3758c4824 in main content/test/run_all_unittests.cc:17:10 #25 0x74a469c0b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x5cd35bc79051 in operator new(unsigned long) (/chromium/chromium/src/out/asan/content_unittests+0xfb2f051) (BuildId: 137735cd7ea3d1aa) #1 0x5cd375d78489 in content::TestWebContents::Create(content::BrowserContext*, scoped_refptr) content/public/browser/web_contents.h:178:3 #2 0x5cd375cd236a in content::RenderViewHostTestHarness::CreateTestWebContents() content/public/test/test_renderer_host.cc:219:10 #3 0x5cd375cd29bf in content::RenderViewHostTestHarness::SetUp() content/public/test/test_renderer_host.cc:262:15 #4 0x5cd361141253 in content::RenderFrameHostImplTest::SetUp() content/browser/renderer_host/render_frame_host_impl_unittest.cc:74:36 #5 0x5cd3663172c1 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #6 0x5cd36631a597 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #7 0x5cd36631c693 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #8 0x5cd36634c25a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #9 0x5cd36634ad2e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #10 0x5cd37623614c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #11 0x5cd375ce4675 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #12 0x5cd3758c4cb1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #13 0x5cd37628cebb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #14 0x5cd37628c7db in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #15 0x5cd3758c4824 in main content/test/run_all_unittests.cc:17:10 #16 0x74a469c0b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) Shadow bytes around the buggy address: 0x72c467dfb480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x72c467dfb500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x72c467dfb580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x72c467dfb600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x72c467dfb680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x72c467dfb700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd] 0x72c467dfb780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x72c467dfb800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x72c467dfb880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x72c467dfb900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x72c467dfb980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb WARNING: All log messages before absl::InitializeLog() is called are written to STDERR E0000 00:00:1779776874.569577 2442 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==2442==ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779776874.569664 2442 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==2442==Note: Please include this section with the ASan report. === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779776874.569696 2442 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779776874.569719 2442 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779776874.569742 2442 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==2442==END OF ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779776874.569769 2442 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==2442==ABORTING === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31