==4783==ERROR: AddressSanitizer: heap-use-after-free on address 0x72a695225f18 at pc 0x5618f0764af2 bp 0x7266864d3490 sp 0x7266864d3488 READ of size 8 at 0x72a695225f18 thread T8 (AuctionV8Helper) #0 0x5618f0764af1 in auction_worklet::SetPriorityBindings::SetPriority(v8::FunctionCallbackInfo const&) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1018:47 #1 0x5618eb9266d3 in Builtins_CallApiCallbackGeneric crtstuff.c #2 0x5618eb924956 in Builtins_InterpreterEntryTrampoline crtstuff.c #3 0x5618eba64a29 in Builtins_PromiseFulfillReactionJob crtstuff.c #4 0x5618eb955fd3 in Builtins_RunMicrotasks crtstuff.c #5 0x5618eb92162a in Builtins_JSRunMicrotasksEntry crtstuff.c #6 0x5618e6c11589 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:493:41 #7 0x5618e6c14abd in v8::internal::(anonymous namespace)::InvokeWithTryCatch(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:535:18 #8 0x5618e6c14ed5 in v8::internal::Execution::TryRunMicrotasks(v8::internal::Isolate*, v8::internal::MicrotaskQueue*) v8/src/execution/execution.cc:639:10 #9 0x5618e6cb88c1 in v8::internal::MicrotaskQueue::RunMicrotasks(v8::internal::Isolate*) v8/src/execution/microtask-queue.cc:185:22 #10 0x5618e6cb846a in v8::internal::MicrotaskQueue::PerformCheckpointInternal(v8::Isolate*) v8/src/execution/microtask-queue.cc:129:3 #11 0x5618e6c821e6 in v8::internal::Isolate::FireCallCompletedCallbackInternal(v8::internal::MicrotaskQueue*) v8/src/execution/microtask-queue.h:48:5 #12 0x5618e6894eaa in v8::CallDepthScope::~CallDepthScope() v8/src/execution/isolate.h:1818:5 #13 0x5618e6828766 in v8::Script::Run(v8::Local, v8::Local) v8/src/api/api-inl.h:259:20 #14 0x5618f0676436 in auction_worklet::AuctionV8Helper::RunScript(v8::Local, v8::Local, auction_worklet::AuctionV8Helper::DebugId const*, auction_worklet::AuctionV8Helper::TimeLimit*, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>&) content/services/auction_worklet/auction_v8_helper.cc:648:52 #15 0x5618f06bf46c in auction_worklet::BidderWorklet::V8State::CreateContextRecyclerAndRunTopLevelForGenerateBid(unsigned long, auction_worklet::AuctionV8Helper::TimeLimit&, bool, bool&, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>&) content/services/auction_worklet/bidder_worklet.cc:2150:19 #16 0x5618f06b9c53 in auction_worklet::BidderWorklet::V8State::RunGenerateBidOnce(auction_worklet::mojom::BidderWorkletNonSharedParams const&, std::__Cr::basic_string, std::__Cr::allocator> const*, std::__Cr::basic_string, std::__Cr::allocator> const*, auction_worklet::DirectFromSellerSignalsRequester::Result const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result const&, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, url::Origin const*, base::TimeDelta, bool, mojo::StructPtr const&, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr const&, unsigned long, std::__Cr::unique_ptr>, bool) content/services/auction_worklet/bidder_worklet.cc:1712:11 #17 0x5618f06b5f35 in auction_worklet::BidderWorklet::V8State::GenerateBid(mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>) content/services/auction_worklet/bidder_worklet.cc:1451:51 #18 0x5618f06d9361 in void base::internal::DecayedFunctorTraits, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*, mojo::StructPtr&&, auction_worklet::mojom::KAnonymityBidMode&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional&&, std::__Cr::optional&&, url::Origin&&, std::__Cr::optional&&, base::TimeDelta&&, bool&&, mojo::StructPtr&&, base::Time&&, std::__Cr::optional&&, unsigned short&&, unsigned long&&, scoped_refptr&&, bool&&, unsigned long&&, base::ScopedClosureRunner&&, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>&&>::Invoke, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>(void (auction_worklet::BidderWorklet::V8State::*)(mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*&&, mojo::StructPtr&&, auction_worklet::mojom::KAnonymityBidMode&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional&&, std::__Cr::optional&&, url::Origin&&, std::__Cr::optional&&, base::TimeDelta&&, bool&&, mojo::StructPtr&&, base::Time&&, std::__Cr::optional&&, unsigned short&&, unsigned long&&, scoped_refptr&&, bool&&, unsigned long&&, base::ScopedClosureRunner&&, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>&&) base/functional/bind_internal.h:740:12 #19 0x5618f06d8e21 in void base::internal::Invoker, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*, mojo::StructPtr&&, auction_worklet::mojom::KAnonymityBidMode&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional&&, std::__Cr::optional&&, url::Origin&&, std::__Cr::optional&&, base::TimeDelta&&, bool&&, mojo::StructPtr&&, base::Time&&, std::__Cr::optional&&, unsigned short&&, unsigned long&&, scoped_refptr&&, bool&&, unsigned long&&, base::ScopedClosureRunner&&, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>&&>, base::internal::BindState, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), base::internal::UnretainedWrapper, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>, void ()>::RunImpl, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), std::__Cr::tuple, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul, 10ul, 11ul, 12ul, 13ul, 14ul, 15ul, 16ul, 17ul, 18ul, 19ul, 20ul, 21ul, 22ul, 23ul, 24ul>(void (auction_worklet::BidderWorklet::V8State::*&&)(mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), std::__Cr::tuple, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:932:12 #20 0x5618f8f301df in base::CancelableTaskTracker::RunIfNotCanceled(scoped_refptr> const&, base::OnceCallback) base/functional/callback.h:155:12 #21 0x5618f8f36ce8 in base::internal::Invoker> const&, base::OnceCallback), scoped_refptr>&&, base::OnceCallback&&>, base::internal::BindState> const&, base::OnceCallback), scoped_refptr>, base::OnceCallback>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #22 0x5618f8fc709b in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(base::internal::PostTaskAndReplyRelay) base/functional/callback.h:155:12 #23 0x5618f8fc75ee in base::internal::Invoker, base::internal::BindState, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #24 0x5618f8f3d3e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #25 0x5618f8fd47b2 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5 #26 0x5618f8fd49fc in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:675:3 #27 0x5618f8fd2fe9 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:705:7 #28 0x5618f8fd2272 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5 #29 0x5618f9017183 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36 #30 0x5618f9016504 in base::internal::WorkerThread::RunDedicatedWorker() base/task/thread_pool/worker_thread.cc:379:3 #31 0x5618f9015c96 in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:345:7 #32 0x5618f90a7e1e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #33 0x5618e0901a6a in asan_thread_start(void*) asan_interceptors.cpp 0x72a695225f18 is located 8 bytes inside of 40-byte region [0x72a695225f10,0x72a695225f38) freed by thread T8 (AuctionV8Helper) here: #0 0x5618e093ee56 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x11352e56) (BuildId: 1a338d794d353982) #1 0x5618f06e8325 in auction_worklet::ContextRecycler::~ContextRecycler() third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x5618f06bb5c9 in auction_worklet::BidderWorklet::V8State::RunGenerateBidOnce(auction_worklet::mojom::BidderWorkletNonSharedParams const&, std::__Cr::basic_string, std::__Cr::allocator> const*, std::__Cr::basic_string, std::__Cr::allocator> const*, auction_worklet::DirectFromSellerSignalsRequester::Result const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result const&, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, url::Origin const*, base::TimeDelta, bool, mojo::StructPtr const&, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr const&, unsigned long, std::__Cr::unique_ptr>, bool) third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #3 0x5618f06b5f35 in auction_worklet::BidderWorklet::V8State::GenerateBid(mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>) content/services/auction_worklet/bidder_worklet.cc:1451:51 #4 0x5618f06d9361 in void base::internal::DecayedFunctorTraits, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*, mojo::StructPtr&&, auction_worklet::mojom::KAnonymityBidMode&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional&&, std::__Cr::optional&&, url::Origin&&, std::__Cr::optional&&, base::TimeDelta&&, bool&&, mojo::StructPtr&&, base::Time&&, std::__Cr::optional&&, unsigned short&&, unsigned long&&, scoped_refptr&&, bool&&, unsigned long&&, base::ScopedClosureRunner&&, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>&&>::Invoke, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>(void (auction_worklet::BidderWorklet::V8State::*)(mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*&&, mojo::StructPtr&&, auction_worklet::mojom::KAnonymityBidMode&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional&&, std::__Cr::optional&&, url::Origin&&, std::__Cr::optional&&, base::TimeDelta&&, bool&&, mojo::StructPtr&&, base::Time&&, std::__Cr::optional&&, unsigned short&&, unsigned long&&, scoped_refptr&&, bool&&, unsigned long&&, base::ScopedClosureRunner&&, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>&&) base/functional/bind_internal.h:740:12 #5 0x5618f06d8e21 in void base::internal::Invoker, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*, mojo::StructPtr&&, auction_worklet::mojom::KAnonymityBidMode&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional&&, std::__Cr::optional&&, url::Origin&&, std::__Cr::optional&&, base::TimeDelta&&, bool&&, mojo::StructPtr&&, base::Time&&, std::__Cr::optional&&, unsigned short&&, unsigned long&&, scoped_refptr&&, bool&&, unsigned long&&, base::ScopedClosureRunner&&, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>&&>, base::internal::BindState, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), base::internal::UnretainedWrapper, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>, void ()>::RunImpl, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), std::__Cr::tuple, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul, 10ul, 11ul, 12ul, 13ul, 14ul, 15ul, 16ul, 17ul, 18ul, 19ul, 20ul, 21ul, 22ul, 23ul, 24ul>(void (auction_worklet::BidderWorklet::V8State::*&&)(mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), std::__Cr::tuple, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:932:12 #6 0x5618f8f301df in base::CancelableTaskTracker::RunIfNotCanceled(scoped_refptr> const&, base::OnceCallback) base/functional/callback.h:155:12 #7 0x5618f8f36ce8 in base::internal::Invoker> const&, base::OnceCallback), scoped_refptr>&&, base::OnceCallback&&>, base::internal::BindState> const&, base::OnceCallback), scoped_refptr>, base::OnceCallback>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #8 0x5618f8fc709b in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(base::internal::PostTaskAndReplyRelay) base/functional/callback.h:155:12 #9 0x5618f8fc75ee in base::internal::Invoker, base::internal::BindState, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #10 0x5618f8f3d3e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #11 0x5618f8fd47b2 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5 #12 0x5618f8fd49fc in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:675:3 #13 0x5618f8fd2fe9 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:705:7 #14 0x5618f8fd2272 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5 #15 0x5618f9017183 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36 #16 0x5618f9016504 in base::internal::WorkerThread::RunDedicatedWorker() base/task/thread_pool/worker_thread.cc:379:3 #17 0x5618f9015c96 in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:345:7 #18 0x5618f90a7e1e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #19 0x5618e0901a6a in asan_thread_start(void*) asan_interceptors.cpp previously allocated by thread T8 (AuctionV8Helper) here: #0 0x5618e093e251 in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x11352251) (BuildId: 1a338d794d353982) #1 0x5618f06e964d in auction_worklet::ContextRecycler::AddSetPriorityBindings() third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x5618f06bf830 in auction_worklet::BidderWorklet::V8State::CreateContextRecyclerAndRunTopLevelForGenerateBid(unsigned long, auction_worklet::AuctionV8Helper::TimeLimit&, bool, bool&, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>&) content/services/auction_worklet/bidder_worklet.cc:2182:21 #3 0x5618f06b9c53 in auction_worklet::BidderWorklet::V8State::RunGenerateBidOnce(auction_worklet::mojom::BidderWorkletNonSharedParams const&, std::__Cr::basic_string, std::__Cr::allocator> const*, std::__Cr::basic_string, std::__Cr::allocator> const*, auction_worklet::DirectFromSellerSignalsRequester::Result const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result const&, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, url::Origin const*, base::TimeDelta, bool, mojo::StructPtr const&, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr const&, unsigned long, std::__Cr::unique_ptr>, bool) content/services/auction_worklet/bidder_worklet.cc:1712:11 #4 0x5618f06b5f35 in auction_worklet::BidderWorklet::V8State::GenerateBid(mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>) content/services/auction_worklet/bidder_worklet.cc:1451:51 #5 0x5618f06d9361 in void base::internal::DecayedFunctorTraits, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*, mojo::StructPtr&&, auction_worklet::mojom::KAnonymityBidMode&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional&&, std::__Cr::optional&&, url::Origin&&, std::__Cr::optional&&, base::TimeDelta&&, bool&&, mojo::StructPtr&&, base::Time&&, std::__Cr::optional&&, unsigned short&&, unsigned long&&, scoped_refptr&&, bool&&, unsigned long&&, base::ScopedClosureRunner&&, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>&&>::Invoke, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>(void (auction_worklet::BidderWorklet::V8State::*)(mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*&&, mojo::StructPtr&&, auction_worklet::mojom::KAnonymityBidMode&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional&&, std::__Cr::optional&&, url::Origin&&, std::__Cr::optional&&, base::TimeDelta&&, bool&&, mojo::StructPtr&&, base::Time&&, std::__Cr::optional&&, unsigned short&&, unsigned long&&, scoped_refptr&&, bool&&, unsigned long&&, base::ScopedClosureRunner&&, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>&&) base/functional/bind_internal.h:740:12 #6 0x5618f06d8e21 in void base::internal::Invoker, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), auction_worklet::BidderWorklet::V8State*, mojo::StructPtr&&, auction_worklet::mojom::KAnonymityBidMode&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, auction_worklet::DirectFromSellerSignalsRequester::Result&&, std::__Cr::optional, std::__Cr::allocator>>&&, std::__Cr::optional&&, std::__Cr::optional&&, url::Origin&&, std::__Cr::optional&&, base::TimeDelta&&, bool&&, mojo::StructPtr&&, base::Time&&, std::__Cr::optional&&, unsigned short&&, unsigned long&&, scoped_refptr&&, bool&&, unsigned long&&, base::ScopedClosureRunner&&, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>&&>, base::internal::BindState, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), base::internal::UnretainedWrapper, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>, void ()>::RunImpl, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), std::__Cr::tuple, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, 7ul, 8ul, 9ul, 10ul, 11ul, 12ul, 13ul, 14ul, 15ul, 16ul, 17ul, 18ul, 19ul, 20ul, 21ul, 22ul, 23ul, 24ul>(void (auction_worklet::BidderWorklet::V8State::*&&)(mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>> const&, std::__Cr::optional, std::__Cr::optional const&, url::Origin const&, std::__Cr::optional const&, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional const&, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>), std::__Cr::tuple, mojo::StructPtr, auction_worklet::mojom::KAnonymityBidMode, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, auction_worklet::DirectFromSellerSignalsRequester::Result, std::__Cr::optional, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, url::Origin, std::__Cr::optional, base::TimeDelta, bool, mojo::StructPtr, base::Time, std::__Cr::optional, unsigned short, unsigned long, scoped_refptr, bool, unsigned long, base::ScopedClosureRunner, base::OnceCallback, std::__Cr::allocator>>, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, std::__Cr::optional, base::flat_map, std::__Cr::allocator>, mojo::InlinedStructPtr, std::__Cr::less, std::__Cr::vector, std::__Cr::allocator>, mojo::InlinedStructPtr>, std::__Cr::allocator, std::__Cr::allocator>, mojo::InlinedStructPtr>>>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, std::__Cr::vector, std::__Cr::allocator>>, base::TimeDelta, auction_worklet::mojom::RejectReason, bool, std::__Cr::vector, std::__Cr::allocator>, std::__Cr::allocator, std::__Cr::allocator>>>)>>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:932:12 #7 0x5618f8f301df in base::CancelableTaskTracker::RunIfNotCanceled(scoped_refptr> const&, base::OnceCallback) base/functional/callback.h:155:12 #8 0x5618f8f36ce8 in base::internal::Invoker> const&, base::OnceCallback), scoped_refptr>&&, base::OnceCallback&&>, base::internal::BindState> const&, base::OnceCallback), scoped_refptr>, base::OnceCallback>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #9 0x5618f8fc709b in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(base::internal::PostTaskAndReplyRelay) base/functional/callback.h:155:12 #10 0x5618f8fc75ee in base::internal::Invoker, base::internal::BindState, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #11 0x5618f8f3d3e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #12 0x5618f8fd47b2 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5 #13 0x5618f8fd49fc in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:675:3 #14 0x5618f8fd2fe9 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:705:7 #15 0x5618f8fd2272 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5 #16 0x5618f9017183 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36 #17 0x5618f9016504 in base::internal::WorkerThread::RunDedicatedWorker() base/task/thread_pool/worker_thread.cc:379:3 #18 0x5618f9015c96 in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:345:7 #19 0x5618f90a7e1e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #20 0x5618e0901a6a in asan_thread_start(void*) asan_interceptors.cpp Thread T8 (AuctionV8Helper) created by T0 (chrome) here: #0 0x5618e08e7795 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x112fb795) (BuildId: 1a338d794d353982) #1 0x5618f90a7472 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x5618f9014a74 in base::internal::WorkerThread::Start(scoped_refptr, base::WorkerThreadObserver*) base/task/thread_pool/worker_thread.cc:185:3 #3 0x5618f8ff6132 in base::internal::PooledSingleThreadTaskRunnerManager::CreateSingleThreadTaskRunner(base::TaskTraits const&, base::SingleThreadTaskRunnerThreadMode) base/task/thread_pool/pooled_single_thread_task_runner_manager.cc:756:23 #4 0x5618f0671f56 in auction_worklet::AuctionV8Helper::CreateTaskRunner() content/services/auction_worklet/auction_v8_helper.cc:365:22 #5 0x5618f0682b16 in auction_worklet::AuctionWorkletServiceImpl::V8HelperHolder::V8Helper() content/services/auction_worklet/auction_worklet_service_impl.cc:127:11 #6 0x5618f06832b8 in auction_worklet::AuctionWorkletServiceImpl::LoadBidderWorklet(mojo::PendingReceiver, std::__Cr::vector, std::__Cr::allocator>>, bool, mojo::PendingRemote, mojo::PendingRemote, mojo::StructPtr, mojo::StructPtr, std::__Cr::optional const&, std::__Cr::basic_string, std::__Cr::allocator> const&, url::Origin const&, mojo::InlinedStructPtr, std::__Cr::optional, mojo::InlinedStructPtr) content/services/auction_worklet/auction_worklet_service_impl.cc:307:64 #7 0x5618eee4ee9c in auction_worklet::mojom::AuctionWorkletServiceStubDispatch::Accept(auction_worklet::mojom::AuctionWorkletService*, mojo::Message*) gen/content/services/auction_worklet/public/mojom/auction_worklet_service.mojom.cc:1058:13 #8 0x5618f9d26938 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54 #9 0x5618f9d44811 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #10 0x5618f9d2cda3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #11 0x5618f9d54788 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #12 0x5618f9d52c68 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7 #13 0x5618f9d44811 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #14 0x5618f9d1d5fa in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase) mojo/public/cpp/bindings/lib/connector.cc:567:49 #15 0x5618f9d1ec80 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14 #16 0x5618f9d1f7e0 in base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #17 0x5618f8f3d3e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #18 0x5618f8faca9c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #19 0x5618f8fab93a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #20 0x5618f8dfba72 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #21 0x5618f8fae184 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #22 0x5618f8eb7980 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #23 0x5618f1a23093 in content::UtilityMain(content::MainFunctionParams) content/utility/utility_main.cc:486:12 #24 0x5618f58aedc3 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14 #25 0x5618f58b00cb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12 #26 0x5618f58b2fd1 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10 #27 0x5618f58ac7db in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #28 0x5618f58acdcc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #29 0x5618e094002b in ChromeMain chrome/app/chrome_main.cc:221:12 #30 0x76669702b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1018:47 in auction_worklet::SetPriorityBindings::SetPriority(v8::FunctionCallbackInfo const&)