==1016==ERROR: AddressSanitizer: heap-use-after-free on address 0x79eda80b0c68 at pc 0x5dceb8d16e7a bp 0x79bd09ffcc70 sp 0x79bd09ffcc68 READ of size 8 at 0x79eda80b0c68 thread T12 (ServiceWorker t) [925:940:0529/025641.154178:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT #0 0x5dceb8d16e79 in blink::HashMap>, blink::HashTraits, blink::HashTraits>>, blink::PartitionAllocator>::erase(blink::String const&) base/memory/scoped_refptr.h:284:27 #1 0x5dceb8ceb42d in blink::ServiceWorkerGlobalScope::DidHandleFetchEvent(int, blink::mojom::ServiceWorkerEventStatus) third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc:2846:28 #2 0x5dceb8d6ffa4 in blink::WaitUntilObserver::MaybeCompleteEvent() third_party/blink/renderer/modules/service_worker/wait_until_observer.cc:239:36 #3 0x5dceb8d72078 in blink::ThenCallable::Call(blink::ScriptState*, blink::ScriptValue) third_party/blink/renderer/modules/service_worker/wait_until_observer.cc:190:3 #4 0x5dceaef15ad1 in blink::ScriptFunction::CallRaw(blink::ScriptState*, v8::FunctionCallbackInfo const&) third_party/blink/renderer/bindings/core/v8/script_function.cc:89:7 #5 0x5dce94ea26d3 in Builtins_CallApiCallbackGeneric crtstuff.c #6 0x5dce94fe1469 in Builtins_PromiseFulfillReactionJob crtstuff.c #7 0x5dce94ed1e53 in Builtins_RunMicrotasks crtstuff.c #8 0x5dce94e9d62a in Builtins_JSRunMicrotasksEntry crtstuff.c #9 0x5dce901225a9 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:493:41 #10 0x5dce90125add in v8::internal::(anonymous namespace)::InvokeWithTryCatch(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:535:18 #11 0x5dce90125ef5 in v8::internal::Execution::TryRunMicrotasks(v8::internal::Isolate*, v8::internal::MicrotaskQueue*) v8/src/execution/execution.cc:639:10 #12 0x5dce901c9c51 in v8::internal::MicrotaskQueue::RunMicrotasks(v8::internal::Isolate*) v8/src/execution/microtask-queue.cc:197:22 #13 0x5dce901c97fa in v8::internal::MicrotaskQueue::PerformCheckpointInternal(v8::Isolate*) v8/src/execution/microtask-queue.cc:141:3 #14 0x5dceaef658f7 in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_microtasks_scope.h:22:7 #15 0x5dceb47b1736 in blink::bindings::CallbackInvokeHelper::Call(int, v8::Local*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:123:12 #16 0x5dceb47c912d in blink::V8Function::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:73:13 #17 0x5dceb47c9869 in blink::V8Function::InvokeAndReportException(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:133:15 #18 0x5dceb556ca79 in blink::ScheduledAction::Execute(blink::ExecutionContext*) third_party/blink/renderer/core/scheduler/scheduled_action.cc:145:18 #19 0x5dceb5564e86 in blink::DOMTimer::Fired() third_party/blink/renderer/core/scheduler/dom_timer.cc:459:11 #20 0x5dceb370be9d in blink::TimerBase::RunInternal() third_party/blink/renderer/platform/timer.cc:166:3 #21 0x5dceaeeca8b0 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #22 0x5dcea25bd593 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #23 0x5dcea262cc4c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #24 0x5dcea262baea in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #25 0x5dcea247bbb2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #26 0x5dcea262e334 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #27 0x5dcea2537ac0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #28 0x5dce9a9aa273 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:178:14 #29 0x5dcea2727fde in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #30 0x5dce89df8a6a in asan_thread_start(void*) asan_interceptors.cpp 0x79eda80b0c68 is located 8 bytes inside of 32-byte region [0x79eda80b0c60,0x79eda80b0c80) freed by thread T12 (ServiceWorker t) here: #0 0x5dce89e35e56 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x1138de56) (BuildId: 5e9aa3a720d182ec) #1 0x5dceb8cf4f7a in blink::ServiceWorkerGlobalScope::InsertNewItemToRaceNetworkRequests(int, base::UnguessableToken const&, mojo::PendingRemote, blink::KURL const&) third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x5dceb8cf31e3 in blink::ServiceWorkerGlobalScope::StartFetchEvent(mojo::StructPtr, base::WeakPtr, base::TimeTicks, int) third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc:1565:5 #3 0x5dceb8d1ff88 in base::internal::Invoker, base::WeakPtr, base::TimeTicks, int), cppgc::internal::BasicPersistent&&, mojo::StructPtr&&, base::WeakPtr&&, base::TimeTicks&&>, base::internal::BindState, base::WeakPtr, base::TimeTicks, int), cppgc::internal::BasicPersistent, mojo::StructPtr, base::WeakPtr, base::TimeTicks>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #4 0x5dceb8cd4ea2 in blink::ServiceWorkerEventQueue::StartEvent(int, std::__Cr::unique_ptr>) base/functional/callback.h:155:12 #5 0x5dceb8cd37c2 in blink::ServiceWorkerEventQueue::ProcessEvents() third_party/blink/renderer/modules/service_worker/service_worker_event_queue.cc:129:5 #6 0x5dceb8cd43a9 in blink::ServiceWorkerEventQueue::EnqueueEvent(std::__Cr::unique_ptr>) third_party/blink/renderer/modules/service_worker/service_worker_event_queue.cc:116:3 #7 0x5dceb8cd3d9a in blink::ServiceWorkerEventQueue::EnqueueNormal(int, base::OnceCallback, base::OnceCallback, std::__Cr::optional) third_party/blink/renderer/modules/service_worker/service_worker_event_queue.cc:78:3 #8 0x5dceb8cf6ca4 in blink::ServiceWorkerGlobalScope::DispatchFetchEventForSubresource(mojo::StructPtr, mojo::PendingRemote, base::OnceCallback) third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc:1633:19 #9 0x5dce99e6be45 in blink::mojom::blink::ControllerServiceWorkerStubDispatch::AcceptWithResponder(blink::mojom::blink::ControllerServiceWorker*, mojo::Message*, std::__Cr::unique_ptr>) gen/third_party/blink/public/mojom/service_worker/controller_service_worker.mojom-blink.cc:835:13 #10 0x5dcea33a238b in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #11 0x5dcea33c0043 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24 #12 0x5dcea33a86d3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #13 0x5dcea33d00b8 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #14 0x5dcea33ce598 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7 #15 0x5dcea33c0141 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #16 0x5dcea3398f2a in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase) mojo/public/cpp/bindings/lib/connector.cc:567:49 #17 0x5dcea339a5b0 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14 #18 0x5dcea339b110 in base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #19 0x5dcea25bd593 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #20 0x5dcea262cc4c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #21 0x5dcea262baea in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #22 0x5dcea247bbb2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #23 0x5dcea262e334 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #24 0x5dcea2537ac0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #25 0x5dce9a9aa273 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:178:14 #26 0x5dcea2727fde in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #27 0x5dce89df8a6a in asan_thread_start(void*) asan_interceptors.cpp previously allocated by thread T12 (ServiceWorker t) here: #0 0x5dce89e35251 in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x1138d251) (BuildId: 5e9aa3a720d182ec) #1 0x5dceb8cf4822 in blink::ServiceWorkerGlobalScope::InsertNewItemToRaceNetworkRequests(int, base::UnguessableToken const&, mojo::PendingRemote, blink::KURL const&) third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x5dceb8cf31e3 in blink::ServiceWorkerGlobalScope::StartFetchEvent(mojo::StructPtr, base::WeakPtr, base::TimeTicks, int) third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc:1565:5 #3 0x5dceb8d1ff88 in base::internal::Invoker, base::WeakPtr, base::TimeTicks, int), cppgc::internal::BasicPersistent&&, mojo::StructPtr&&, base::WeakPtr&&, base::TimeTicks&&>, base::internal::BindState, base::WeakPtr, base::TimeTicks, int), cppgc::internal::BasicPersistent, mojo::StructPtr, base::WeakPtr, base::TimeTicks>, void (int)>::RunOnce(base::internal::BindStateBase*, int) base/functional/bind_internal.h:740:12 #4 0x5dceb8cd4ea2 in blink::ServiceWorkerEventQueue::StartEvent(int, std::__Cr::unique_ptr>) base/functional/callback.h:155:12 #5 0x5dceb8cd37c2 in blink::ServiceWorkerEventQueue::ProcessEvents() third_party/blink/renderer/modules/service_worker/service_worker_event_queue.cc:129:5 #6 0x5dceb8cd43a9 in blink::ServiceWorkerEventQueue::EnqueueEvent(std::__Cr::unique_ptr>) third_party/blink/renderer/modules/service_worker/service_worker_event_queue.cc:116:3 #7 0x5dceb8cd3d9a in blink::ServiceWorkerEventQueue::EnqueueNormal(int, base::OnceCallback, base::OnceCallback, std::__Cr::optional) third_party/blink/renderer/modules/service_worker/service_worker_event_queue.cc:78:3 #8 0x5dceb8cf6ca4 in blink::ServiceWorkerGlobalScope::DispatchFetchEventForSubresource(mojo::StructPtr, mojo::PendingRemote, base::OnceCallback) third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc:1633:19 #9 0x5dce99e6be45 in blink::mojom::blink::ControllerServiceWorkerStubDispatch::AcceptWithResponder(blink::mojom::blink::ControllerServiceWorker*, mojo::Message*, std::__Cr::unique_ptr>) gen/third_party/blink/public/mojom/service_worker/controller_service_worker.mojom-blink.cc:835:13 #10 0x5dcea33a238b in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #11 0x5dcea33c0043 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:51:24 #12 0x5dcea33a86d3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #13 0x5dcea33d00b8 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #14 0x5dcea33ce598 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7 #15 0x5dcea33c0141 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #16 0x5dcea3398f2a in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase) mojo/public/cpp/bindings/lib/connector.cc:567:49 #17 0x5dcea339a5b0 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14 #18 0x5dcea339b110 in base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #19 0x5dcea25bd593 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #20 0x5dcea262cc4c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #21 0x5dcea262baea in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #22 0x5dcea247bbb2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #23 0x5dcea262e334 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #24 0x5dcea2537ac0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #25 0x5dce9a9aa273 in blink::scheduler::NonMainThreadImpl::SimpleThreadImpl::Run() third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:178:14 #26 0x5dcea2727fde in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #27 0x5dce89df8a6a in asan_thread_start(void*) asan_interceptors.cpp Thread T12 (ServiceWorker t) created by T10 (ThreadPoolSingl) here: #0 0x5dce89dde795 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x11336795) (BuildId: 5e9aa3a720d182ec) #1 0x5dcea2727632 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x5dcea26b496c in base::SimpleThread::StartAsync() base/threading/simple_thread.cc:55:13 #3 0x5dce9a9a7cda in blink::NonMainThread::CreateThread(blink::ThreadCreationParams const&) third_party/blink/renderer/platform/scheduler/worker/non_main_thread_impl.cc:40:11 #4 0x5dceb2d286c0 in blink::WorkerBackingThread::WorkerBackingThread(blink::ThreadCreationParams const&) third_party/blink/renderer/core/workers/worker_backing_thread.cc:130:23 #5 0x5dceb8d66172 in blink::ServiceWorkerThread::ServiceWorkerThread(std::__Cr::unique_ptr>, std::__Cr::unique_ptr>, mojo::PendingRemote, scoped_refptr, base::TokenType const&) third_party/libc++/src/include/__memory/unique_ptr.h:756:30 #6 0x5dceb866c6af in std::__Cr::unique_ptr> std::__Cr::make_unique>, std::__Cr::unique_ptr>, mojo::PendingRemote, scoped_refptr&, base::TokenType&, 0>(std::__Cr::unique_ptr>&&, std::__Cr::unique_ptr>&&, mojo::PendingRemote&&, scoped_refptr&, base::TokenType&) third_party/libc++/src/include/__memory/unique_ptr.h:756:30 #7 0x5dceb866a39a in blink::WebEmbeddedWorkerImpl::StartWorkerThread(std::__Cr::unique_ptr>, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>, mojo::PendingRemote, mojo::PendingRemote, blink::InterfaceRegistry*, scoped_refptr, mojo::PendingReceiver, mojo::PendingReceiver) third_party/blink/renderer/modules/exported/web_embedded_worker_impl.cc:248:20 #8 0x5dceb866953f in blink::WebEmbeddedWorkerImpl::StartWorkerContext(std::__Cr::unique_ptr>, std::__Cr::unique_ptr>, blink::CrossVariantMojoRemote, blink::CrossVariantMojoRemote, blink::CrossVariantMojoRemote, blink::InterfaceRegistry*, scoped_refptr, blink::CrossVariantMojoReceiver, blink::CrossVariantMojoReceiver) third_party/blink/renderer/modules/exported/web_embedded_worker_impl.cc:137:3 #9 0x5dceaee07db9 in content::ServiceWorkerContextClient::StartWorkerContextOnInitiatorThread(std::__Cr::unique_ptr>, std::__Cr::unique_ptr>, std::__Cr::unique_ptr>, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingRemote, mojo::PendingReceiver, mojo::PendingReceiver) content/renderer/service_worker/service_worker_context_client.cc:214:12 #10 0x5dceaee01629 in content::EmbeddedWorkerInstanceClientImpl::StartWorker(mojo::StructPtr) content/renderer/service_worker/embedded_worker_instance_client_impl.cc:141:35 #11 0x5dce8eb5a4ee in blink::mojom::EmbeddedWorkerInstanceClientStubDispatch::Accept(blink::mojom::EmbeddedWorkerInstanceClient*, mojo::Message*) gen/third_party/blink/public/mojom/service_worker/embedded_worker.mojom.cc:697:13 #12 0x5dcea33a2268 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54 #13 0x5dcea33c0141 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #14 0x5dcea33a86d3 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #15 0x5dcea33d00b8 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #16 0x5dcea33ce598 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7 #17 0x5dcea33c0141 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #18 0x5dcea3398f2a in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase) mojo/public/cpp/bindings/lib/connector.cc:567:49 #19 0x5dcea339a5b0 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14 #20 0x5dcea339a009 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3 #21 0x5dcea339be64 in base::internal::Invoker, base::internal::BindState, base::internal::UnretainedWrapper>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12 #22 0x5dce8f33c65e in base::RepeatingCallback::Run(unsigned int) const & base/functional/callback.h:346:12 #23 0x5dce8f33c3fa in base::internal::Invoker const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback const&>, base::internal::BindState const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12 #24 0x5dcea343cb30 in base::RepeatingCallback::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12 #25 0x5dcea343c470 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14 #26 0x5dcea343d637 in base::internal::Invoker&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #27 0x5dcea25bd593 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #28 0x5dcea2654962 in base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/common/task_annotator.h:112:5 #29 0x5dcea2654bac in base::internal::TaskTracker::RunSkipOnShutdown(base::internal::Task&, base::TaskTraits const&, base::internal::TaskSource*, base::internal::SequenceToken const&) base/task/thread_pool/task_tracker.cc:675:3 #30 0x5dcea2653199 in base::internal::TaskTracker::RunTask(base::internal::Task, base::internal::TaskSource*, base::TaskTraits const&, base::ThreadType) base/task/thread_pool/task_tracker.cc:705:7 #31 0x5dcea2652422 in base::internal::TaskTracker::RunAndPopNextTask(base::internal::RegisteredTaskSource) base/task/thread_pool/task_tracker.cc:393:5 #32 0x5dcea2697333 in base::internal::WorkerThread::RunWorker() base/task/thread_pool/worker_thread.cc:473:36 #33 0x5dcea2696594 in base::internal::WorkerThread::RunSharedWorker() base/task/thread_pool/worker_thread.cc:369:3 #34 0x5dcea2695ecb in base::internal::WorkerThread::ThreadMain() base/task/thread_pool/worker_thread.cc:342:7 #35 0x5dcea2727fde in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #36 0x5dce89df8a6a in asan_thread_start(void*) asan_interceptors.cpp Thread T10 (ThreadPoolSingl) created by T0 (chrome) here: #0 0x5dce89dde795 in pthread_create (/chromium/chromium/src/out/asan/chrome+0x11336795) (BuildId: 5e9aa3a720d182ec) #1 0x5dcea2727632 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x5dcea2694c24 in base::internal::WorkerThread::Start(scoped_refptr, base::WorkerThreadObserver*) base/task/thread_pool/worker_thread.cc:185:3 #3 0x5dcea26762e2 in base::internal::PooledSingleThreadTaskRunnerManager::CreateSingleThreadTaskRunner(base::TaskTraits const&, base::SingleThreadTaskRunnerThreadMode) base/task/thread_pool/pooled_single_thread_task_runner_manager.cc:756:23 #4 0x5dceaed72870 in content::ExposeRendererInterfacesToBrowser(base::WeakPtr, mojo::BinderMap*) content/renderer/browser_exposed_renderer_interfaces.cc:203:7 #5 0x5dceaed4e5b0 in content::RenderThreadImpl::Init() content/renderer/render_thread_impl.cc:564:3 #6 0x5dceaed51654 in content::RenderThreadImpl::RenderThreadImpl(base::RepeatingCallback, std::__Cr::unique_ptr>) content/renderer/render_thread_impl.cc:475:3 #7 0x5dceaedf1483 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:278:9 #8 0x5dce9ee4b273 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:666:14 #9 0x5dce9ee4c57b in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:773:12 #10 0x5dce9ee4f481 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1165:10 #11 0x5dce9ee48c8b in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #12 0x5dce9ee4927c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #13 0x5dce89e3702b in ChromeMain chrome/app/chrome_main.cc:221:12 #14 0x7dbda9e0b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free base/memory/scoped_refptr.h:284:27 in blink::HashMap>, blink::HashTraits, blink::HashTraits>>, blink::PartitionAllocator>::erase(blink::String const&) Shadow bytes around the buggy address: 0x79eda80b0980: f7 fa fd fd fd fa f7 fa fd fd fd fa f7 fa fd fd 0x79eda80b0a00: fd fd f7 fa 00 00 02 fa f7 fa 00 00 00 03 f7 fa 0x79eda80b0a80: 00 00 06 fa f7 fa 00 00 05 fa f7 fa 00 00 00 04 0x79eda80b0b00: f7 fa 00 00 00 06 f7 fa 00 00 00 02 f7 fa 00 00 0x79eda80b0b80: 03 fa f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa =>0x79eda80b0c00: 00 00 05 fa f7 fa 00 00 00 fa f7 fa fd[fd]fd fd 0x79eda80b0c80: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa 00 00 0x79eda80b0d00: 00 00 f7 fa fd fd fd fa f7 fa fd fd fd fd f7 fa 0x79eda80b0d80: fd fd fd fa f7 fa fd fd fd fa f7 fa fd fd fd fa 0x79eda80b0e00: f7 fa 00 00 00 fa f7 fa fd fd fd fa f7 fa fd fd 0x79eda80b0e80: fd fa f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1016==ADDITIONAL INFO ==1016==Note: Please include this section with the ASan report. Task trace: #0 0x5dceb5563b0c in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool, blink::probe::AsyncTaskContext::ScanForAds) third_party/blink/renderer/core/scheduler/dom_timer.cc:348:27 #1 0x5dcea339ad08 in mojo::Connector::ScheduleDispatchOfPendingMessagesOrWaitForMore(unsigned long) mojo/public/cpp/bindings/lib/connector.cc:588:7 #2 0x5dcea343cfa3 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13 #3 0x5dcea343cfa3 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13 Command line: `/proc/self/exe --type=renderer --gpu-client-id=6 --crashpad-handler-pid=927 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --ozone-platform=x11 --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1779725768335899 --gpu-channel-request-start-time-ticks=297630220380 --launch-time-ticks=297630225553 --shared-files=v8_context_snapshot_data:100 --metrics-shmem-handle=4,i,10977226250852394733,4073888476297000336,2097152 --field-trial-handle=3,i,2741793110403476106,5746943869853023612,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,4351447271424757914,4172046222366743844,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=stderr --v=0` MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. ==1016==END OF ADDITIONAL INFO ==1016==ABORTING