IMPORTANT DEBUGGING NOTE: batches of tests are run inside their
own process. For debugging a test inside a debugger, use the
--gtest_filter=<your_test_name> flag along with
--single-process-tests.
Using sharding settings from environment. This is shard 0/1
Using 1 parallel jobs.
Note: Google Test filter = MenuRunnerImplTest.ReleaseDuringShowAtCausesUAFInOpenMenuImpl
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from MenuRunnerImplTest
[ RUN      ] MenuRunnerImplTest.ReleaseDuringShowAtCausesUAFInOpenMenuImpl

(views_unittests:2702): dbind-WARNING **: 08:04:55.765: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/229127/at-spi/bus_20: No such file or directory
=================================================================
==2702==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d35d0be75d0 at pc 0x5600ce2786ab bp 0x7ffdabbd5580 sp 0x7ffdabbd5578
READ of size 8 at 0x7d35d0be75d0 thread T0
    #0 0x5600ce2786aa in views::MenuItemView::GetSubmenu() gen/third_party/libc++/src/include/__memory/unique_ptr.h:266:112
    #1 0x5600ce258041 in views::MenuController::OpenMenuImpl(views::MenuItemView*, bool) ui/views/controls/menu/menu_controller.cc:2536:15
    #2 0x5600ce253547 in views::MenuController::CommitPendingSelection() ui/views/controls/menu/menu_controller.cc:2448:3
    #3 0x5600ce2448f0 in views::MenuController::SetSelection(views::MenuItemView*, int) ui/views/controls/menu/menu_controller.cc:1747:5
    #4 0x5600ce242ed9 in views::MenuController::Run(views::Widget*, views::MenuButtonController*, views::MenuItemView*, gfx::Rect const&, views::MenuAnchorPosition, ui::mojom::MenuSourceType, views::MenuController::MenuType, bool, aura::Window*) ui/views/controls/menu/menu_controller.cc:724:5
    #5 0x5600ce2915a7 in views::internal::MenuRunnerImpl::RunMenuAt(views::Widget*, views::MenuButtonController*, gfx::Rect const&, views::MenuAnchorPosition, ui::mojom::MenuSourceType, int, aura::Window*, std::__Cr::optional<gfx::RoundedCornersF>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>) ui/views/controls/menu/menu_runner_impl.cc:205:15
    #6 0x5600c28b8e81 in views::test::MenuRunnerImplTest_ReleaseDuringShowAtCausesUAFInOpenMenuImpl_Test::TestBody() ui/views/controls/menu/menu_runner_impl_interface.h:64:5
    #7 0x5600c3d17d8b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x5600c3d1aa37 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #9 0x5600c3d1cb43 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #10 0x5600c3d4c99a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #11 0x5600c3d4b3fe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #12 0x5600ce940bcc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #13 0x5600c3c98e31 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), views::ViewsTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<views::ViewsTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #14 0x5600ce94953b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #15 0x5600ce948e5b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #16 0x5600c3c9855d in views::ViewsTestSuite::RunTests() ui/views/views_test_suite.cc:39:10
    #17 0x5600c33d7034 in main ui/views/run_all_unittests_main.cc:10:44
    #18 0x7f95d2245249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7d35d0be75d0 is located 848 bytes inside of 1200-byte region [0x7d35d0be7280,0x7d35d0be7730)
freed by thread T0 here:
    #0 0x5600c2310c3d in operator delete(void*) (/chromium/chromium/src/out/asan/views_unittests+0x666bc3d) (BuildId: f3b8ae0156f3ec0c)
    #1 0x5600ce292cdb in views::internal::MenuRunnerImpl::~MenuRunnerImpl() gen/third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x5600ce292e13 in views::internal::MenuRunnerImpl::~MenuRunnerImpl() ui/views/controls/menu/menu_runner_impl.cc:272:35
    #3 0x5600ce292076 in views::internal::MenuRunnerImpl::OnMenuClosed(views::internal::MenuControllerDelegate::NotifyType, views::MenuItemView*, int) ui/views/controls/menu/menu_runner_impl.cc:246:5
    #4 0x5600ce244f6e in views::MenuController::ExitMenu() ui/views/controls/menu/menu_controller.cc:3553:13
    #5 0x5600ce290b73 in views::internal::MenuRunnerImpl::Release() ui/views/controls/menu/menu_runner_impl.cc:106:20
    #6 0x5600c28c4176 in base::internal::BindLambdaForTestingHelper<views::test::MenuRunnerImplTest_ReleaseDuringShowAtCausesUAFInOpenMenuImpl_Test::TestBody()::$_0, void (views::Widget*)>::Run(views::test::MenuRunnerImplTest_ReleaseDuringShowAtCausesUAFInOpenMenuImpl_Test::TestBody()::$_0 const&, views::Widget*) ui/views/controls/menu/menu_runner_unittest.cc:722:22
    #7 0x5600c28c4355 in base::internal::Invoker<base::internal::FunctorTraits<void (* const&)(views::test::MenuRunnerImplTest_ReleaseDuringShowAtCausesUAFInOpenMenuImpl_Test::TestBody()::$_0 const&, views::Widget*), views::test::MenuRunnerImplTest_ReleaseDuringShowAtCausesUAFInOpenMenuImpl_Test::TestBody()::$_0 const&>, base::internal::BindState<false, true, false, void (*)(views::test::MenuRunnerImplTest_ReleaseDuringShowAtCausesUAFInOpenMenuImpl_Test::TestBody()::$_0 const&, views::Widget*), views::test::MenuRunnerImplTest_ReleaseDuringShowAtCausesUAFInOpenMenuImpl_Test::TestBody()::$_0>, void (views::Widget*)>::Run(base::internal::BindStateBase*, views::Widget*) base/functional/bind_internal.h:673:12
    #8 0x5600c3c4ae3f in base::RepeatingCallback<void (views::Widget*)>::Run(views::Widget*) const & base/functional/callback.h:346:12
    #9 0x5600ce4acb5b in void base::ObserverList<views::AnyWidgetObserver, false, (base::ObserverListReentrancyPolicy)1, base::internal::CheckedObserverAdapter>::Notify<void (views::AnyWidgetObserver::*)(views::Widget*), views::Widget*>(T, views::Widget* const&) gen/third_party/libc++/src/include/__type_traits/invoke.h:90:27
    #10 0x5600ce4ad0e3 in views::internal::AnyWidgetObserverSingleton::OnAnyWidgetShown(views::Widget*) ui/views/widget/any_widget_observer_singleton.cc:25:1
    #11 0x5600ce4d6b1d in views::Widget::ShowInactive() ui/views/widget/widget.cc:2810:56
    #12 0x5600ce2a242e in views::MenuHost::ShowMenuHost(bool) ui/views/controls/menu/menu_host.cc:216:3
    #13 0x5600ce2a1cdd in views::MenuHost::InitMenuHost(views::MenuHost::InitParams const&) ui/views/controls/menu/menu_host.cc:205:3
    #14 0x5600ce29b9d3 in views::SubmenuView::ShowAt(views::MenuHost::InitParams const&) ui/views/controls/menu/submenu_view.cc:514:12
    #15 0x5600ce258039 in views::MenuController::OpenMenuImpl(views::MenuItemView*, bool) ui/views/controls/menu/menu_controller.cc:2530:25
    #16 0x5600ce253547 in views::MenuController::CommitPendingSelection() ui/views/controls/menu/menu_controller.cc:2448:3
    #17 0x5600ce2448f0 in views::MenuController::SetSelection(views::MenuItemView*, int) ui/views/controls/menu/menu_controller.cc:1747:5
    #18 0x5600ce242ed9 in views::MenuController::Run(views::Widget*, views::MenuButtonController*, views::MenuItemView*, gfx::Rect const&, views::MenuAnchorPosition, ui::mojom::MenuSourceType, views::MenuController::MenuType, bool, aura::Window*) ui/views/controls/menu/menu_controller.cc:724:5
    #19 0x5600ce2915a7 in views::internal::MenuRunnerImpl::RunMenuAt(views::Widget*, views::MenuButtonController*, gfx::Rect const&, views::MenuAnchorPosition, ui::mojom::MenuSourceType, int, aura::Window*, std::__Cr::optional<gfx::RoundedCornersF>, std::__Cr::optional<std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>>) ui/views/controls/menu/menu_runner_impl.cc:205:15
    #20 0x5600c28b8e81 in views::test::MenuRunnerImplTest_ReleaseDuringShowAtCausesUAFInOpenMenuImpl_Test::TestBody() ui/views/controls/menu/menu_runner_impl_interface.h:64:5
    #21 0x5600c3d17d8b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #22 0x5600c3d1aa37 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #23 0x5600c3d1cb43 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #24 0x5600c3d4c99a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #25 0x5600c3d4b3fe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #26 0x5600ce940bcc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #27 0x5600c3c98e31 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), views::ViewsTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<views::ViewsTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #28 0x5600ce94953b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #29 0x5600ce948e5b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10

previously allocated by thread T0 here:
    #0 0x5600c23103fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/views_unittests+0x666b3fd) (BuildId: f3b8ae0156f3ec0c)
    #1 0x5600c28b9307 in views::test::MenuRunnerTest::CreateMenuItemView() ui/views/view.h:306:3
    #2 0x5600c28b8c61 in views::test::MenuRunnerImplTest_ReleaseDuringShowAtCausesUAFInOpenMenuImpl_Test::TestBody() ui/views/controls/menu/menu_runner_unittest.cc:706:36
    #3 0x5600c3d17d8b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #4 0x5600c3d1aa37 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #5 0x5600c3d1cb43 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #6 0x5600c3d4c99a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #7 0x5600c3d4b3fe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x5600ce940bcc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #9 0x5600c3c98e31 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), views::ViewsTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<views::ViewsTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #10 0x5600ce94953b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #11 0x5600ce948e5b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #12 0x5600c3c9855d in views::ViewsTestSuite::RunTests() ui/views/views_test_suite.cc:39:10
    #13 0x5600c33d7034 in main ui/views/run_all_unittests_main.cc:10:44
    #14 0x7f95d2245249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/libc++/src/include/__memory/unique_ptr.h:266:112 in views::MenuItemView::GetSubmenu()
Shadow bytes around the buggy address:
  0x7d35d0be7300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d35d0be7380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d35d0be7400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d35d0be7480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d35d0be7500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d35d0be7580: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
  0x7d35d0be7600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d35d0be7680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d35d0be7700: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa
  0x7d35d0be7780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7d35d0be7800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2702==ADDITIONAL INFO

==2702==Note: Please include this section with the ASan report.
Task trace:


==2702==END OF ADDITIONAL INFO

==2702==ABORTING
[1/1] MenuRunnerImplTest.ReleaseDuringShowAtCausesUAFInOpenMenuImpl (CRASHED)
1 test crashed:
    MenuRunnerImplTest.ReleaseDuringShowAtCausesUAFInOpenMenuImpl (../../ui/views/controls/menu/menu_runner_unittest.cc:704)
Tests took 3 seconds.