[.] Sanitizer coverage enabled. Counter map size: 11270573, Cmp map size: 262144 Note: Google Test filter = InstallReplacementWebAppApiTest.UAF_CapturedByOpenPWA [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from InstallReplacementWebAppApiTest, where TypeParam = [ RUN ] InstallReplacementWebAppApiTest.UAF_CapturedByOpenPWA [.] Sanitizer coverage enabled. Counter map size: 11270573, Cmp map size: 262144 [.] Sanitizer coverage enabled. Counter map size: 11270573, Cmp map size: 262144 [12575:12592:0426/041831.977228:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory Gtk-Message: 04:18:32.217: Failed to load module "canberra-gtk-module" Gtk-Message: 04:18:32.226: Failed to load module "canberra-gtk-module" [12575:12592:0426/041832.270043:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [12575:12592:0426/041832.270273:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [12575:12592:0426/041832.270464:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [12575:12592:0426/041832.485725:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [12575:12592:0426/041832.583381:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory (browser_tests:12575): dbind-WARNING **: 04:18:32.607: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/229127/at-spi/bus_20: No such file or directory [.] Sanitizer coverage enabled. Counter map size: 11270573, Cmp map size: 262144 [12575:12592:0426/041832.778254:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [12575:12592:0426/041832.778451:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [12575:12575:0426/041833.189582:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12575:12575:0426/041833.189808:WARNING:device/bluetooth/dbus/bluez_dbus_manager.cc:209] Floss manager service not available, cannot set Floss enable/disable. [12575:12592:0426/041833.190074:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [12575:12575:0426/041833.206789:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12609:12609:0426/041833.217754:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [12575:12575:0426/041833.224665:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12575:12592:0426/041833.225259:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [12609:12609:0426/041833.235157:WARNING:ui/gfx/linux/gbm_support_x11.cc:48] dri3 extension not supported. [12575:12592:0426/041833.261713:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [12575:12592:0426/041833.262016:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [12575:12575:0426/041833.267023:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12575:12575:0426/041833.317034:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12575:12592:0426/041833.317428:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [12575:12575:0426/041833.363793:WARNING:dbus/property.cc:94] Failed to connect to PropertiesChangedsignal. [12575:12575:0426/041833.363886:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [12575:12575:0426/041833.363922:WARNING:dbus/property.cc:174] GetAll request failed for: org.freedesktop.UPower.Device [12575:12575:0426/041833.382464:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12575:12592:0426/041833.383030:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [12575:12575:0426/041833.432959:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12575:12592:0426/041833.433384:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/229127/bus: No such file or directory [12575:12575:0426/041833.453372:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [12575:12575:0426/041833.453438:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. [12575:12589:0426/041833.937626:ERROR:crypto/nss_util.cc:79] Failed to create /usr/local/google/home/vmiura/.local/share/pki/nssdb directory. ================================================================= ==12575==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ddabd92e500 at pc 0x5602322be609 bp 0x7ffdd431cb60 sp 0x7ffdd431cb58 READ of size 8 at 0x7ddabd92e500 thread T0 (browser_tests) #0 0x5602322be608 in web_app::WebAppProvider::GetForWebContents(content::WebContents*) chrome/browser/web_applications/web_app_provider.cc:135:49 #1 0x56023309a3a5 in web_app::CreateWebAppFromManifest(content::WebContents*, webapps::WebappInstallSource, base::OnceCallback, std::__Cr::allocator> const&, webapps::InstallResultCode)>, web_app::PwaInProductHelpState) chrome/browser/ui/web_applications/web_app_dialog_utils.cc:255:20 #2 0x56021aeec594 in extensions::(anonymous namespace)::OnWebAppInstallabilityChecked(base::WeakPtr, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>) chrome/browser/extensions/api/management/chrome_management_api_delegate_non_android.cc:256:7 #3 0x56021aeefc04 in void base::internal::DecayedFunctorTraits, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>), base::WeakPtr&&, base::OnceCallback&&, std::__Cr::unique_ptr>&&>::Invoke, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>), base::WeakPtr, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>>(void (*&&)(base::WeakPtr, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>), base::WeakPtr&&, base::OnceCallback&&, std::__Cr::unique_ptr>&&, web_app::InstallableCheckResult&&, std::__Cr::optional, std::__Cr::allocator>>&&) base/functional/bind_internal.h:673:12 #4 0x56021aeef952 in base::internal::Invoker, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>), base::WeakPtr&&, base::OnceCallback&&, std::__Cr::unique_ptr>&&>, base::internal::BindState, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>), base::WeakPtr, base::OnceCallback, std::__Cr::unique_ptr>>, void (web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>)>::RunOnce(base::internal::BindStateBase*, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>&&) base/functional/bind_internal.h:932:12 #5 0x560231e801c9 in void base::internal::DecayedFunctorTraits, std::__Cr::allocator>>)>, web_app::InstallableCheckResult&&, std::__Cr::optional, std::__Cr::allocator>>&&>::Invoke, std::__Cr::allocator>>)>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>>(base::OnceCallback, std::__Cr::allocator>>)>&&, web_app::InstallableCheckResult&&, std::__Cr::optional, std::__Cr::allocator>>&&) base/functional/callback.h:155:12 #6 0x560231e7fc1c in base::internal::Invoker, std::__Cr::allocator>>)>&&, web_app::InstallableCheckResult&&, std::__Cr::optional, std::__Cr::allocator>>&&>, base::internal::BindState, std::__Cr::allocator>>)>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:932:12 #7 0x5602321cbe1a in web_app::WebAppCommandManager::OnCommandComplete(base::PassKey, web_app::internal::CommandBase*, CommandResult, base::OnceCallback) base/functional/callback.h:155:12 #8 0x560231ebf2ec in web_app::internal::CommandBase::CompleteAndSelfDestructInternal(CommandResult, base::OnceCallback) chrome/browser/web_applications/commands/internal/command_internal.cc:120:22 #9 0x560231e7ba04 in web_app::WebAppCommand, std::__Cr::allocator>>>::CompleteAndSelfDestruct(CommandResult, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>, base::Location const&) chrome/browser/web_applications/commands/web_app_command.h:198:28 #10 0x560231e7d2ba in web_app::FetchInstallabilityForChromeManagement::OnAppLockGranted() chrome/browser/web_applications/commands/fetch_installability_for_chrome_management.cc:176:3 #11 0x560231e7e930 in base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #12 0x5602320e9fdd in void web_app::WebAppLockManager::GrantLockWithCallback(base::WeakPtr, base::OnceCallback) base/functional/callback.h:155:12 #13 0x5602320f1734 in void base::internal::Invoker, base::OnceCallback), base::WeakPtr&&, base::WeakPtr&&, base::OnceCallback&&>, base::internal::BindState, base::OnceCallback), base::WeakPtr, base::WeakPtr, base::OnceCallback>, void ()>::RunImpl, base::OnceCallback), std::__Cr::tuple, base::WeakPtr, base::OnceCallback>, 0ul, 1ul, 2ul>(void (web_app::WebAppLockManager::*&&)(base::WeakPtr, base::OnceCallback), std::__Cr::tuple, base::WeakPtr, base::OnceCallback>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:740:12 #14 0x56023239608b in web_app::(anonymous namespace)::CallIfHolderIsAlive(base::WeakPtr, base::OnceCallback) base/functional/callback.h:155:12 #15 0x56023239b7f8 in base::internal::Invoker, base::OnceCallback), base::WeakPtr&&, base::OnceCallback&&>, base::internal::BindState, base::OnceCallback), base::WeakPtr, base::OnceCallback>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #16 0x560237a6f2d6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #17 0x560237ae70e9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #18 0x560237ae5f5a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #19 0x560237c9eb18 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #20 0x560237ca20d8 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 #21 0x7fcabfd1c718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d) 0x7ddabd92e500 is located 0 bytes inside of 4848-byte region [0x7ddabd92e500,0x7ddabd92f7f0) freed by thread T0 (browser_tests) here: #0 0x56021153caad in operator delete(void*) (/chromium/chromium/src/out/asan/browser_tests+0x18590aad) (BuildId: eea87f5966b5f753) #1 0x56025225d560 in NavigateParams::~NavigateParams() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x5602523f4fad in chrome::AddWebContents(BrowserWindowInterface*, content::WebContents*, std::__Cr::unique_ptr>, GURL const&, WindowOpenDisposition, blink::mojom::WindowFeatures const&, NavigateParams::WindowAction, bool) chrome/browser/ui/browser_tabstrip.cc:112:1 #3 0x56021aeec4a5 in extensions::(anonymous namespace)::OnWebAppInstallabilityChecked(base::WeakPtr, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>) chrome/browser/extensions/api/management/chrome_management_api_delegate_non_android.cc:252:7 #4 0x56021aeefc04 in void base::internal::DecayedFunctorTraits, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>), base::WeakPtr&&, base::OnceCallback&&, std::__Cr::unique_ptr>&&>::Invoke, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>), base::WeakPtr, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>>(void (*&&)(base::WeakPtr, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>), base::WeakPtr&&, base::OnceCallback&&, std::__Cr::unique_ptr>&&, web_app::InstallableCheckResult&&, std::__Cr::optional, std::__Cr::allocator>>&&) base/functional/bind_internal.h:673:12 #5 0x56021aeef952 in base::internal::Invoker, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>), base::WeakPtr&&, base::OnceCallback&&, std::__Cr::unique_ptr>&&>, base::internal::BindState, base::OnceCallback, std::__Cr::unique_ptr>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>), base::WeakPtr, base::OnceCallback, std::__Cr::unique_ptr>>, void (web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>)>::RunOnce(base::internal::BindStateBase*, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>&&) base/functional/bind_internal.h:932:12 #6 0x560231e801c9 in void base::internal::DecayedFunctorTraits, std::__Cr::allocator>>)>, web_app::InstallableCheckResult&&, std::__Cr::optional, std::__Cr::allocator>>&&>::Invoke, std::__Cr::allocator>>)>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>>(base::OnceCallback, std::__Cr::allocator>>)>&&, web_app::InstallableCheckResult&&, std::__Cr::optional, std::__Cr::allocator>>&&) base/functional/callback.h:155:12 #7 0x560231e7fc1c in base::internal::Invoker, std::__Cr::allocator>>)>&&, web_app::InstallableCheckResult&&, std::__Cr::optional, std::__Cr::allocator>>&&>, base::internal::BindState, std::__Cr::allocator>>)>, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:932:12 #8 0x5602321cbe1a in web_app::WebAppCommandManager::OnCommandComplete(base::PassKey, web_app::internal::CommandBase*, CommandResult, base::OnceCallback) base/functional/callback.h:155:12 #9 0x560231ebf2ec in web_app::internal::CommandBase::CompleteAndSelfDestructInternal(CommandResult, base::OnceCallback) chrome/browser/web_applications/commands/internal/command_internal.cc:120:22 #10 0x560231e7ba04 in web_app::WebAppCommand, std::__Cr::allocator>>>::CompleteAndSelfDestruct(CommandResult, web_app::InstallableCheckResult, std::__Cr::optional, std::__Cr::allocator>>, base::Location const&) chrome/browser/web_applications/commands/web_app_command.h:198:28 #11 0x560231e7d2ba in web_app::FetchInstallabilityForChromeManagement::OnAppLockGranted() chrome/browser/web_applications/commands/fetch_installability_for_chrome_management.cc:176:3 #12 0x560231e7e930 in base::internal::Invoker&&>, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #13 0x5602320e9fdd in void web_app::WebAppLockManager::GrantLockWithCallback(base::WeakPtr, base::OnceCallback) base/functional/callback.h:155:12 #14 0x5602320f1734 in void base::internal::Invoker, base::OnceCallback), base::WeakPtr&&, base::WeakPtr&&, base::OnceCallback&&>, base::internal::BindState, base::OnceCallback), base::WeakPtr, base::WeakPtr, base::OnceCallback>, void ()>::RunImpl, base::OnceCallback), std::__Cr::tuple, base::WeakPtr, base::OnceCallback>, 0ul, 1ul, 2ul>(void (web_app::WebAppLockManager::*&&)(base::WeakPtr, base::OnceCallback), std::__Cr::tuple, base::WeakPtr, base::OnceCallback>&&, std::__Cr::integer_sequence) base/functional/bind_internal.h:740:12 #15 0x56023239608b in web_app::(anonymous namespace)::CallIfHolderIsAlive(base::WeakPtr, base::OnceCallback) base/functional/callback.h:155:12 #16 0x56023239b7f8 in base::internal::Invoker, base::OnceCallback), base::WeakPtr&&, base::OnceCallback&&>, base::internal::BindState, base::OnceCallback), base::WeakPtr, base::OnceCallback>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #17 0x560237a6f2d6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #18 0x560237ae70e9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #19 0x560237ae5f5a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #20 0x560237c9eb18 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #21 0x560237ca20d8 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 #22 0x7fcabfd1c718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d) previously allocated by thread T0 (browser_tests) here: #0 0x56021153c26d in operator new(unsigned long) (/chromium/chromium/src/out/asan/browser_tests+0x1859026d) (BuildId: eea87f5966b5f753) #1 0x56022def7964 in content::WebContentsImpl::CreateWithOpener(content::WebContents::CreateParams const&, content::RenderFrameHostImpl*) content/public/browser/web_contents.h:178:3 #2 0x56021aeeb7a9 in extensions::ChromeManagementAPIDelegate::InstallOrLaunchReplacementWebApp(content::BrowserContext*, GURL const&, base::OnceCallback) const chrome/browser/extensions/api/management/chrome_management_api_delegate_non_android.cc:370:7 #3 0x56022fa73d82 in extensions::ManagementInstallReplacementWebAppFunction::Run() extensions/browser/api/management/management_api.cc:1118:17 #4 0x56022f257b7f in ExtensionFunction::RunWithValidation() extensions/browser/extension_function.cc:494:10 #5 0x56022f268e52 in extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal(mojo::StructPtr, content::RenderFrameHost*, content::RenderProcessHost&, base::OnceCallback, std::__Cr::allocator> const&, mojo::StructPtr)>) extensions/browser/extension_function_dispatcher.cc:458:15 #6 0x56022f2699df in extensions::ExtensionFunctionDispatcher::DispatchForServiceWorker(mojo::StructPtr, int, base::OnceCallback, std::__Cr::allocator> const&, mojo::StructPtr)>) extensions/browser/extension_function_dispatcher.cc:248:3 #7 0x56022f3fb4d7 in extensions::ServiceWorkerHost::RequestWorker(mojo::StructPtr, base::OnceCallback, std::__Cr::allocator> const&, mojo::StructPtr)>) extensions/browser/service_worker/service_worker_host.cc:283:16 #8 0x56021ff41363 in extensions::mojom::ServiceWorkerHostStubDispatch::AcceptWithResponder(extensions::mojom::ServiceWorkerHost*, mojo::Message*, std::__Cr::unique_ptr>) gen/extensions/common/mojom/service_worker_host.mojom.cc:1720:13 #9 0x56023d8b94c0 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #10 0x56023d8d7201 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #11 0x56023d8bf823 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #12 0x56023d8e7158 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) mojo/public/cpp/bindings/lib/multiplex_router.cc:1204:42 #13 0x56023d8e5638 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/multiplex_router.cc:790:7 #14 0x56023d8d7201 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #15 0x56023d8aeb9a in mojo::Connector::DispatchMessage(mojo::ScopedHandleBase) mojo/public/cpp/bindings/lib/connector.cc:567:49 #16 0x56023d8b0220 in mojo::Connector::ReadAllAvailableMessages() mojo/public/cpp/bindings/lib/connector.cc:628:14 #17 0x56023d8afc79 in mojo::Connector::OnWatcherHandleReady(char const*, unsigned int) mojo/public/cpp/bindings/lib/connector.cc:453:3 #18 0x56023d8b1ad4 in base::internal::Invoker, base::internal::BindState, base::internal::UnretainedWrapper>, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) base/functional/bind_internal.h:740:12 #19 0x56021eaa289e in base::RepeatingCallback::Run(unsigned int) const & base/functional/callback.h:346:12 #20 0x56021eaa263a in base::internal::Invoker const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback const&>, base::internal::BindState const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback>, void (unsigned int, mojo::HandleSignalsState const&)>::Run(base::internal::BindStateBase*, unsigned int, mojo::HandleSignalsState const&) base/functional/bind_internal.h:673:12 #21 0x56023affa330 in base::RepeatingCallback::Run(unsigned int, mojo::HandleSignalsState const&) const & base/functional/callback.h:346:12 #22 0x56023aff9c70 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) mojo/public/cpp/system/simple_watcher.cc:286:14 #23 0x56023affae37 in base::internal::Invoker&&, int&&, unsigned int&&, mojo::HandleSignalsState&&>, base::internal::BindState, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #24 0x560237a6f2d6 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #25 0x560237ae70e9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #26 0x560237ae5f5a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #27 0x560237c9f454 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:782:48 #28 0x560237ae87f7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #29 0x5602379ec490 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 Shadow bytes around the buggy address: 0x7ddabd92e280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddabd92e300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7ddabd92e380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7ddabd92e400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7ddabd92e480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa =>0x7ddabd92e500:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddabd92e580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddabd92e600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddabd92e680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddabd92e700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7ddabd92e780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb WARNING: All log messages before absl::InitializeLog() is called are written to STDERR E0000 00:00:1777177122.265154 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==12575==ADDITIONAL INFO E0000 00:00:1777177122.265305 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==12575==Note: Please include this section with the ASan report. E0000 00:00:1777177122.265442 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace: E0000 00:00:1777177122.266118 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: #0 0x5602323951d3 in web_app::PartitionedLockManager::AcquireNextLockOrPostCompletion(std::__Cr::unique_ptr, std::__Cr::vector>>, std::__Cr::default_delete, std::__Cr::vector>>>>, std::__Cr::__wrap_iter, base::WeakPtr, base::OnceCallback, base::Location const&) chrome/browser/web_applications/locks/partitioned_lock_manager.cc:246:28 E0000 00:00:1777177122.266524 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: #1 0x56022cd850ee in content::ManifestIconDownloader::ScaleIcon(int, int, SkBitmap const&, base::OnceCallback) content/browser/manifest/manifest_icon_downloader.cc:152:7 E0000 00:00:1777177122.266698 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: #2 0x56022cd843d9 in content::ManifestIconDownloader::OnIconFetched(int, int, bool, base::WeakPtr, base::OnceCallback, bool, int, int, GURL const&, std::__Cr::vector> const&, std::__Cr::vector> const&) content/browser/manifest/manifest_icon_downloader.cc:132:9 E0000 00:00:1777177122.266862 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: #3 0x56023affa7a3 in mojo::SimpleWatcher::Context::Notify(unsigned int, MojoHandleSignalsState, unsigned int) mojo/public/cpp/system/simple_watcher.cc:103:13 E0000 00:00:1777177122.266900 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: E0000 00:00:1777177122.267140 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Command line: `out/asan/browser_tests --disable-gpu-process-for-dx12-info-collection --gtest_filter=InstallReplacementWebAppApiTest.UAF_CapturedByOpenPWA --no-sandbox --single-process-tests --test-launcher-timeout=120000 --user-data-dir=/tmp/org.chromium.Chromium.scoped_dir.eZ015e --disable-auto-reload --disable-renderer-backgrounding --no-first-run --enable-logging=stderr --disable-default-apps --wm-window-animations-disabled --password-store=basic --disable-component-update --change-stack-guard-on-fork=disable --test-type=browser --disable-zero-browsers-open-for-tests --ip-address-space-overrides=127.0.0.1:0=public,[::1]:0=public --use-fake-device-for-media-stream --browser-test --ipc-connection-timeout=60 --log-missing-unload-ack --dom-automation --log-gpu-control-list-decisions --disable-d3d11-warp --disable-backgrounding-occluded-windows --disable-ignore-duplicate-navs-for-testing --disable-gl-drawing-for-tests --override-use-software-gl-for-tests --force-color-profile=srgb --enable-features=*TestBlinkFeatureDefault,TestFeatureForBrowserTest1 --disable-features=ExtensionDisableUnsupportedDeveloper,PreconnectToSearch,Prewarm,RestartNetworkServiceUnsandboxedForFailedLaunch,SessionRestoreInfobar,TestFeatureForBrowserTest2 --disable-gpu-process-for-dx12-info-collection --disable-platform-accessibility-integration --flag-switches-begin --flag-switches-end --ozone-platform=x11 about:blank` E0000 00:00:1777177122.267206 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: MiraclePtr Status: NOT PROTECTED No raw_ptr access to this region was detected prior to this crash. This crash is still exploitable with MiraclePtr. Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details. E0000 00:00:1777177122.267291 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==12575==END OF ADDITIONAL INFO E0000 00:00:1777177122.267339 12575 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==12575==ABORTING