[.] Sanitizer coverage enabled. Counter map size: 2629819, Cmp map size: 262144 Note: Google Test filter = *DatagramBypassReentrancyUAF_MaybeAggregate*/IS_CLIENT [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from Tests/QuicUnackedPacketMapTest [ RUN ] Tests/QuicUnackedPacketMapTest.DatagramBypassReentrancyUAF_MaybeAggregateAckedStreamFrame/IS_CLIENT ================================================================= ==3762==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b9e9993b6e8 at pc 0x5645f3735349 bp 0x7ffc969e7270 sp 0x7ffc969e7268 READ of size 1 at 0x7b9e9993b6e8 thread T0 #0 0x5645f3735348 in quic::QuicUnackedPacketMap::MaybeAggregateAckedStreamFrame(quic::QuicPacketNumber, quic::QuicTimeDelta, quic::QuicTime, quic::QuicTransmissionInfo*&) net/third_party/quiche/src/quiche/quic/core/quic_unacked_packet_map.cc:572:15 #1 0x5645efed9b70 in quic::test::(anonymous namespace)::QuicUnackedPacketMapTest_DatagramBypassReentrancyUAF_MaybeAggregateAckedStreamFrame_Test::TestBody() net/third_party/quiche/src/quiche/quic/core/quic_unacked_packet_map_test.cc:1012:20 #2 0x5645f13217ab in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x5645f1324967 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x5645f1326a73 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x5645f1356a9a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x5645f13554fe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x5645f3ea553c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x5645eaabf641 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #9 0x5645f3ec1bcb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #10 0x5645f3ec14eb in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #11 0x5645eaabf339 in main net/test/run_all_unittests.cc:53:10 #12 0x7f5e9a2f4249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7b9e9993b6e8 is located 24 bytes inside of 48-byte region [0x7b9e9993b6d0,0x7b9e9993b700) freed by thread T0 here: #0 0x5645e64ef4b2 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/net_unittests+0x50e04b2) (BuildId: ac013af358a70fd3) #1 0x5645f35e1db2 in quiche::QuicheCircularDeque>::Relocate(unsigned long) net/third_party/quiche/src/quiche/common/quiche_circular_deque.h:715:15 #2 0x5645f3730810 in quic::QuicUnackedPacketMap::AddSentPacket(quic::SerializedPacket*, quic::TransmissionType, quic::QuicTime, bool, bool, quic::QuicEcnCodepoint) net/third_party/quiche/src/quiche/common/quiche_circular_deque.h:594:5 #3 0x5645efed8e0f in quic::test::(anonymous namespace)::ReentrantNotifier::OnFrameAcked(quic::QuicFrame const&, quic::QuicTimeDelta, quic::QuicTime, bool) net/third_party/quiche/src/quiche/quic/core/quic_unacked_packet_map_test.cc:888:13 #4 0x5645f3734c51 in quic::QuicUnackedPacketMap::MaybeAggregateAckedStreamFrame(quic::QuicPacketNumber, quic::QuicTimeDelta, quic::QuicTime, quic::QuicTransmissionInfo*&) net/third_party/quiche/src/quiche/quic/core/quic_unacked_packet_map.cc:597:26 #5 0x5645efed9b70 in quic::test::(anonymous namespace)::QuicUnackedPacketMapTest_DatagramBypassReentrancyUAF_MaybeAggregateAckedStreamFrame_Test::TestBody() net/third_party/quiche/src/quiche/quic/core/quic_unacked_packet_map_test.cc:1012:20 #6 0x5645f13217ab in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x5645f1324967 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #8 0x5645f1326a73 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #9 0x5645f1356a9a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #10 0x5645f13554fe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #11 0x5645f3ea553c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #12 0x5645eaabf641 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #13 0x5645f3ec1bcb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #14 0x5645f3ec14eb in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #15 0x5645eaabf339 in main net/test/run_all_unittests.cc:53:10 #16 0x7f5e9a2f4249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x5645e64ee8ad in operator new(unsigned long) (/chromium/chromium/src/out/asan/net_unittests+0x50df8ad) (BuildId: ac013af358a70fd3) #1 0x5645e9c966dd in quic::QuicFrame& absl::inlined_vector_internal::Storage>::EmplaceBackSlow(quic::QuicFrame&&) gen/third_party/libc++/src/include/__new/allocate.h:43:28 #2 0x5645efed9cc2 in quic::test::(anonymous namespace)::QuicUnackedPacketMapTest_DatagramBypassReentrancyUAF_MaybeAggregateAckedStreamFrame_Test::TestBody() third_party/abseil-cpp/absl/container/internal/inlined_vector.h:829:10 #3 0x5645f13217ab in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #4 0x5645f1324967 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #5 0x5645f1326a73 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #6 0x5645f1356a9a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #7 0x5645f13554fe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x5645f3ea553c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #9 0x5645eaabf641 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #10 0x5645f3ec1bcb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #11 0x5645f3ec14eb in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #12 0x5645eaabf339 in main net/test/run_all_unittests.cc:53:10 #13 0x7f5e9a2f4249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) Shadow bytes around the buggy address: 0x7b9e9993b400: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fd 0x7b9e9993b480: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa 0x7b9e9993b500: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd 0x7b9e9993b580: fa fa 00 00 00 07 fc fc fa fa 00 00 00 00 00 06 0x7b9e9993b600: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fd =>0x7b9e9993b680: fa fa fd fd fd fd fd fd fa fa fd fd fd[fd]fd fd 0x7b9e9993b700: fa fa 00 00 00 00 00 00 fa fa fa fa fa fa fa fa 0x7b9e9993b780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7b9e9993b800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7b9e9993b880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7b9e9993b900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb WARNING: All log messages before absl::InitializeLog() is called are written to STDERR E0000 00:00:1775227874.679428 3762 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==3762==ADDITIONAL INFO E0000 00:00:1775227874.679674 3762 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==3762==Note: Please include this section with the ASan report. E0000 00:00:1775227874.679754 3762 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace: E0000 00:00:1775227874.679827 3762 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: E0000 00:00:1775227874.679888 3762 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==3762==END OF ADDITIONAL INFO E0000 00:00:1775227874.679975 3762 runtime.cc:175] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==3762==ABORTING