[3390:3406:0520/223915.710780:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[3390:3406:0520/223917.581984:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /dev/null: Connection refused
[3390:3406:0520/223917.582377:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[3390:3406:0520/223917.582664:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[3390:3406:0520/223917.582869:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /dev/null: Connection refused
[3390:3421:0520/223917.695758:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1587] drmGetDevices2() has not found any devices
[3390:3390:0520/223918.373864:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured.
[3390:3406:0520/223918.439177:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /dev/null: Connection refused
[3390:3390:0520/223918.727878:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3390:3390:0520/223918.728340:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable.
[3390:3406:0520/223918.728396:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /dev/null: Connection refused
[3390:3390:0520/223918.728540:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3390:3406:0520/223918.728973:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /dev/null: Connection refused
[3390:3390:0520/223918.861956:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3390:3390:0520/223918.896714:WARNING:ui/gfx/linux/gbm_support_x11.cc:48] dri3 extension not supported.
[3390:3406:0520/223919.480036:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /dev/null: Connection refused
[3390:3406:0520/223919.480298:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /dev/null: Connection refused
[3390:3406:0520/223920.902438:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[3390:3406:0520/223920.902748:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory
[3390:3390:0520/223920.902890:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3390:3390:0520/223920.903068:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3390:3406:0520/223920.903425:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /dev/null: Connection refused
[3390:3390:0520/223921.046573:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal.
[3390:3390:0520/223921.047330:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: 
[3390:3390:0520/223921.047450:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device
[3390:3390:0520/223921.047587:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3390:3406:0520/223921.047964:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /dev/null: Connection refused
[3390:3390:0520/223921.201266:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3390:3406:0520/223921.201751:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /dev/null: Connection refused
[3390:3390:0520/223921.360558:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[3390:3390:0520/223921.360714:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used.
[3390:3406:0520/223924.530529:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR
[3390:3406:0520/223924.537842:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR

(chrome:3390): dconf-WARNING **: 22:39:29.635: failed to commit changes to dconf: Could not connect: Connection refused

(chrome:3390): dconf-WARNING **: 22:39:29.673: failed to commit changes to dconf: Could not connect: Connection refused

(chrome:3390): dconf-WARNING **: 22:39:29.704: failed to commit changes to dconf: Could not connect: Connection refused

(chrome:3390): dconf-WARNING **: 22:39:29.764: failed to commit changes to dconf: Could not connect: Connection refused

(chrome:3390): dconf-WARNING **: 22:39:29.863: failed to commit changes to dconf: Could not connect: Connection refused

(chrome:3390): dconf-WARNING **: 22:39:29.870: failed to commit changes to dconf: Could not connect: Connection refused
=================================================================
==3390==ERROR: AddressSanitizer: heap-use-after-free on address 0x77b9ddd692b0 at pc 0x5891df6945c4 bp 0x7ffe04d09890 sp 0x7ffe04d09048
READ of size 8 at 0x77b9ddd692b0 thread T0 (chrome)
    #0 0x5891df6945c3 in memcpy (/chromium/chromium/src/out/asan/chrome+0x10df45c3) (BuildId: 42c52701e3eebdcb)
    #1 0x7a49e0db7136 in probe /poc-artifacts/asan_gobject_probe.c:24:3
    #2 0x7a49e0db715c in g_type_check_instance_cast /poc-artifacts/asan_gobject_probe.c:32:3
    #3 0x58920f7b389b in gtk::ClearAuraTransientParent(_GtkWidget*, aura::Window*, gtk::GtkUiPlatform*) ui/gtk/gtk_util.cc:230:21
    #4 0x58920f7c95de in gtk::SelectFileDialogLinuxGtk::OnFileChooserDestroy(_GtkWidget*) ui/gtk/select_file_dialog_linux_gtk.cc:633:5
    #5 0x58920f7c8b88 in gtk::SelectFileDialogLinuxGtk::~SelectFileDialogLinuxGtk() ui/gtk/select_file_dialog_linux_gtk.cc:211:5
    #6 0x58920f7c9b33 in gtk::SelectFileDialogLinuxGtk::~SelectFileDialogLinuxGtk() ui/gtk/select_file_dialog_linux_gtk.cc:197:55
    #7 0x5891ff81eb59 in ui::SelectFileDialogLinuxPortal::ListenerDestroyed() base/memory/ref_counted.h:438:5
    #8 0x5891eb90f097 in content::FileSystemChooser::~FileSystemChooser() content/browser/file_system_access/file_system_chooser.cc:417:14
    #9 0x5891eb9108bf in content::FileSystemChooser::FileSelectionCanceled() content/browser/file_system_access/file_system_chooser.cc:445:3
    #10 0x5891eb910e41 in base::internal::Invoker<base::internal::FunctorTraits<void (content::FileSystemChooser::*&&)(), content::FileSystemChooser*>, base::internal::BindState<true, true, false, void (content::FileSystemChooser::*)(), base::internal::UnretainedWrapper<content::FileSystemChooser, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #11 0x5891ebdea64a in content::WebContentsBasedCanceller::RenderFrameHostStateChanged(content::RenderFrameHost*, content::RenderFrameHost::LifecycleState, content::RenderFrameHost::LifecycleState) base/functional/callback.h:155:12
    #12 0x5891ed06b863 in void content::WebContentsImpl::WebContentsObserverList::NotifyObservers<void (content::WebContentsObserver::*)(content::RenderFrameHost*, content::RenderFrameHost::LifecycleState, content::RenderFrameHost::LifecycleState), content::RenderFrameHost*&, content::RenderFrameHost::LifecycleState&, content::RenderFrameHost::LifecycleState&>(void (content::WebContentsObserver::*)(content::RenderFrameHost*, content::RenderFrameHost::LifecycleState, content::RenderFrameHost::LifecycleState), content::RenderFrameHost*&, content::RenderFrameHost::LifecycleState&, content::RenderFrameHost::LifecycleState&) content/browser/web_contents/web_contents_impl.h:1846:9
    #13 0x5891ed06af2e in content::WebContentsImpl::RenderFrameHostStateChanged(content::RenderFrameHost*, content::RenderFrameHost::LifecycleState, content::RenderFrameHost::LifecycleState) content/browser/web_contents/web_contents_impl.cc:12237:14
    #14 0x5891ec6d983e in content::RenderFrameHostImpl::SetLifecycleState(content::RenderFrameHostImpl::LifecycleStateImpl) content/browser/renderer_host/render_frame_host_impl.cc:18949:18
    #15 0x5891ec6d7e63 in content::RenderFrameHostImpl::DidEnterBackForwardCacheInternal() content/browser/renderer_host/render_frame_host_impl.cc:3170:3
    #16 0x5891ec6d71ba in content::RenderFrameHostImpl::DidEnterBackForwardCache() content/browser/renderer_host/render_frame_host_impl.cc:3149:3
    #17 0x5891ebdfbfc7 in content::BackForwardCacheImpl::StoreEntry(std::__Cr::unique_ptr<content::BackForwardCacheImpl::Entry, std::__Cr::default_delete<content::BackForwardCacheImpl::Entry>>) content/browser/back_forward_cache/back_forward_cache_impl.cc:1377:31
    #18 0x5891ec8368e5 in content::RenderFrameHostManager::UnloadOldFrame(std::__Cr::unique_ptr<content::RenderFrameHostImpl, std::__Cr::default_delete<content::RenderFrameHostImpl>>, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1455:26
    #19 0x5891ec8306b0 in content::RenderFrameHostManager::CommitPending(std::__Cr::unique_ptr<content::RenderFrameHostImpl, std::__Cr::default_delete<content::RenderFrameHostImpl>>, std::__Cr::unique_ptr<content::StoredPage, std::__Cr::default_delete<content::StoredPage>>, bool, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:5533:3
    #20 0x5891ec82d659 in content::RenderFrameHostManager::CommitPendingIfNecessary(content::RenderFrameHostImpl*, bool, bool, bool, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1092:5
    #21 0x5891ec82cf1c in content::RenderFrameHostManager::DidNavigateFrame(content::RenderFrameHostImpl*, bool, bool, bool, blink::FramePolicy const&, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1037:3
    #22 0x5891ec67e8c0 in content::Navigator::DidNavigate(content::RenderFrameHostImpl*, content::mojom::DidCommitProvisionalLoadParams const&, std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, bool, bool) content/browser/renderer_host/navigator.cc:603:38
    #23 0x5891ec70faf0 in content::RenderFrameHostImpl::DidCommitNavigationInternal(std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitSameDocumentNavigationParams>, base::TimeTicks const&) content/browser/renderer_host/render_frame_host_impl.cc:16215:58
    #24 0x5891ec70a30d in content::RenderFrameHostImpl::DidCommitNavigation(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>) content/browser/renderer_host/render_frame_host_impl.cc:17128:8
    #25 0x5891ec7e052f in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, void, 0ul, 1ul>::MakeItSo<void (content::RenderFrameHostImpl::*)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), std::__Cr::tuple<base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>>(void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), std::__Cr::tuple<base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>&&) base/functional/bind_internal.h:740:12
    #26 0x5891ec7e0270 in base::internal::Invoker<base::internal::FunctorTraits<void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, base::internal::BindState<true, true, false, void (content::RenderFrameHostImpl::*)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>)>::RunOnce(base::internal::BindStateBase*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>&&) base/functional/bind_internal.h:1069:14
    #27 0x5891e53857be in content::mojom::NavigationClient_CommitNavigation_ForwardToCallback::Accept(mojo::Message*) base/functional/callback.h:155:12
    #28 0x5891f8619d19 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1079:41
    #29 0x5891f8637291 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #30 0x5891f861f973 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #31 0x5891fb733833 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #32 0x5891fb735cb5 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #33 0x5891f785f4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #34 0x5891f78ce4ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #35 0x5891f78cd38a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #36 0x5891f7a7a164 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48
    #37 0x5891f78cfbd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #38 0x5891f77dab70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #39 0x5891eb12411c in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18
    #40 0x5891eb12cacc in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:148:15
    #41 0x5891eb11b15c in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28
    #42 0x5891f405c8c1 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10
    #43 0x5891f4060a08 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1331:10
    #44 0x5891f405fea0 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12
    #45 0x5891f4059788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #46 0x5891f4059d8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #47 0x5891df6d0266 in ChromeMain chrome/app/chrome_main.cc:194:12
    #48 0x7a49df82b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)
    #49 0x7a49df82b304 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x27304) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)
    #50 0x5891df5f5029 in _start (/chromium/chromium/src/out/asan/chrome+0x10d55029) (BuildId: 42c52701e3eebdcb)

0x77b9ddd692b0 is located 688 bytes inside of 760-byte region [0x77b9ddd69000,0x77b9ddd692f8)
freed by thread T0 (chrome) here:
    #0 0x5891df695366 in free (/chromium/chromium/src/out/asan/chrome+0x10df5366) (BuildId: 42c52701e3eebdcb)
    #1 0x7a49e0c351bb in g_type_free_instance (/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x381bb) (BuildId: d56c5a278ee6e10faea0a792cbbf7a764701a962)
    #2 0x58920f7c8b7c in gtk::SelectFileDialogLinuxGtk::~SelectFileDialogLinuxGtk() ui/gtk/select_file_dialog_linux_gtk.cc:210:5
    #3 0x58920f7c9b33 in gtk::SelectFileDialogLinuxGtk::~SelectFileDialogLinuxGtk() ui/gtk/select_file_dialog_linux_gtk.cc:197:55
    #4 0x5891ff81eb59 in ui::SelectFileDialogLinuxPortal::ListenerDestroyed() base/memory/ref_counted.h:438:5
    #5 0x5891eb90f097 in content::FileSystemChooser::~FileSystemChooser() content/browser/file_system_access/file_system_chooser.cc:417:14
    #6 0x5891eb9108bf in content::FileSystemChooser::FileSelectionCanceled() content/browser/file_system_access/file_system_chooser.cc:445:3
    #7 0x5891eb910e41 in base::internal::Invoker<base::internal::FunctorTraits<void (content::FileSystemChooser::*&&)(), content::FileSystemChooser*>, base::internal::BindState<true, true, false, void (content::FileSystemChooser::*)(), base::internal::UnretainedWrapper<content::FileSystemChooser, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #8 0x5891ebdea64a in content::WebContentsBasedCanceller::RenderFrameHostStateChanged(content::RenderFrameHost*, content::RenderFrameHost::LifecycleState, content::RenderFrameHost::LifecycleState) base/functional/callback.h:155:12
    #9 0x5891ed06b863 in void content::WebContentsImpl::WebContentsObserverList::NotifyObservers<void (content::WebContentsObserver::*)(content::RenderFrameHost*, content::RenderFrameHost::LifecycleState, content::RenderFrameHost::LifecycleState), content::RenderFrameHost*&, content::RenderFrameHost::LifecycleState&, content::RenderFrameHost::LifecycleState&>(void (content::WebContentsObserver::*)(content::RenderFrameHost*, content::RenderFrameHost::LifecycleState, content::RenderFrameHost::LifecycleState), content::RenderFrameHost*&, content::RenderFrameHost::LifecycleState&, content::RenderFrameHost::LifecycleState&) content/browser/web_contents/web_contents_impl.h:1846:9
    #10 0x5891ed06af2e in content::WebContentsImpl::RenderFrameHostStateChanged(content::RenderFrameHost*, content::RenderFrameHost::LifecycleState, content::RenderFrameHost::LifecycleState) content/browser/web_contents/web_contents_impl.cc:12237:14
    #11 0x5891ec6d983e in content::RenderFrameHostImpl::SetLifecycleState(content::RenderFrameHostImpl::LifecycleStateImpl) content/browser/renderer_host/render_frame_host_impl.cc:18949:18
    #12 0x5891ec6d7e63 in content::RenderFrameHostImpl::DidEnterBackForwardCacheInternal() content/browser/renderer_host/render_frame_host_impl.cc:3170:3
    #13 0x5891ec6d71ba in content::RenderFrameHostImpl::DidEnterBackForwardCache() content/browser/renderer_host/render_frame_host_impl.cc:3149:3
    #14 0x5891ebdfbfc7 in content::BackForwardCacheImpl::StoreEntry(std::__Cr::unique_ptr<content::BackForwardCacheImpl::Entry, std::__Cr::default_delete<content::BackForwardCacheImpl::Entry>>) content/browser/back_forward_cache/back_forward_cache_impl.cc:1377:31
    #15 0x5891ec8368e5 in content::RenderFrameHostManager::UnloadOldFrame(std::__Cr::unique_ptr<content::RenderFrameHostImpl, std::__Cr::default_delete<content::RenderFrameHostImpl>>, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1455:26
    #16 0x5891ec8306b0 in content::RenderFrameHostManager::CommitPending(std::__Cr::unique_ptr<content::RenderFrameHostImpl, std::__Cr::default_delete<content::RenderFrameHostImpl>>, std::__Cr::unique_ptr<content::StoredPage, std::__Cr::default_delete<content::StoredPage>>, bool, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:5533:3
    #17 0x5891ec82d659 in content::RenderFrameHostManager::CommitPendingIfNecessary(content::RenderFrameHostImpl*, bool, bool, bool, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1092:5
    #18 0x5891ec82cf1c in content::RenderFrameHostManager::DidNavigateFrame(content::RenderFrameHostImpl*, bool, bool, bool, blink::FramePolicy const&, bool, content::RenderFrameHostManager::ViewTransitionCommitInfo const&, base::optional_ref<GURL const, (partition_alloc::internal::RawPtrTraits)0>, bool) content/browser/renderer_host/render_frame_host_manager.cc:1037:3
    #19 0x5891ec67e8c0 in content::Navigator::DidNavigate(content::RenderFrameHostImpl*, content::mojom::DidCommitProvisionalLoadParams const&, std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, bool, bool) content/browser/renderer_host/navigator.cc:603:38
    #20 0x5891ec70faf0 in content::RenderFrameHostImpl::DidCommitNavigationInternal(std::__Cr::unique_ptr<content::NavigationRequest, std::__Cr::default_delete<content::NavigationRequest>>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitSameDocumentNavigationParams>, base::TimeTicks const&) content/browser/renderer_host/render_frame_host_impl.cc:16215:58
    #21 0x5891ec70a30d in content::RenderFrameHostImpl::DidCommitNavigation(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>) content/browser/renderer_host/render_frame_host_impl.cc:17128:8
    #22 0x5891ec7e052f in void base::internal::InvokeHelper<false, base::internal::FunctorTraits<void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, void, 0ul, 1ul>::MakeItSo<void (content::RenderFrameHostImpl::*)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), std::__Cr::tuple<base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>>(void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), std::__Cr::tuple<base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>&&) base/functional/bind_internal.h:740:12
    #23 0x5891ec7e0270 in base::internal::Invoker<base::internal::FunctorTraits<void (content::RenderFrameHostImpl::*&&)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), content::RenderFrameHostImpl*, content::NavigationRequest*&&>, base::internal::BindState<true, true, false, void (content::RenderFrameHostImpl::*)(content::NavigationRequest*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>), base::internal::UnretainedWrapper<content::RenderFrameHostImpl, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper<content::NavigationRequest, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>)>::RunOnce(base::internal::BindStateBase*, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadParams>&&, mojo::StructPtr<content::mojom::DidCommitProvisionalLoadInterfaceParams>&&) base/functional/bind_internal.h:1069:14
    #24 0x5891e53857be in content::mojom::NavigationClient_CommitNavigation_ForwardToCallback::Accept(mojo::Message*) base/functional/callback.h:155:12
    #25 0x5891f8619d19 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1079:41
    #26 0x5891f8637291 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19
    #27 0x5891f861f973 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20
    #28 0x5891fb733833 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1199:24
    #29 0x5891fb735cb5 in base::internal::Invoker<base::internal::FunctorTraits<void (IPC::ChannelAssociatedGroupController::*&&)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), IPC::ChannelAssociatedGroupController*&&, mojo::Message&&, IPC::(anonymous namespace)::ScopedUrgentMessageNotification&&>, base::internal::BindState<true, true, false, void (IPC::ChannelAssociatedGroupController::*)(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification), scoped_refptr<IPC::ChannelAssociatedGroupController>, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #30 0x5891f785f4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #31 0x5891f78ce4ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #32 0x5891f78cd38a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #33 0x5891f7a7a164 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48
    #34 0x5891f78cfbd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #35 0x5891f77dab70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #36 0x5891eb12411c in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1103:18
    #37 0x5891eb12cacc in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:148:15

previously allocated by thread T0 (chrome) here:
    #0 0x5891df695934 in malloc (/chromium/chromium/src/out/asan/chrome+0x10df5934) (BuildId: 42c52701e3eebdcb)
    #1 0x7a49e0cbc5e8 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5a5e8) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)
    #2 0x7a49e0cd4f81 in g_slice_alloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x72f81) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)
    #3 0x7a49e0cd55b8 in g_slice_alloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x735b8) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)
    #4 0x7a49e0c34d4c in g_type_create_instance (/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x37d4c) (BuildId: d56c5a278ee6e10faea0a792cbbf7a764701a962)
    #5 0x7a49e0c18d2f  (/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x1bd2f) (BuildId: d56c5a278ee6e10faea0a792cbbf7a764701a962)
    #6 0x7a49e0c1a982 in g_object_new_valist (/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x1d982) (BuildId: d56c5a278ee6e10faea0a792cbbf7a764701a962)
    #7 0x7a49e0c1afd8 in g_object_new (/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x1dfd8) (BuildId: d56c5a278ee6e10faea0a792cbbf7a764701a962)
    #8 0x7649c6f02957 in gtk_file_chooser_dialog_new (/lib/x86_64-linux-gnu/libgtk-3.so.0+0x188957) (BuildId: 0fac6003588ded4bfc8ba157abb8aee2ff6b3fc2)
    #9 0x58920f7a78c1 in gtk::GtkFileChooserDialogNew(char const*, _GtkWindow*, GtkFileChooserAction, char const*, GtkResponseType, char const*, GtkResponseType) ui/gtk/gtk_compat.cc:66:12
    #10 0x58920f7cedc4 in gtk::SelectFileDialogLinuxGtk::CreateFileOpenHelper(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, base::FilePath const&, aura::Window*) ui/gtk/select_file_dialog_linux_gtk.cc:423:23
    #11 0x58920f7cb974 in gtk::SelectFileDialogLinuxGtk::CreateFileOpenDialog(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, base::FilePath const&, aura::Window*) ui/gtk/select_file_dialog_linux_gtk.cc:494:23
    #12 0x58920f7ca2f4 in gtk::SelectFileDialogLinuxGtk::SelectFileImpl(ui::SelectFileDialog::Type, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>> const&, base::FilePath const&, ui::SelectFileDialog::FileTypeInfo const*, int, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, aura::Window*, GURL const*) ui/gtk/select_file_dialog_linux_gtk.cc:279:16
    #13 0x5891ff81c10e in ui::SelectFileDialog::SelectFile(ui::SelectFileDialog::Type, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>> const&, base::FilePath const&, ui::SelectFileDialog::FileTypeInfo const*, int, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, aura::Window*, GURL const*) ui/shell_dialogs/select_file_dialog.cc:155:3
    #14 0x5891ff81ffbb in ui::SelectFileDialogLinuxPortal::OnPortalAvailable(std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>, base::FilePath, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::optional<GURL>, unsigned int) ui/shell_dialogs/select_file_dialog_linux_portal.cc:171:25
    #15 0x5891ff82a7db in void base::internal::DecayedFunctorTraits<void (ui::SelectFileDialogLinuxPortal::*)(std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>, base::FilePath, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::optional<GURL>, unsigned int), base::WeakPtr<ui::SelectFileDialogLinuxPortal>&&, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>&&, base::FilePath&&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>&&, std::__Cr::optional<GURL>&&>::Invoke<void (ui::SelectFileDialogLinuxPortal::*)(std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>, base::FilePath, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::optional<GURL>, unsigned int), base::WeakPtr<ui::SelectFileDialogLinuxPortal> const&, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>, base::FilePath, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::optional<GURL>, unsigned int>(void (ui::SelectFileDialogLinuxPortal::*)(std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>, base::FilePath, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::optional<GURL>, unsigned int), base::WeakPtr<ui::SelectFileDialogLinuxPortal> const&, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>&&, base::FilePath&&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>&&, std::__Cr::optional<GURL>&&, unsigned int&&) base/functional/bind_internal.h:740:12
    #16 0x5891ff82a53d in base::internal::Invoker<base::internal::FunctorTraits<void (ui::SelectFileDialogLinuxPortal::*&&)(std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>, base::FilePath, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::optional<GURL>, unsigned int), base::WeakPtr<ui::SelectFileDialogLinuxPortal>&&, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>&&, base::FilePath&&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>&&, std::__Cr::optional<GURL>&&>, base::internal::BindState<true, true, false, void (ui::SelectFileDialogLinuxPortal::*)(std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>, base::FilePath, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::optional<GURL>, unsigned int), base::WeakPtr<ui::SelectFileDialogLinuxPortal>, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>>, base::FilePath, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>, std::__Cr::optional<GURL>>, void (unsigned int)>::RunOnce(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:956:5
    #17 0x5891e11c3330 in dbus_xdg::RequestXdgDesktopPortal(dbus::Bus*, base::OnceCallback<void (unsigned int)>) base/functional/callback.h:155:12
    #18 0x5891ff81f3ec in ui::SelectFileDialogLinuxPortal::SelectFileImpl(ui::SelectFileDialog::Type, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>> const&, base::FilePath const&, ui::SelectFileDialog::FileTypeInfo const*, int, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, aura::Window*, GURL const*) ui/shell_dialogs/select_file_dialog_linux_portal.cc:152:3
    #19 0x5891ff81c10e in ui::SelectFileDialog::SelectFile(ui::SelectFileDialog::Type, std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>> const&, base::FilePath const&, ui::SelectFileDialog::FileTypeInfo const*, int, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, aura::Window*, GURL const*) ui/shell_dialogs/select_file_dialog.cc:155:3
    #20 0x5891eb90db94 in content::FileSystemChooser::CreateAndShow(content::RenderFrameHost*, content::FileSystemChooser::Options const&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<content::PathInfo, std::__Cr::allocator<content::PathInfo>>)>, content::FileSystemChooser::ScopedObjects) content/browser/file_system_access/file_system_chooser.cc:351:22
    #21 0x5891eb894825 in content::(anonymous namespace)::ShowFilePickerOnUIThread(content::FileSystemAccessPermissionContext*, url::Origin const&, content::GlobalRenderFrameHostId, content::FileSystemChooser::Options const&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<content::PathInfo, std::__Cr::allocator<content::PathInfo>>)>) content/browser/file_system_access/file_system_access_manager_impl.cc:259:3
    #22 0x5891eb891f30 in content::FileSystemAccessManagerImpl::SetDefaultPathAndShowPicker(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool) content/browser/file_system_access/file_system_access_manager_impl.cc:763:3
    #23 0x5891eb8afef7 in void base::internal::DecayedFunctorTraits<void (content::FileSystemAccessManagerImpl::*)(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool), base::WeakPtr<content::FileSystemAccessManagerImpl>&&, content::FileSystemAccessEntryFactory::BindingContext&&, mojo::StructPtr<blink::mojom::FilePickerOptions>&&, base::FilePath&&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>&&>::Invoke<void (content::FileSystemAccessManagerImpl::*)(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool), base::WeakPtr<content::FileSystemAccessManagerImpl> const&, content::FileSystemAccessEntryFactory::BindingContext, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool>(void (content::FileSystemAccessManagerImpl::*)(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool), base::WeakPtr<content::FileSystemAccessManagerImpl> const&, content::FileSystemAccessEntryFactory::BindingContext&&, mojo::StructPtr<blink::mojom::FilePickerOptions>&&, base::FilePath&&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>&&, bool&&) base/functional/bind_internal.h:740:12
    #24 0x5891eb8afc34 in base::internal::Invoker<base::internal::FunctorTraits<void (content::FileSystemAccessManagerImpl::*&&)(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool), base::WeakPtr<content::FileSystemAccessManagerImpl>&&, content::FileSystemAccessEntryFactory::BindingContext&&, mojo::StructPtr<blink::mojom::FilePickerOptions>&&, base::FilePath&&, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>&&>, base::internal::BindState<true, true, false, void (content::FileSystemAccessManagerImpl::*)(content::FileSystemAccessEntryFactory::BindingContext const&, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>, bool), base::WeakPtr<content::FileSystemAccessManagerImpl>, content::FileSystemAccessEntryFactory::BindingContext, mojo::StructPtr<blink::mojom::FilePickerOptions>, base::FilePath, base::OnceCallback<void (mojo::InlinedStructPtr<blink::mojom::FileSystemAccessError>, std::__Cr::vector<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>, std::__Cr::allocator<mojo::StructPtr<blink::mojom::FileSystemAccessEntry>>>)>>, void (bool)>::RunOnce(base::internal::BindStateBase*, bool) base/functional/bind_internal.h:956:5
    #25 0x5891e001c1ee in void base::internal::ReplyAdapter<std::__Cr::tuple<bool>, bool>(base::OnceCallback<void (bool)>, std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>*) base/functional/callback.h:155:12
    #26 0x5891e001c945 in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::OnceCallback<void (bool)>, std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>*), base::OnceCallback<void (bool)>&&, std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>*>, base::internal::BindState<false, true, false, void (*)(base::OnceCallback<void (bool)>, std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>*), base::OnceCallback<void (bool)>, base::internal::OwnedWrapper<std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>, std::__Cr::default_delete<std::__Cr::unique_ptr<std::__Cr::tuple<bool>, std::__Cr::default_delete<std::__Cr::tuple<bool>>>>>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #27 0x5891f78e92cb in base::internal::PostTaskAndReplyRelay::RunReply(base::internal::PostTaskAndReplyRelay) base/functional/callback.h:155:12
    #28 0x5891f78e903e in base::internal::Invoker<base::internal::FunctorTraits<void (*&&)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay&&>, base::internal::BindState<false, true, false, void (*)(base::internal::PostTaskAndReplyRelay), base::internal::PostTaskAndReplyRelay>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12
    #29 0x5891f785f4c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #30 0x5891f78ce4ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #31 0x5891f78cd38a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #32 0x5891f7a79828 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #33 0x5891f7a7cde8 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #34 0x7a49e0cb6718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)
    #35 0x7a49e0cb69a7  (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x549a7) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)
    #36 0x7a49e0cb6a3b in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54a3b) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d)
    #37 0x5891f7a79e43 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:770:30

SUMMARY: AddressSanitizer: heap-use-after-free (/chromium/chromium/src/out/asan/chrome+0x10df45c3) (BuildId: 42c52701e3eebdcb) in memcpy
Shadow bytes around the buggy address:
  0x77b9ddd69000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x77b9ddd69080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x77b9ddd69100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x77b9ddd69180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x77b9ddd69200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x77b9ddd69280: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fa
  0x77b9ddd69300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x77b9ddd69380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x77b9ddd69400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x77b9ddd69480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x77b9ddd69500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==3390==ADDITIONAL INFO

==3390==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5891fb72ce6d in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1138:13
    #1 0x5891f86b3b43 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13


Command line: `/chromium/chromium/src/out/asan/chrome --no-sandbox --no-first-run --no-default-browser-check --disable-gpu --in-process-gpu --ozone-platform=x11 --gtk-version=3 --password-store=basic --use-mock-keychain --enable-logging=stderr --v=0 --user-data-dir=/tmp/chrome-poc-profile.zrxRjq --window-position=0,0 --window-size=1280,1024 --flag-switches-begin --flag-switches-end --gpu-preferences=UAAAAAAAAAAoAQAEAAAAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAYAAAAAAAAABgAAAAAAAAAAQAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled http://127.0.0.1:8137/poc.html`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==3390==END OF ADDITIONAL INFO

==3390==ABORTING
[3425:3434:0520/223931.752575:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.
[3425:3434:0520/223931.752777:WARNING:net/extras/sqlite/sqlite_persistent_store_backend_base.cc:179] Failed to post task from FlushAndNotifyInBackground@net/extras/sqlite/sqlite_persistent_store_backend_base.cc:229 to client_task_runner_.