[162:162:0527/004950.660551:INFO:CONSOLE:9] "[poc] wrapper iframe onload", source: http://127.0.0.1:8080/poc.html (9)
[162:162:0527/004950.858111:INFO:CONSOLE:9] "[poc] attempt #1 internalid=64BFE0A715EA60F44A4873AEAD5B95CF frames=1", source: http://127.0.0.1:8080/poc.html (9)
[162:162:0527/004950.858709:INFO:CONSOLE:9] "[poc] caching pm; waiting for guest DidLoad...", source: http://127.0.0.1:8080/poc.html (9)
[162:177:0527/004955.585634:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
=================================================================
==250==ERROR: AddressSanitizer: heap-use-after-free on address 0x785e7514c6c8 at pc 0x5b28c287f7c6 bp 0x7ffed1fd6050 sp 0x7ffed1fd6048
READ of size 8 at 0x785e7514c6c8 thread T0 (chrome)
[162:162:0527/004956.884498:INFO:CONSOLE:9] "[poc] calling cached pm({}) ...", source: http://127.0.0.1:8080/poc.html (9)
[162:162:0527/004956.884600:INFO:CONSOLE:9] "[poc] getter fired: removing wrapper iframe (frees |this|)", source: http://127.0.0.1:8080/poc.html (9)
    #0 0x5b28c287f7c5 in extensions::PostMessageSupport::PostJavaScriptMessage(v8::Isolate*, v8::Local<v8::Value>) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1012:48
    #1 0x5b28c288293a in void base::internal::Invoker<base::internal::FunctorTraits<void (extensions::PostMessageSupport::* const&)(v8::Isolate*, v8::Local<v8::Value>), base::WeakPtr<extensions::PostMessageSupport> const&, v8::Isolate* const&>, base::internal::BindState<true, true, false, void (extensions::PostMessageSupport::*)(v8::Isolate*, v8::Local<v8::Value>), base::WeakPtr<extensions::PostMessageSupport>, base::internal::UnretainedWrapper<v8::Isolate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (v8::Local<v8::Value>)>::RunImpl<void (extensions::PostMessageSupport::* const&)(v8::Isolate*, v8::Local<v8::Value>), std::__Cr::tuple<base::WeakPtr<extensions::PostMessageSupport>, base::internal::UnretainedWrapper<v8::Isolate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>> const&, 0ul, 1ul>(void (extensions::PostMessageSupport::* const&)(v8::Isolate*, v8::Local<v8::Value>), std::__Cr::tuple<base::WeakPtr<extensions::PostMessageSupport>, base::internal::UnretainedWrapper<v8::Isolate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>> const&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>, v8::Local<v8::Value>&&) base/functional/bind_internal.h:740:12
    #2 0x5b28c288237d in base::RepeatingCallback<void (v8::Local<v8::Value>)>::Run(v8::Local<v8::Value>) const & base/functional/callback.h:346:12
    #3 0x5b28c2881a59 in gin::internal::Dispatcher<void (v8::Local<v8::Value>)>::DispatchToCallbackImpl(gin::Arguments*) gin/function_template.h:250:14
    #4 0x5b28c28816f1 in gin::internal::Dispatcher<void (v8::Local<v8::Value>)>::DispatchToCallback(v8::FunctionCallbackInfo<v8::Value> const&) gin/function_template.h:292:5
    #5 0x5b28b56476d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #6 0x5b28b5645956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #7 0x5b28b56426db in Builtins_JSEntryTrampoline crtstuff.c
    #8 0x5b28b564242a in Builtins_JSEntry crtstuff.c
    #9 0x5b28b09327e1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #10 0x5b28b0931121 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) v8/src/execution/execution.cc:565:10
    #11 0x5b28b057d19d in v8::Function::Call(v8::Isolate*, v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) v8/src/api/api.cc:5612:27
    #12 0x5b28cf60aa4f in blink::V8ScriptRunner::CallFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:851:48
    #13 0x5b28d4e33a16 in blink::bindings::CallbackInvokeHelper<blink::CallbackFunctionBase, (blink::bindings::CallbackInvokeHelperMode)0, (blink::bindings::CallbackReturnTypeIsPromise)0>::Call(int, v8::Local<v8::Value>*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:123:12
    #14 0x5b28d4e4b40d in blink::V8Function::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:73:13
    #15 0x5b28d4e4bb49 in blink::V8Function::InvokeAndReportException(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:133:15
    #16 0x5b28d5bee739 in blink::ScheduledAction::Execute(blink::ExecutionContext*) third_party/blink/renderer/core/scheduler/scheduled_action.cc:145:18
    #17 0x5b28d5be6b46 in blink::DOMTimer::Fired() third_party/blink/renderer/core/scheduler/dom_timer.cc:459:11
    #18 0x5b28d3d9534d in blink::TimerBase::RunInternal() third_party/blink/renderer/platform/timer.cc:166:3
    #19 0x5b28cf56fed0 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::TimerBase::*&&)(), blink::TimerBase*>, base::internal::BindState<true, true, false, void (blink::TimerBase::*)(), blink::UnretainedWrapper<blink::TimerBase>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #20 0x5b28c2c5e3e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #21 0x5b28c2ccda9c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #22 0x5b28c2ccc93a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #23 0x5b28c2b1ca72 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #24 0x5b28c2ccf184 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #25 0x5b28c2bd8980 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #26 0x5b28cf496de4 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16
    #27 0x5b28bf5cfdc3 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #28 0x5b28bf5d10cb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #29 0x5b28bf5d3fd1 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #30 0x5b28bf5cd7db in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #31 0x5b28bf5cddcc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #32 0x5b28aa66102b in ChromeMain chrome/app/chrome_main.cc:221:12
    #33 0x7bfe76e2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x785e7514c6c8 is located 40 bytes inside of 64-byte region [0x785e7514c6a0,0x785e7514c6e0)
freed by thread T0 (chrome) here:
    #0 0x5b28aa65fe56 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x11352e56) (BuildId: 1a338d794d353982)
    #1 0x5b28c2878724 in extensions::MimeHandlerViewContainerManager::~MimeHandlerViewContainerManager() third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5b28c2878803 in extensions::MimeHandlerViewContainerManager::~MimeHandlerViewContainerManager() extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container_manager.cc:139:67
    #3 0x5b28c287cb3a in std::__Cr::vector<std::__Cr::pair<base::TokenType<blink::LocalFrameTokenTypeMarker>, std::__Cr::unique_ptr<extensions::MimeHandlerViewContainerManager, std::__Cr::default_delete<extensions::MimeHandlerViewContainerManager>>>, std::__Cr::allocator<std::__Cr::pair<base::TokenType<blink::LocalFrameTokenTypeMarker>, std::__Cr::unique_ptr<extensions::MimeHandlerViewContainerManager, std::__Cr::default_delete<extensions::MimeHandlerViewContainerManager>>>>>::erase(std::__Cr::__wrap_iter<std::__Cr::pair<base::TokenType<blink::LocalFrameTokenTypeMarker>, std::__Cr::unique_ptr<extensions::MimeHandlerViewContainerManager, std::__Cr::default_delete<extensions::MimeHandlerViewContainerManager>>> const*>, std::__Cr::__wrap_iter<std::__Cr::pair<base::TokenType<blink::LocalFrameTokenTypeMarker>, std::__Cr::unique_ptr<extensions::MimeHandlerViewContainerManager, std::__Cr::default_delete<extensions::MimeHandlerViewContainerManager>>> const*>) third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #4 0x5b28cf2a3a8b in content::RenderFrameImpl::~RenderFrameImpl() content/renderer/render_frame_impl.cc:2037:14
    #5 0x5b28cf2a63e3 in content::RenderFrameImpl::~RenderFrameImpl() content/renderer/render_frame_impl.cc:2033:37
    #6 0x5b28cf2d2334 in content::RenderFrameImpl::FrameDetached(blink::DetachReason) content/renderer/render_frame_impl.cc:3836:3
    #7 0x5b28d0ea15b9 in blink::LocalFrameClientImpl::Detached(blink::FrameDetachType) third_party/blink/renderer/core/frame/local_frame_client_impl.cc:381:11
    #8 0x5b28d0a753af in blink::Frame::Detach(blink::FrameDetachType) third_party/blink/renderer/core/frame/frame.cc:172:12
    #9 0x5b28d1247531 in blink::HTMLFrameOwnerElement::DisconnectContentFrame() third_party/blink/renderer/core/html/html_frame_owner_element.cc:377:19
    #10 0x5b28d0b998a6 in blink::ChildFrameDisconnector::DisconnectCollectedFrameOwners() third_party/blink/renderer/core/dom/child_frame_disconnector.cc:65:14
    #11 0x5b28d4259f46 in blink::ContainerNode::WillRemoveChild(blink::Node&) third_party/blink/renderer/core/dom/container_node.cc:871:10
    #12 0x5b28d4258321 in blink::ContainerNode::RemoveChild(blink::Node*, blink::ExceptionState&) third_party/blink/renderer/core/dom/container_node.cc:996:3
    #13 0x5b28d50ce337 in blink::(anonymous namespace)::v8_element::RemoveOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_element.cc:4520:17
    #14 0x5b28b56476d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #15 0x5b28b5645956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #16 0x5b28b56426db in Builtins_JSEntryTrampoline crtstuff.c
    #17 0x5b28b564242a in Builtins_JSEntry crtstuff.c
    #18 0x5b28b09327e1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #19 0x5b28b0931121 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) v8/src/execution/execution.cc:565:10
    #20 0x5b28b16cc614 in v8::internal::Object::GetPropertyWithAccessor(v8::internal::LookupIterator*) v8/src/objects/objects.cc:1730:22
    #21 0x5b28b16ca227 in v8::internal::Object::GetProperty(v8::internal::LookupIterator*, bool) v8/src/objects/objects.cc:1348:16
    #22 0x5b28b1b4e609 in v8::internal::Runtime::GetObjectProperty(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, bool*) v8/src/runtime/runtime-object.cc:42:38
    #23 0x5b28b056e201 in v8::Object::Get(v8::Local<v8::Context>, v8::Local<v8::Value>) v8/src/api/api.cc:4800:7
    #24 0x5b28c270dac5 in bool gin::Dictionary::Get<v8::Local<v8::Function>>(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, v8::Local<v8::Function>*) gin/dictionary.h:38:19
    #25 0x5b28c287f316 in extensions::PostMessageSupport::PostJavaScriptMessage(v8::Isolate*, v8::Local<v8::Value>) extensions/renderer/guest_view/mime_handler_view/post_message_support.cc:151:22
    #26 0x5b28c288293a in void base::internal::Invoker<base::internal::FunctorTraits<void (extensions::PostMessageSupport::* const&)(v8::Isolate*, v8::Local<v8::Value>), base::WeakPtr<extensions::PostMessageSupport> const&, v8::Isolate* const&>, base::internal::BindState<true, true, false, void (extensions::PostMessageSupport::*)(v8::Isolate*, v8::Local<v8::Value>), base::WeakPtr<extensions::PostMessageSupport>, base::internal::UnretainedWrapper<v8::Isolate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (v8::Local<v8::Value>)>::RunImpl<void (extensions::PostMessageSupport::* const&)(v8::Isolate*, v8::Local<v8::Value>), std::__Cr::tuple<base::WeakPtr<extensions::PostMessageSupport>, base::internal::UnretainedWrapper<v8::Isolate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>> const&, 0ul, 1ul>(void (extensions::PostMessageSupport::* const&)(v8::Isolate*, v8::Local<v8::Value>), std::__Cr::tuple<base::WeakPtr<extensions::PostMessageSupport>, base::internal::UnretainedWrapper<v8::Isolate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>> const&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>, v8::Local<v8::Value>&&) base/functional/bind_internal.h:740:12
    #27 0x5b28c288237d in base::RepeatingCallback<void (v8::Local<v8::Value>)>::Run(v8::Local<v8::Value>) const & base/functional/callback.h:346:12
    #28 0x5b28c2881a59 in gin::internal::Dispatcher<void (v8::Local<v8::Value>)>::DispatchToCallbackImpl(gin::Arguments*) gin/function_template.h:250:14
    #29 0x5b28c28816f1 in gin::internal::Dispatcher<void (v8::Local<v8::Value>)>::DispatchToCallback(v8::FunctionCallbackInfo<v8::Value> const&) gin/function_template.h:292:5

previously allocated by thread T0 (chrome) here:
    #0 0x5b28aa65f251 in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x11352251) (BuildId: 1a338d794d353982)
    #1 0x5b28c2878e81 in extensions::MimeHandlerViewContainerManager::CreateBeforeUnloadControl(base::OnceCallback<void (mojo::PendingRemote<extensions::mime_handler::BeforeUnloadControl>)>) third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x5b28b9a528f3 in extensions::mojom::MimeHandlerViewContainerManagerStubDispatch::AcceptWithResponder(extensions::mojom::MimeHandlerViewContainerManager*, mojo::Message*, std::__Cr::unique_ptr<mojo::MessageReceiverWithStatus, std::__Cr::default_delete<mojo::MessageReceiverWithStatus>>) gen/extensions/common/mojom/guest_view.mojom.cc:1195:13
    #3 0x5b28c3a47a5b in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56
    #4 0x5b28c3a65713 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24
    #5 0x5b28c3a4dda3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #6 0x5b28c6b7c9b3 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #7 0x5b28c6b7ee35 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #8 0x5b28c2c5e3e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #9 0x5b28c2ccda9c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #10 0x5b28c2ccc93a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #11 0x5b28c2b1ca72 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #12 0x5b28c2ccf184 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #13 0x5b28c2bd8980 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #14 0x5b28cf496de4 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16
    #15 0x5b28bf5cfdc3 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #16 0x5b28bf5d10cb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #17 0x5b28bf5d3fd1 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #18 0x5b28bf5cd7db in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #19 0x5b28bf5cddcc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #20 0x5b28aa66102b in ChromeMain chrome/app/chrome_main.cc:221:12
    #21 0x7bfe76e2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1012:48 in extensions::PostMessageSupport::PostJavaScriptMessage(v8::Isolate*, v8::Local<v8::Value>)
Shadow bytes around the buggy address:
  0x785e7514c400: fd fd fd fd fd fd fd fd fa fa f7 fa fd fd fd fd
  0x785e7514c480: fd fd fd fa fa fa f7 fa fd fd fd fd fd fd fd fa
  0x785e7514c500: fa fa f7 fa 00 00 00 00 00 00 00 00 fa fa f7 fa
  0x785e7514c580: 00 00 00 00 00 00 00 fa fa fa f7 fa fd fd fd fd
  0x785e7514c600: fd fd fd fa fa fa f7 fa fd fd fd fd fd fd fd fa
=>0x785e7514c680: fa fa f7 fa fd fd fd fd fd[fd]fd fd fa fa f7 fa
  0x785e7514c700: fd fd fd fd fd fd fd fd fa fa f7 fa fd fd fd fd
  0x785e7514c780: fd fd fd fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x785e7514c800: fa fa f7 fa fd fd fd fd fd fd fd fa fa fa f7 fa
  0x785e7514c880: fd fd fd fd fd fd fd fa fa fa f7 fa fd fd fd fd
  0x785e7514c900: fd fd fd fa fa fa f7 fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==250==ADDITIONAL INFO

==250==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5b28d5be57cc in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool, blink::probe::AsyncTaskContext::ScanForAds) third_party/blink/renderer/core/scheduler/dom_timer.cc:348:27
    #1 0x5b28d5be57cc in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool, blink::probe::AsyncTaskContext::ScanForAds) third_party/blink/renderer/core/scheduler/dom_timer.cc:348:27
    #2 0x5b28d4301189 in blink::Document::DecrementLoadEventDelayCount() third_party/blink/renderer/core/dom/document.cc:8762:61
    #3 0x5b28d0c4b4a3 in blink::LocalFrameView::PerformPostLayoutTasks(bool) third_party/blink/renderer/core/frame/local_frame_view.cc:1840:57


Command line: `/proc/self/exe --type=renderer --gpu-client-id=6 --crashpad-handler-pid=164 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --disable-dev-shm-usage --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1779725768335899 --gpu-channel-request-start-time-ticks=117222040052 --launch-time-ticks=117222047036 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,1092674741233051378,9738278634986853095,2097152 --field-trial-handle=3,i,8947740084722643934,3355341070865020400,262144 --disable-features=PdfOopif --variations-seed-version --pseudonymization-salt-handle=7,i,10856244357945066891,15730706099973523767,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=stderr --v=0`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==250==END OF ADDITIONAL INFO

==250==ABORTING