[.] Sanitizer coverage enabled. Counter map size: 12114806, Cmp map size: 262144 Note: Google Test filter = ClipboardProviderTest.ImageMatchFreedDuringThreadPoolEncode [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from ClipboardProviderTest [ RUN ] ClipboardProviderTest.ImageMatchFreedDuringThreadPoolEncode ================================================================= ==1312==ERROR: AddressSanitizer: heap-use-after-free on address 0x7815ae433900 at pc 0x638050c01626 bp 0x7ffcf0015af0 sp 0x7ffcf0015ae8 WRITE of size 1 at 0x7815ae433900 thread T0 #0 0x638050c01625 in GURL::operator=(GURL&&) url/gurl.cc:150:13 #1 0x63806805a1ab in ClipboardProvider::OnReceiveImageMatchForMatchWithContent(base::OnceCallback, AutocompleteMatch*, std::__Cr::optional) components/omnibox/browser/clipboard_provider.cc:509:26 #2 0x63806805cd0d in void base::internal::DecayedFunctorTraits, AutocompleteMatch*, std::__Cr::optional), base::WeakPtr&&, base::OnceCallback&&, AutocompleteMatch*&&>::Invoke, AutocompleteMatch*, std::__Cr::optional), base::WeakPtr const&, base::OnceCallback, AutocompleteMatch*, std::__Cr::optional>(void (ClipboardProvider::*)(base::OnceCallback, AutocompleteMatch*, std::__Cr::optional), base::WeakPtr const&, base::OnceCallback&&, AutocompleteMatch*&&, std::__Cr::optional&&) base/functional/bind_internal.h:740:12 #3 0x63806805ca24 in base::internal::Invoker, AutocompleteMatch*, std::__Cr::optional), base::WeakPtr&&, base::OnceCallback&&, AutocompleteMatch*&&>, base::internal::BindState, AutocompleteMatch*, std::__Cr::optional), base::WeakPtr, base::OnceCallback, base::internal::UnretainedWrapper>, void (std::__Cr::optional)>::RunOnce(base::internal::BindStateBase*, std::__Cr::optional&&) base/functional/bind_internal.h:956:5 #4 0x638068058494 in ClipboardProvider::ConstructImageMatchCallback(base::OnceCallback)>, scoped_refptr) base/functional/callback.h:155:12 #5 0x63806805b106 in base::internal::Invoker)>, scoped_refptr), base::WeakPtr&&, base::OnceCallback)>&&>, base::internal::BindState)>, scoped_refptr), base::WeakPtr, base::OnceCallback)>>, void (scoped_refptr)>::RunOnce(base::internal::BindStateBase*, scoped_refptr&&) base/functional/bind_internal.h:740:12 #6 0x63806805e545 in std::__Cr::__invoke_result_impl::type std::__Cr::__invoke>, scoped_refptr>(base::OnceCallback)>, std::__Cr::unique_ptr>, std::__Cr::default_delete>>>*)::'lambda'(auto&&...), scoped_refptr>(auto&&...) base/functional/callback.h:155:12 #7 0x63806805da2b in void base::internal::ReplyAdapter>, scoped_refptr>(base::OnceCallback)>, std::__Cr::unique_ptr>, std::__Cr::default_delete>>>*) gen/third_party/libc++/src/include/tuple:1400:29 #8 0x63806805e0f5 in base::internal::Invoker)>, std::__Cr::unique_ptr>, std::__Cr::default_delete>>>*), base::OnceCallback)>&&, std::__Cr::unique_ptr>, std::__Cr::default_delete>>>*>, base::internal::BindState)>, std::__Cr::unique_ptr>, std::__Cr::default_delete>>>*), base::OnceCallback)>, base::internal::OwnedWrapper>, std::__Cr::default_delete>>>, std::__Cr::default_delete>, std::__Cr::default_delete>>>>>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #9 0x63804ff628eb in base::internal::PostTaskAndReplyRelay::RunReply(base::internal::PostTaskAndReplyRelay) base/functional/callback.h:155:12 #10 0x63804ff6265e in base::internal::Invoker, base::internal::BindState, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #11 0x63804fed7e33 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #12 0x63804ff474ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #13 0x63804ff4638a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #14 0x63804fdbd672 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55 #15 0x63804ff48bd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #16 0x63804fe5e110 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #17 0x63804fe6076c in base::RunLoop::RunUntilIdle() base/run_loop.cc:144:3 #18 0x638058a5b211 in base::test::TaskEnvironment::RunUntilIdle() base/test/task_environment.cc:773:51 #19 0x63802a7a2fe0 in ClipboardProviderTest_ImageMatchFreedDuringThreadPoolEncode_Test::TestBody() components/omnibox/browser/clipboard_provider_unittest.cc:416:21 #20 0x6380432c079b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #21 0x6380432c3817 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #22 0x6380432c5893 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #23 0x6380432f4a14 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #24 0x6380432f358a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #25 0x638058a721e0 in base::TestSuite::Run() base/test/test_suite.cc:440:16 #26 0x6380659edc15 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #27 0x63804b1c6680 in base::internal::Invoker>&&>, base::internal::BindState>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #28 0x638058a8b03b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #29 0x638058a8a95b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #30 0x7a55b0445249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7815ae433900 is located 128 bytes inside of 1744-byte region [0x7815ae433880,0x7815ae433f50) freed by thread T0 here: