[.] Sanitizer coverage enabled. Counter map size: 7900654, Cmp map size: 262144 IMPORTANT DEBUGGING NOTE: each test is run inside its own process. For debugging a test inside a debugger, use the --gtest_filter= flag along with either --single-process-tests (to run the test in one launcher/browser process) or --single-process (to do the above, and also run Chrome in single-process mode). Using sharding settings from environment. This is shard 0/1 Using 1 parallel jobs. [.] Sanitizer coverage enabled. Counter map size: 7900654, Cmp map size: 262144 Note: Google Test filter = ScreenOrientationWidgetUAFBrowserTest.DetachLocalRootDuringOrientationChange [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from ScreenOrientationWidgetUAFBrowserTest, where TypeParam = [ RUN ] ScreenOrientationWidgetUAFBrowserTest.DetachLocalRootDuringOrientationChange [.] Sanitizer coverage enabled. Counter map size: 7900654, Cmp map size: 262144 [.] Sanitizer coverage enabled. Counter map size: 7900654, Cmp map size: 262144 [4946:4955:0612/194627.989091:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [4946:4955:0612/194628.039565:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [4946:4955:0612/194628.039671:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory DevTools listening on ws://127.0.0.1:32979/devtools/browser/be4aee20-6628-4a58-b158-fde41d863013 (content_browsertests:4946): dbind-WARNING **: 19:46:28.061: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory [4946:4946:0612/194628.101445:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [4967:4967:0612/194628.115377:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1655] drmGetDevices2() has not found any devices [4967:4967:0612/194628.125309:WARNING:sandbox/policy/linux/sandbox_linux.cc:405] InitializeSandbox() called with multiple threads in process gpu-process. [4967:4967:0612/194628.132878:WARNING:ui/gfx/linux/gbm_support_x11.cc:48] dri3 extension not supported. [.] Sanitizer coverage enabled. Counter map size: 7900654, Cmp map size: 262144 ================================================================= ==5027==ERROR: AddressSanitizer: heap-use-after-free on address 0x6f7d8248cda8 at pc 0x5b7b866bec1c bp 0x7ffc32ec5470 sp 0x7ffc32ec5468 READ of size 8 at 0x6f7d8248cda8 thread T0 (content_browser) #0 0x5b7b866bec1b in blink::WidgetBase::UpdateSurfaceAndScreenInfo(viz::LocalSurfaceId const&, gfx::Rect const&, display::ScreenInfos const&) base/allocator/partition_allocator/src/partition_alloc/pointers/raw_ptr.h:1022:48 #1 0x5b7b834e8c89 in blink::WebFrameWidgetImpl::ApplyVisualPropertiesSizing(blink::VisualProperties const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:2064:17 #2 0x5b7b834e69cd in blink::WebFrameWidgetImpl::UpdateVisualProperties(blink::VisualProperties const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:1941:3 #3 0x5b7b866ab6e9 in blink::WidgetBase::UpdateVisualProperties(blink::VisualProperties const&) third_party/blink/renderer/platform/widget/widget_base.cc:568:12 #4 0x5b7b7412a04f in blink::mojom::blink::WidgetStubDispatch::Accept(blink::mojom::blink::Widget*, mojo::Message*) gen/third_party/blink/public/mojom/widget/platform_widget.mojom-blink.cc:2396:13 #5 0x5b7b768c4a80 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54 #6 0x5b7b768e2a81 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #7 0x5b7b768caf03 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #8 0x5b7b7687718f in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1200:24 #9 0x5b7b768795b5 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #10 0x5b7b7753d0e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #11 0x5b7b775acd72 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #12 0x5b7b775abb1a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:345:40 #13 0x5b7b7742ecd2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #14 0x5b7b775ae4d4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:657:12 #15 0x5b7b774cc380 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #16 0x5b7b81bcdebc in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16 #17 0x5b7b7005e74f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:666:14 #18 0x5b7b7005f9ab in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:773:12 #19 0x5b7b70062861 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1165:10 #20 0x5b7b7005bfbb in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #21 0x5b7b7005c5ac in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #22 0x5b7b76086413 in content::LaunchTestsInternal(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:389:12 #23 0x5b7b76087181 in content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:518:10 #24 0x5b7b64414e7c in ContentTestMain content/test/content_test_launcher.cc:106:10 #25 0x71ed8442b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x6f7d8248cda8 is located 40 bytes inside of 1120-byte region [0x6f7d8248cd80,0x6f7d8248d1e0) freed by thread T0 (content_browser) here: #0 0x5b7b5e178d56 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/content_browsertests+0xf9c4d56) (BuildId: 478463998af16fa5) #1 0x5b7b834d0ca7 in blink::WebFrameWidgetImpl::Close(blink::DetachReason) third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x5b7b835803ef in blink::WebLocalFrameImpl::Close(blink::DetachReason) third_party/blink/renderer/core/frame/web_local_frame_impl.cc:800:20 #3 0x5b7b81a7e41c in content::RenderFrameImpl::FrameDetached(blink::DetachReason) content/renderer/render_frame_impl.cc:3873:11 #4 0x5b7b835cc6d9 in blink::LocalFrameClientImpl::Detached(blink::FrameDetachType) third_party/blink/renderer/core/frame/local_frame_client_impl.cc:381:11 #5 0x5b7b83198ad7 in blink::Frame::Detach(blink::FrameDetachType) third_party/blink/renderer/core/frame/frame.cc:172:12 #6 0x5b7b83445a2c in blink::RemoteFrame::DetachChildren() third_party/blink/renderer/core/frame/remote_frame.cc:918:12 #7 0x5b7b83444e6c in blink::RemoteFrame::DetachImpl(blink::FrameDetachType) third_party/blink/renderer/core/frame/remote_frame.cc:330:8 #8 0x5b7b831987ff in blink::Frame::Detach(blink::FrameDetachType) third_party/blink/renderer/core/frame/frame.cc:124:8 #9 0x5b7b8397d3ce in blink::HTMLFrameOwnerElement::DisconnectContentFrame() third_party/blink/renderer/core/html/html_frame_owner_element.cc:377:19 #10 0x5b7b832bc946 in blink::ChildFrameDisconnector::DisconnectCollectedFrameOwners() third_party/blink/renderer/core/dom/child_frame_disconnector.cc:65:14 #11 0x5b7b86a52816 in blink::ContainerNode::WillRemoveChild(blink::Node&) third_party/blink/renderer/core/dom/container_node.cc:871:10 #12 0x5b7b86a50bf1 in blink::ContainerNode::RemoveChild(blink::Node*, blink::ExceptionState&) third_party/blink/renderer/core/dom/container_node.cc:996:3 #13 0x5b7b87886137 in blink::(anonymous namespace)::v8_element::RemoveOperationCallback(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/core/v8/v8_element.cc:4494:17 #14 0x5b7b6fb0a653 in Builtins_CallApiCallbackGeneric crtstuff.c #15 0x5b7b6fb08940 in Builtins_InterpreterEntryTrampoline crtstuff.c #16 0x5b7b6fb056db in Builtins_JSEntryTrampoline crtstuff.c #17 0x5b7b6fb0542a in Builtins_JSEntry crtstuff.c #18 0x5b7b6ac87011 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22 #19 0x5b7b6ac85949 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle, v8::internal::DirectHandle, v8::base::Vector const>) v8/src/execution/execution.cc:565:10 #20 0x5b7b6a8d4fed in v8::Function::Call(v8::Isolate*, v8::Local, v8::Local, int, v8::Local*) v8/src/api/api.cc:5665:27 #21 0x5b7b81db0218 in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:851:48 #22 0x5b7b81cce736 in blink::bindings::CallbackInvokeHelper::Call(int, v8::Local*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:123:12 #23 0x5b7b8763364a in blink::V8EventListener::InvokeWithoutRunnabilityCheck(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::Event*) gen/third_party/blink/renderer/bindings/core/v8/v8_event_listener.cc:119:13 #24 0x5b7b81cf2528 in blink::JSBasedEventListener::Invoke(blink::ExecutionContext*, blink::Event*) third_party/blink/renderer/bindings/core/v8/js_based_event_listener.cc:189:5 #25 0x5b7b82a5388c in blink::EventTarget::FireEventListeners(blink::Event&, blink::EventTargetData*, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember, 1u>) third_party/blink/renderer/core/dom/events/event_target.cc:1081:15 #26 0x5b7b82a515a0 in blink::EventTarget::FireEventListeners(blink::Event&) third_party/blink/renderer/core/dom/events/event_target.cc:982:29 #27 0x5b7b82a51038 in blink::EventTarget::DispatchEventInternal(blink::Event&) third_party/blink/renderer/core/dom/events/event_target.cc:874:41 #28 0x5b7b831c549d in blink::LocalDOMWindow::SendOrientationChangeEvent() third_party/blink/renderer/core/frame/local_dom_window.cc:1142:25 #29 0x5b7b866be9e5 in blink::WidgetBase::UpdateSurfaceAndScreenInfo(viz::LocalSurfaceId const&, gfx::Rect const&, display::ScreenInfos const&) third_party/blink/renderer/platform/widget/widget_base.cc:1848:14 previously allocated by thread T0 (content_browser) here: #0 0x5b7b5e178151 in operator new(unsigned long) (/chromium/chromium/src/out/asan/content_browsertests+0xf9c4151) (BuildId: 478463998af16fa5) #1 0x5b7b834cebfb in std::__Cr::unique_ptr> std::__Cr::make_unique, blink::CrossVariantMojoAssociatedReceiver, scoped_refptr&, bool&, bool&, bool, bool&, 0>(blink::WebFrameWidgetImpl*&&, blink::CrossVariantMojoAssociatedRemote&&, blink::CrossVariantMojoAssociatedReceiver&&, scoped_refptr&, bool&, bool&, bool&&, bool&) third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x5b7b834cd555 in blink::WebFrameWidgetImpl::WebFrameWidgetImpl(base::PassKey, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, scoped_refptr, viz::FrameSinkId const&, bool, bool, bool, bool, bool) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:439:20 #3 0x5b7b835b14c5 in blink::WebFrameWidgetImpl* cppgc::MakeGarbageCollectedTrait::Call, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, scoped_refptr, viz::FrameSinkId const&, bool&, bool&, bool&, bool&, bool&>(cppgc::AllocationHandle&, base::PassKey&&, blink::CrossVariantMojoAssociatedRemote&&, blink::CrossVariantMojoAssociatedReceiver&&, blink::CrossVariantMojoAssociatedRemote&&, blink::CrossVariantMojoAssociatedReceiver&&, scoped_refptr&&, viz::FrameSinkId const&, bool&, bool&, bool&, bool&, bool&) v8/include/cppgc/allocation.h:290:32 #4 0x5b7b835a021f in blink::WebLocalFrameImpl::CreateFrameWidgetInternal(base::PassKey, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, viz::FrameSinkId const&, bool, bool, bool) v8/include/cppgc/allocation.h:328:7 #5 0x5b7b8357f45f in blink::WebLocalFrame::InitializeFrameWidget(blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, blink::CrossVariantMojoAssociatedRemote, blink::CrossVariantMojoAssociatedReceiver, viz::FrameSinkId const&, bool, bool, bool) third_party/blink/renderer/core/frame/web_local_frame_impl.cc:698:3 #6 0x5b7b81a4bc43 in content::(anonymous namespace)::InitializeFrameWidgetForFrame(blink::WebLocalFrame&, mojo::StructPtr, bool) content/renderer/render_frame_impl.cc:1308:34 #7 0x5b7b81a4a769 in content::RenderFrameImpl::CreateFrame(content::AgentSchedulingGroup&, base::TokenType const&, int, mojo::PendingAssociatedReceiver, mojo::PendingRemote, mojo::PendingAssociatedRemote, blink::WebView*, base::optional_ref, base::TokenType> const, (partition_alloc::internal::RawPtrTraits)0>, base::optional_ref, base::TokenType> const, (partition_alloc::internal::RawPtrTraits)0>, base::optional_ref, base::TokenType> const, (partition_alloc::internal::RawPtrTraits)0>, base::optional_ref, base::TokenType> const, (partition_alloc::internal::RawPtrTraits)0>, base::UnguessableToken const&, std::__Cr::optional const&, blink::mojom::TreeScopeType, mojo::StructPtr, mojo::StructPtr, mojo::StructPtr, bool, base::TokenType const&, mojo::StructPtr, bool) content/renderer/render_frame_impl.cc:1939:5 #8 0x5b7b81a35d41 in content::AgentSchedulingGroup::CreateFrame(mojo::StructPtr) content/renderer/agent_scheduling_group.cc:383:3 #9 0x5b7b6a6d0735 in content::mojom::AgentSchedulingGroupStubDispatch::Accept(content::mojom::AgentSchedulingGroup*, mojo::Message*) gen/content/common/agent_scheduling_group.mojom.cc:697:13 #10 0x5b7b768c4a80 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1085:54 #11 0x5b7b768e2a81 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #12 0x5b7b768caf03 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #13 0x5b7b7687718f in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ipc/ipc_mojo_bootstrap.cc:1200:24 #14 0x5b7b768795b5 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #15 0x5b7b7753d0e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #16 0x5b7b775acd72 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #17 0x5b7b775abb1a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:345:40 #18 0x5b7b7742ecd2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #19 0x5b7b775ae4d4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:657:12 #20 0x5b7b774cc380 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #21 0x5b7b81bcdebc in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16 #22 0x5b7b7005e74f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:666:14 #23 0x5b7b7005f9ab in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:773:12 #24 0x5b7b70062861 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1165:10 #25 0x5b7b7005bfbb in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #26 0x5b7b7005c5ac in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #27 0x5b7b76086413 in content::LaunchTestsInternal(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:389:12 #28 0x5b7b76087181 in content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:518:10 #29 0x5b7b64414e7c in ContentTestMain content/test/content_test_launcher.cc:106:10 Shadow bytes around the buggy address: 0x6f7d8248cb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x6f7d8248cb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x6f7d8248cc00: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x6f7d8248cc80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x6f7d8248cd00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa =>0x6f7d8248cd80: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd 0x6f7d8248ce00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x6f7d8248ce80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x6f7d8248cf00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x6f7d8248cf80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x6f7d8248d000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb WARNING: All log messages before absl::InitializeLog() is called are written to STDERR E0000 00:00:1781293589.317790 5027 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==5027==ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781293589.317907 5027 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==5027==Note: Please include this section with the ASan report. === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781293589.317943 5027 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781293589.317989 5027 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: #0 0x5b7b7686f900 in IPC::ChannelAssociatedGroupController::Accept(mojo::Message*) ipc/ipc_mojo_bootstrap.cc:1139:13 === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781293589.318008 5027 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781293589.318094 5027 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Command line: `/proc/self/exe --type=renderer --gpu-client-id=5 --no-sandbox --dom-automation --force-color-profile=srgb --ipc-connection-timeout=60 --enable-blink-features=OrientationEvent --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1779725768335899 --gpu-channel-request-start-time-ticks=1567819909700 --launch-time-ticks=1567819917541 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,10988809786273581838,12216705770568570799,262144 --enable-features=TestFeatureForBrowserTest1 --disable-features=IgnoreDuplicateNavs,TestFeatureForBrowserTest2 --variations-seed-version --pseudonymization-salt-handle=7,i,6396586236042195242,2063876593099575377,4 --trace-process-track-uuid=3190708990997080739` === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781293589.318130 5027 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781293589.318153 5027 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==5027==END OF ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781293589.318173 5027 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==5027==ABORTING === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31