[.] Sanitizer coverage enabled. Counter map size: 11455109, Cmp map size: 262144 Note: Google Test filter = CastMirroringServiceHostBrowserTest.PauseAfterPipeCloseUAF [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from CastMirroringServiceHostBrowserTest, where TypeParam = [ RUN ] CastMirroringServiceHostBrowserTest.PauseAfterPipeCloseUAF [.] Sanitizer coverage enabled. Counter map size: 11455109, Cmp map size: 262144 [.] Sanitizer coverage enabled. Counter map size: 11455109, Cmp map size: 262144 [885:902:0519/195708.960797:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [885:902:0519/195708.961026:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [885:902:0519/195708.962001:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [885:902:0519/195708.962134:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [885:902:0519/195708.962220:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [885:902:0519/195709.067790:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [919:919:0519/195709.074268:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1587] drmGetDevices2() has not found any devices [919:919:0519/195709.084797:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [919:919:0519/195709.095443:WARNING:ui/gfx/linux/gbm_support_x11.cc:48] dri3 extension not supported. (browser_tests:885): dbind-WARNING **: 19:57:09.129: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory [885:902:0519/195709.168579:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [885:902:0519/195709.168637:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [.] Sanitizer coverage enabled. Counter map size: 11455109, Cmp map size: 262144 [885:885:0519/195709.469241:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [885:885:0519/195709.469361:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [885:885:0519/195709.469426:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [885:902:0519/195709.469547:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [885:902:0519/195709.469651:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [885:885:0519/195709.479558:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [885:902:0519/195709.801899:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [885:902:0519/195709.801991:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [885:885:0519/195709.801988:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [885:885:0519/195709.802094:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [885:902:0519/195709.802304:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [885:885:0519/195709.857882:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [885:885:0519/195709.857952:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [885:885:0519/195709.857976:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [885:885:0519/195709.858045:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [885:902:0519/195709.858263:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [885:885:0519/195709.888432:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [885:902:0519/195709.890934:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [885:885:0519/195709.928471:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [885:885:0519/195709.928494:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: OnMessage(56-byte object <90-EC C2-32 9B-78 00-00 21-00 00-00 00-00 00-00 28-00 00-00 00-00 00-80 40-90 21-32 9B-79 00-00 8C-01 00-00 00-00 00-00 90-01 00-00 00-00 00-80 01-00 00-00 01-07 00-00>) NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: OnRemotingStateChanged(false) NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. [1007:1007:0519/195714.315793:ERROR:components/mirroring/service/mirroring_logger.cc:75] mirroring.OpenscreenSessionHost: SessionError (0), Failure: AnswerTimeout = "Didn't receive an ANSWER message before timeout." GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: LogErrorMessage(@0x7ffd3d6f0860 "mirroring.OpenscreenSessionHost: SessionError (0), Failure: AnswerTimeout = \"Didn't receive an ANSWER message before timeout.\"") NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: OnError(ANSWER_TIME_OUT) NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: LogInfoMessage(@0x7ffd3d6f0bc0 "mirroring.OpenscreenSessionHost: stopped session. state=1") NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: LogInfoMessage(@0x7ffd3d6f0d80 "mirroring.OpenscreenSessionHost: stopped streaming. state=3") NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: DidStop() NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. ================================================================= ==885==ERROR: AddressSanitizer: heap-use-after-free on address 0x796b32f44b80 at pc 0x57581f85a20f bp 0x785b1ecd2a90 sp 0x785b1ecd2a88 READ of size 8 at 0x796b32f44b80 thread T9 (Chrome_IOThread) #0 0x57581f85a20e in mirroring::(anonymous namespace)::PauseVideoCaptureHostOnIO(media::mojom::VideoCaptureHost*, base::UnguessableToken, base::OnceCallback) chrome/browser/media/cast_mirroring_service_host.cc:104:9 #1 0x57581f85eec4 in base::internal::Invoker), media::mojom::VideoCaptureHost*&&, base::UnguessableToken&&, base::OnceCallback&&>, base::internal::BindState), base::internal::UnretainedWrapper, base::UnguessableToken, base::OnceCallback>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #2 0x575825826c33 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #3 0x5758258963cc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #4 0x57582589526a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #5 0x575825a2539d in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55 #6 0x575825897ab4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #7 0x5758257a4a50 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #8 0x575825932adc in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13 #9 0x575818fc4fe3 in content::BrowserProcessIOThread::IOThreadRun(base::RunLoop*) content/browser/browser_process_io_thread.cc:104:11 #10 0x57582593301f in base::Thread::ThreadMain() base/threading/thread.cc:426:3 #11 0x57582599bdfe in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #12 0x5757fdd8ef16 in asan_thread_start(void*) asan_interceptors.cpp 0x796b32f44b80 is located 0 bytes inside of 208-byte region [0x796b32f44b80,0x796b32f44c50) freed by thread T9 (Chrome_IOThread) here: #0 0x5757fddcb012 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/browser_tests+0x189f9012) (BuildId: 6f0fcecf0fc6d50e) #1 0x57581f85cbb5 in mojo::internal::SelfOwnedReceiver::Close() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x57581f85c1f5 in mojo::internal::SelfOwnedReceiver::OnDisconnect(unsigned int, std::__Cr::basic_string, std::__Cr::allocator> const&) mojo/public/cpp/bindings/self_owned_receiver.h:120:5 #3 0x57581f85c9e3 in base::internal::Invoker::*&&)(unsigned int, std::__Cr::basic_string, std::__Cr::allocator> const&), mojo::internal::SelfOwnedReceiver*>, base::internal::BindState::*)(unsigned int, std::__Cr::basic_string, std::__Cr::allocator> const&), base::internal::UnretainedWrapper, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int, std::__Cr::basic_string, std::__Cr::allocator> const&)>::RunOnce(base::internal::BindStateBase*, unsigned int, std::__Cr::basic_string, std::__Cr::allocator> const&) base/functional/bind_internal.h:740:12 #4 0x57582aa0aa85 in mojo::InterfaceEndpointClient::NotifyError(std::__Cr::optional const&) base/functional/callback.h:155:12 #5 0x57582aa33ccc in mojo::internal::MultiplexRouter::ProcessNotifyErrorTask(mojo::internal::MultiplexRouter::Task*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1116:13 #6 0x57582aa29f9b in mojo::internal::MultiplexRouter::ProcessTasks(mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1024:15 #7 0x57582aa246ca in mojo::internal::MultiplexRouter::OnPipeConnectionError(bool) mojo/public/cpp/bindings/lib/multiplex_router.cc:930:3 #8 0x57582aa371ab in base::internal::Invoker, base::internal::BindState, bool>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #9 0x57582a9f85a8 in mojo::Connector::HandleError(bool, bool) base/functional/callback.h:155:12 #10 0x57582a9fa421 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc #11 0x57582a9fc264 in base::internal::Invoker, base::internal::BindState, base::internal::UnretainedWrapper>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12 #12 0x57580b6ed68e in base::RepeatingCallback::Run(unsigned int) const & base/functional/callback.h:346:12 #13 0x57580b6ed42a in base::internal::Invoker const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback const&>, base::internal::BindState const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12 #14 0x575827ffd080 in base::RepeatingCallback::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12 #15 0x575827ffc9c0 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14 #16 0x575827ffdb87 in base::internal::Invoker&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #17 0x575825826c33 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #18 0x5758258963cc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #19 0x57582589526a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #20 0x575825a2539d in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55 #21 0x575825897ab4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #22 0x5758257a4a50 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #23 0x575825932adc in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13 #24 0x575818fc4fe3 in content::BrowserProcessIOThread::IOThreadRun(base::RunLoop*) content/browser/browser_process_io_thread.cc:104:11 #25 0x57582593301f in base::Thread::ThreadMain() base/threading/thread.cc:426:3 #26 0x57582599bdfe in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #27 0x5757fdd8ef16 in asan_thread_start(void*) asan_interceptors.cpp previously allocated by thread T9 (Chrome_IOThread) here: #0 0x5757fddca40d in operator new(unsigned long) (/chromium/chromium/src/out/asan/browser_tests+0x189f840d) (BuildId: 6f0fcecf0fc6d50e) #1 0x57581f855c12 in mirroring::(anonymous namespace)::CreateVideoCaptureHostOnIO(std::__Cr::basic_string, std::__Cr::allocator> const&, blink::mojom::MediaStreamType, mojo::PendingReceiver) gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x57581f85b137 in base::internal::Invoker> (*&&)(std::__Cr::basic_string, std::__Cr::allocator> const&, blink::mojom::MediaStreamType, mojo::PendingReceiver), std::__Cr::basic_string, std::__Cr::allocator>&&, blink::mojom::MediaStreamType&&, mojo::PendingReceiver&&>, base::internal::BindState> (*)(std::__Cr::basic_string, std::__Cr::allocator> const&, blink::mojom::MediaStreamType, mojo::PendingReceiver), std::__Cr::basic_string, std::__Cr::allocator>, blink::mojom::MediaStreamType, mojo::PendingReceiver>, base::WeakPtr> ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #3 0x57581f86043e in void base::internal::ReturnAsParamAdapter>>, base::WeakPtr>>(base::OnceCallback> ()>, std::__Cr::unique_ptr>>, std::__Cr::default_delete>>>>*) base/functional/callback.h:155:12 #4 0x57581f86094c in base::internal::Invoker> ()>, std::__Cr::unique_ptr>>, std::__Cr::default_delete>>>>*), base::OnceCallback> ()>&&, std::__Cr::unique_ptr>>, std::__Cr::default_delete>>>>*&&>, base::internal::BindState> ()>, std::__Cr::unique_ptr>>, std::__Cr::default_delete>>>>*), base::OnceCallback> ()>, base::internal::UnretainedWrapper>>, std::__Cr::default_delete>>>>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #5 0x5758258b101b in base::internal::PostTaskAndReplyRelay::RunTaskAndPostReply(base::internal::PostTaskAndReplyRelay) base/functional/callback.h:155:12 #6 0x5758258b156e in base::internal::Invoker, base::internal::BindState, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #7 0x575825826c33 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #8 0x5758258963cc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #9 0x57582589526a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #10 0x575825a2539d in base::MessagePumpEpoll::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_epoll.cc:224:55 #11 0x575825897ab4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #12 0x5758257a4a50 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #13 0x575825932adc in base::Thread::Run(base::RunLoop*) base/threading/thread.cc:356:13 #14 0x575818fc4fe3 in content::BrowserProcessIOThread::IOThreadRun(base::RunLoop*) content/browser/browser_process_io_thread.cc:104:11 #15 0x57582593301f in base::Thread::ThreadMain() base/threading/thread.cc:426:3 #16 0x57582599bdfe in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:102:13 #17 0x5757fdd8ef16 in asan_thread_start(void*) asan_interceptors.cpp Thread T9 (Chrome_IOThread) created by T0 (browser_tests) here: #0 0x5757fdd74d91 in pthread_create (/chromium/chromium/src/out/asan/browser_tests+0x189a2d91) (BuildId: 6f0fcecf0fc6d50e) #1 0x57582599b452 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThreadBase::Delegate*, base::PlatformThreadHandle*, base::ThreadType, base::MessagePumpType) base/threading/platform_thread_posix.cc:153:13 #2 0x575825931b6c in base::Thread::StartWithOptions(base::Thread::Options) base/threading/thread.cc:232:26 #3 0x57581a85362a in content::BrowserTaskExecutor::CreateIOThread() content/browser/scheduler/browser_task_executor.cc:304:19 #4 0x5758206cd100 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1293:42 #5 0x5758206cbfc0 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12 #6 0x5758206c56f8 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #7 0x5758206c5cfc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #8 0x575827bcb9cd in content::BrowserTestBase::SetUp() content/public/test/browser_test_base.cc:615:34 #9 0x5758255f85d1 in InProcessBrowserTest::SetUp() chrome/test/base/in_process_browser_test.cc:560:20 #10 0x57581e286211 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #11 0x57581e2893f7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #12 0x57581e28b473 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #13 0x57581e2ba5f4 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #14 0x57581e2b916a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #15 0x575825b09510 in base::TestSuite::Run() base/test/test_suite.cc:440:16 #16 0x575841f66be0 in ChromeTestSuiteRunner::RunTestSuite(int, char**) chrome/test/base/chrome_test_launcher.cc:101:22 #17 0x575827dd0dc5 in content::LaunchTestsInternal(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:423:31 #18 0x575827dd17c1 in content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:518:10 #19 0x575841f675f1 in LaunchChromeTests(unsigned long, content::TestLauncherDelegate*, int, char**) chrome/test/base/chrome_test_launcher.cc:360:10 #20 0x57582541a2bb in main chrome/test/base/browser_tests_main.cc:60:10 #21 0x7c5b33c2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) Shadow bytes around the buggy address: 0x796b32f44900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x796b32f44980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x796b32f44a00: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd 0x796b32f44a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x796b32f44b00: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa =>0x796b32f44b80:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x796b32f44c00: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x796b32f44c80: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd 0x796b32f44d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x796b32f44d80: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa 0x796b32f44e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb WARNING: All log messages before absl::InitializeLog() is called are written to STDERR E0000 00:00:1779220639.336508 903 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==885==ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779220639.336600 903 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==885==Note: Please include this section with the ASan report. === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779220639.336647 903 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779220639.336742 903 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: #0 0x57581f859c3a in mirroring::CastMirroringServiceHost::Pause(base::OnceCallback) chrome/browser/media/cast_mirroring_service_host.cc:616:9 === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779220639.336767 903 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779220639.336891 903 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Command line: `out/asan/browser_tests --disable-gpu-process-for-dx12-info-collection --gtest_filter=CastMirroringServiceHostBrowserTest.PauseAfterPipeCloseUAF --no-sandbox --single-process-tests --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.fhSGKW --disable-auto-reload --no-first-run --enable-logging=stderr --disable-default-apps --wm-window-animations-disabled --password-store=basic --disable-component-update --change-stack-guard-on-fork=disable --test-type=browser --disable-zero-browsers-open-for-tests --disable-updater-scheduler --ip-address-space-overrides=127.0.0.1:0=public,[::1]:0=public --use-fake-device-for-media-stream --browser-test --ipc-connection-timeout=60 --log-missing-unload-ack --dom-automation --log-gpu-control-list-decisions --disable-d3d11-warp --disable-backgrounding-occluded-windows --disable-ignore-duplicate-navs-for-testing --disable-gl-drawing-for-tests --override-use-software-gl-for-tests --force-color-profile=srgb --enable-features=*TestBlinkFeatureDefault,TestFeatureForBrowserTest1 --disable-features=ExtensionDisableUnsupportedDeveloper,PreconnectToSearch,RestartNetworkServiceUnsandboxedForFailedLaunch,SessionRestoreInfobar,TestFeatureForBrowserTest2 --disable-gpu-process-for-dx12-info-collection --disable-platform-accessibility-integration --ozone-platform=x11 --flag-switches-begin --flag-switches-end about:blank` === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779220639.336941 903 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: MiraclePtr Status: PROTECTED This crash occurred inside a callback where a raw_ptr pointing to the same region was bound to one of the arguments. MiraclePtr is expected to make this crash non-exploitable once fully enabled. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779220639.336971 903 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==885==END OF ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779220639.336994 903 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==885==ABORTING === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31