[128677:128677:0526/191532.020615:ERROR:components/autofill/content/renderer/autofill_agent.cc:811] POC[renderer]: AutofillAgent::OnDestruct posting DeleteSoon [128677:128677:0526/191532.021106:ERROR:components/autofill/content/renderer/password_autofill_agent.cc:1051] POC[renderer]: DoFillField after SetAutofillValue (UAF next) [0526/191532.032633:WARNING:third_party/crashpad/crashpad/snapshot/linux/process_reader_linux.cc:146] no stack mapping [0526/191532.033633:ERROR:third_party/crashpad/crashpad/util/file/file_io_posix.cc:145] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq: No such file or directory (2) [0526/191532.033670:ERROR:third_party/crashpad/crashpad/util/file/file_io_posix.cc:145] open /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq: No such file or directory (2) Received signal 11 SEGV_MAPERR 000000000000 #0 0x64c75bda63fa in ___interceptor_backtrace ??:0:0 #1 0x64c774604f68 in base::debug::CollectStackTrace(base::span) ./../../base/debug/stack_trace_posix.cc:1050:7 #2 0x64c7745c18b7 in base::debug::StackTrace::StackTrace() ./../../base/debug/stack_trace.cc:280:20 #3 0x64c77460436f in base::debug::(anonymous namespace)::StackDumpSignalHandler(int, siginfo_t*, void*) ./../../base/debug/stack_trace_posix.cc:483:3 #4 0x7784e2240050 in __sigaction ??:? #5 0x64c78f0fcbad in autofill::PasswordAutofillAgent::GetPasswordManagerDriver() ./../../components/autofill/content/renderer/password_autofill_agent.cc:1541:26 #6 0x64c78f1002c0 in autofill::PasswordAutofillAgent::NotifyPasswordManagerAboutUserFieldModification(blink::WebInputElement const&, autofill::PasswordAutofillAgent::FieldModificationType) ./../../components/autofill/content/renderer/password_autofill_agent.cc:817:3 #7 0x64c78f1033b9 in autofill::PasswordAutofillAgent::DoFillField(blink::WebInputElement, std::__Cr::basic_string, std::__Cr::allocator> const&, unsigned int) ./../../components/autofill/content/renderer/password_autofill_agent.cc:1059:5 #8 0x64c78f1042cd in autofill::PasswordAutofillAgent::FillField(autofill::FieldRendererId, std::__Cr::basic_string, std::__Cr::allocator> const&, unsigned int, base::OnceCallback) ./../../components/autofill/content/renderer/password_autofill_agent.cc:981:3 #9 0x64c76dbc32bf in autofill::mojom::PasswordAutofillAgentStubDispatch::AcceptWithResponder(autofill::mojom::PasswordAutofillAgent*, mojo::Message*, std::__Cr::unique_ptr>) ./gen/components/autofill/content/common/mojom/autofill_agent.mojom.cc:4919:13 #10 0x64c775222a5c in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1036:56 #11 0x64c775240812 in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:44:19 #12 0x64c775228da4 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:747:20 #13 0x64c7783579b4 in IPC::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification) ./../../ipc/ipc_mojo_bootstrap.cc:1199:24 #14 0x64c778359e36 in base::internal::Invoker, base::internal::BindState, mojo::Message, IPC::(anonymous namespace)::ScopedUrgentMessageNotification>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:740:12 #15 0x64c7744393e4 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/functional/callback.h:155:12 #16 0x64c7744a8a9d in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/common/task_annotator.h:112:5 #17 0x64c7744a793b in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #18 0x64c7742f7a73 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:65:55 #19 0x64c7744aa185 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12 #20 0x64c7743b3981 in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:135:14 #21 0x64c780c720e5 in content::RendererMain(content::MainFunctionParams) ./../../content/renderer/renderer_main.cc:336:16 #22 0x64c770daadc4 in content::RunZygote(content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:665:14 #23 0x64c770dac0cc in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:772:12 #24 0x64c770daefd2 in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner_impl.cc:1164:10 #25 0x64c770da87dc in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ./../../content/app/content_main.cc:356:36 #26 0x64c770da8dcd in content::ContentMain(content::ContentMainParams) ./../../content/app/content_main.cc:369:10 #27 0x64c75be3c02c in ChromeMain ./../../chrome/app/chrome_main.cc:221:12 #28 0x7784e222b24a in __libc_init_first ??:? #29 0x7784e222b305 in __libc_start_main ??:0:0 #30 0x64c75bd5e02a in _start ??:0:0 r8: 000000007fff8000 r9: 00007fffffffff01 r10: 00007fffffffff01 r11: a2151e42d0606801 r12: 00007384df018900 r13: 000074d4e03ebc00 r14: 00007384df018900 r15: 00000e709be03120 di: 0000000000000000 si: 0000000000000000 bp: 00007fff6b24fe50 bx: 00007fff6b24fdc0 dx: 0000000000000000 ax: 0000000000000000 cx: 0000000000000000 sp: 00007fff6b24fdc0 ip: 000064c78f0fcbad efl: 0000000000010246 cgf: 002b000000000033 erf: 0000000000000004 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000000 [end of stack trace]