==9434==ERROR: AddressSanitizer: heap-use-after-free on address 0x78aaa9b508a8 at pc 0x5f49a4289b47 bp 0x7ffd799f0a70 sp 0x7ffd799f0a68 READ of size 4 at 0x78aaa9b508a8 thread T0 (interactive_ui_) #0 0x5f49a4289b46 in TabDragController::DragBrowserToNewTabStrip(TabDragContext*, gfx::Point const&) chrome/browser/ui/views/tabs/dragging/tab_drag_controller.cc:1033:7 #1 0x5f49a42856a9 in TabDragController::ContinueDragging(gfx::Point const&) chrome/browser/ui/views/tabs/dragging/tab_drag_controller.cc:995:12 #2 0x5f49a427fcab in TabDragController::Drag(gfx::Point const&) chrome/browser/ui/views/tabs/dragging/tab_drag_controller.cc:743:10 #3 0x5f49a43ab384 in TabStrip::TabDragContextImpl::OnGestureEvent(ui::GestureEvent*) chrome/browser/ui/views/tabs/tab_strip.cc:389:27 #4 0x5f49868ee467 in TabDragControllerTest_TransferEventsToReentrantDestructionInNewTabStrip_Test::RunTestOnMainThread() chrome/browser/ui/views/tabs/dragging/tab_drag_controller_interactive_uitest.cc:675:32 #5 0x5f49a4c40dd5 in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop() content/public/test/browser_test_base.cc:1018:9 #6 0x5f49a4c45a91 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #7 0x5f499577661a in content::BrowserMainLoop::RunMainMessageLoop() base/functional/callback.h:155:12 #8 0x5f499577f1ec in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:148:15 #9 0x5f499576d56c in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28 #10 0x5f499e13168a in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10 #11 0x5f499e135858 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1331:10 #12 0x5f499e134ce3 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12 #13 0x5f499e12e4bb in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #14 0x5f499e12eaac in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #15 0x5f49a4c3eb92 in content::BrowserTestBase::SetUp() content/public/test/browser_test_base.cc:615:34 #16 0x5f49a2e4da0b in InProcessBrowserTest::SetUp() chrome/test/base/in_process_browser_test.cc:559:20 #17 0x5f499b855a61 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #18 0x5f499b858d37 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #19 0x5f499b85ae33 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #20 0x5f499b88a9fa in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #21 0x5f499b8894ce in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #22 0x5f49be22e3cc in base::TestSuite::Run() base/test/test_suite.cc:440:16 #23 0x5f49a2dd88f3 in ChromeTestSuiteRunner::RunTestSuiteInternal(ChromeTestSuite*) chrome/test/base/chrome_test_launcher.cc:101:22 #24 0x5f4985b7e070 in InteractiveUITestSuiteRunner::RunTestSuite(int, char**) chrome/test/base/interactive_ui_tests_main.cc:152:12 #25 0x5f49a4d7ee72 in content::LaunchTestsInternal(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:423:31 #26 0x5f49a4d7f8a1 in content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:518:10 #27 0x5f49a2dd9491 in LaunchChromeTests(unsigned long, content::TestLauncherDelegate*, int, char**) chrome/test/base/chrome_test_launcher.cc:360:10 #28 0x5f4985b7de7e in main chrome/test/base/interactive_ui_tests_main.cc:209:10 #29 0x7b4aab82b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x78aaa9b508a8 is located 40 bytes inside of 624-byte region [0x78aaa9b50880,0x78aaa9b50af0) freed by thread T0 (interactive_ui_) here: #0 0x5f49850d1c56 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/interactive_ui_tests+0x14820c56) (BuildId: bc0a4719653bace8) #1 0x5f49a42866eb in TabDragController::EndDragImpl(TabDragController::EndDragType) chrome/browser/ui/views/tabs/dragging/tab_drag_controller.cc:1901:19 #2 0x5f49a427ec1c in TabDragController::EndDrag(EndDragReason) chrome/browser/ui/views/tabs/dragging/tab_drag_controller.cc #3 0x5f49a43ab420 in TabStrip::TabDragContextImpl::OnGestureEvent(ui::GestureEvent*) chrome/browser/ui/views/tabs/tab_strip.cc:401:23 #4 0x5f49869a0913 in (anonymous namespace)::ReentrantDragEnder::DispatchSyntheticTouchEvent(ui::TouchEvent*) chrome/browser/ui/views/tabs/dragging/tab_drag_controller_interactive_uitest.cc:905:44 #5 0x5f49ad121ee6 in ui::GestureRecognizerImpl::CancelActiveTouchesImpl(ui::GestureConsumer*) ui/events/gestures/gesture_recognizer_impl.cc:395:13 #6 0x5f49ad121984 in ui::GestureRecognizerImpl::CancelActiveTouchesExceptImpl(ui::GestureConsumer*) ui/events/gestures/gesture_recognizer_impl.cc:374:7 #7 0x5f49ad12245a in ui::GestureRecognizerImpl::TransferEventsTo(ui::GestureConsumer*, ui::GestureConsumer*, ui::TransferTouchesBehavior) ui/events/gestures/gesture_recognizer_impl.cc:194:3 #8 0x5f49a4289475 in TabDragController::DragBrowserToNewTabStrip(TabDragContext*, gfx::Point const&) chrome/browser/ui/views/tabs/dragging/tab_drag_controller.cc:1028:55 #9 0x5f49a42856a9 in TabDragController::ContinueDragging(gfx::Point const&) chrome/browser/ui/views/tabs/dragging/tab_drag_controller.cc:995:12 #10 0x5f49a427fcab in TabDragController::Drag(gfx::Point const&) chrome/browser/ui/views/tabs/dragging/tab_drag_controller.cc:743:10 #11 0x5f49a43ab384 in TabStrip::TabDragContextImpl::OnGestureEvent(ui::GestureEvent*) chrome/browser/ui/views/tabs/tab_strip.cc:389:27 #12 0x5f49868ee467 in TabDragControllerTest_TransferEventsToReentrantDestructionInNewTabStrip_Test::RunTestOnMainThread() chrome/browser/ui/views/tabs/dragging/tab_drag_controller_interactive_uitest.cc:675:32 #13 0x5f49a4c40dd5 in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop() content/public/test/browser_test_base.cc:1018:9 #14 0x5f49a4c45a91 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #15 0x5f499577661a in content::BrowserMainLoop::RunMainMessageLoop() base/functional/callback.h:155:12 #16 0x5f499577f1ec in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:148:15 #17 0x5f499576d56c in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28 #18 0x5f499e13168a in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10 #19 0x5f499e135858 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1331:10 #20 0x5f499e134ce3 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12 #21 0x5f499e12e4bb in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #22 0x5f499e12eaac in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #23 0x5f49a4c3eb92 in content::BrowserTestBase::SetUp() content/public/test/browser_test_base.cc:615:34 #24 0x5f49a2e4da0b in InProcessBrowserTest::SetUp() chrome/test/base/in_process_browser_test.cc:559:20 #25 0x5f499b855a61 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #26 0x5f499b858d37 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #27 0x5f499b85ae33 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #28 0x5f499b88a9fa in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #29 0x5f499b8894ce in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc previously allocated by thread T0 (interactive_ui_) here: #0 0x5f49850d1051 in operator new(unsigned long) (/chromium/chromium/src/out/asan/interactive_ui_tests+0x14820051) (BuildId: bc0a4719653bace8) #1 0x5f49a43a1cbc in TabStrip::TabDragContextImpl::MaybeStartDrag(TabSlotView*, ui::LocatedEvent const&, ui::ListSelectionModel) third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x5f49a43a0b45 in TabStrip::MaybeStartDrag(TabSlotView*, ui::LocatedEvent const&, ui::ListSelectionModel) chrome/browser/ui/views/tabs/tab_strip.cc:1917:18 #3 0x5f49868edd05 in TabDragControllerTest_TransferEventsToReentrantDestructionInNewTabStrip_Test::RunTestOnMainThread() chrome/browser/ui/views/tabs/dragging/tab_drag_controller_interactive_uitest.cc:940:14 #4 0x5f49a4c40dd5 in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop() content/public/test/browser_test_base.cc:1018:9 #5 0x5f49a4c45a91 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #6 0x5f499577661a in content::BrowserMainLoop::RunMainMessageLoop() base/functional/callback.h:155:12 #7 0x5f499577f1ec in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:148:15 #8 0x5f499576d56c in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28 #9 0x5f499e13168a in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:697:10 #10 0x5f499e135858 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1331:10 #11 0x5f499e134ce3 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1162:12 #12 0x5f499e12e4bb in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #13 0x5f499e12eaac in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #14 0x5f49a4c3eb92 in content::BrowserTestBase::SetUp() content/public/test/browser_test_base.cc:615:34 #15 0x5f49a2e4da0b in InProcessBrowserTest::SetUp() chrome/test/base/in_process_browser_test.cc:559:20 #16 0x5f499b855a61 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #17 0x5f499b858d37 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #18 0x5f499b85ae33 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #19 0x5f499b88a9fa in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #20 0x5f499b8894ce in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #21 0x5f49be22e3cc in base::TestSuite::Run() base/test/test_suite.cc:440:16 #22 0x5f49a2dd88f3 in ChromeTestSuiteRunner::RunTestSuiteInternal(ChromeTestSuite*) chrome/test/base/chrome_test_launcher.cc:101:22 #23 0x5f4985b7e070 in InteractiveUITestSuiteRunner::RunTestSuite(int, char**) chrome/test/base/interactive_ui_tests_main.cc:152:12 #24 0x5f49a4d7ee72 in content::LaunchTestsInternal(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:423:31 #25 0x5f49a4d7f8a1 in content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:518:10 #26 0x5f49a2dd9491 in LaunchChromeTests(unsigned long, content::TestLauncherDelegate*, int, char**) chrome/test/base/chrome_test_launcher.cc:360:10 #27 0x5f4985b7de7e in main chrome/test/base/interactive_ui_tests_main.cc:209:10 #28 0x7b4aab82b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) Shadow bytes around the buggy address: 0x78aaa9b50600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x78aaa9b50680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x78aaa9b50700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x78aaa9b50780: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa 0x78aaa9b50800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa =>0x78aaa9b50880: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd 0x78aaa9b50900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x78aaa9b50980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x78aaa9b50a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x78aaa9b50a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa 0x78aaa9b50b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb WARNING: All log messages before absl::InitializeLog() is called are written to STDERR E0000 00:00:1779886936.667680 9434 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==9434==ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779886936.667763 9434 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==9434==Note: Please include this section with the ASan report. === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779886936.667803 9434 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779886936.667837 9434 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779886936.667996 9434 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Command line: `./out/asan/interactive_ui_tests --disable-gpu-process-for-dx12-info-collection --gtest_filter=TabDragControllerTest.TransferEventsToReentrantDestructionInNewTabStrip --no-sandbox --single-process-tests --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.HN4ENb --disable-auto-reload --no-first-run --enable-logging=stderr --disable-default-apps --wm-window-animations-disabled --password-store=basic --disable-component-update --change-stack-guard-on-fork=disable --test-type=browser --disable-zero-browsers-open-for-tests --disable-updater-scheduler --ip-address-space-overrides=127.0.0.1:0=public,[::1]:0=public --use-fake-device-for-media-stream --browser-test --ipc-connection-timeout=60 --log-missing-unload-ack --dom-automation --log-gpu-control-list-decisions --disable-d3d11-warp --disable-backgrounding-occluded-windows --disable-ignore-duplicate-navs-for-testing --disable-gl-drawing-for-tests --override-use-software-gl-for-tests --force-color-profile=srgb --enable-features=*TestBlinkFeatureDefault,TestFeatureForBrowserTest1 --disable-features=ExtensionDisableUnsupportedDeveloper,PreconnectToSearch,RestartNetworkServiceUnsandboxedForFailedLaunch,SessionRestoreInfobar,TestFeatureForBrowserTest2 --disable-gpu-process-for-dx12-info-collection --disable-platform-accessibility-integration --ozone-platform=x11 --flag-switches-begin --flag-switches-end about:blank` === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779886936.668043 9434 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779886936.668075 9434 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==9434==END OF ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779886936.668103 9434 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==9434==ABORTING === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31