Note: Google Test filter = X11WindowTest.SetOverrideRedirectSelfDeleteUaf
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from X11WindowTest
[ RUN      ] X11WindowTest.SetOverrideRedirectSelfDeleteUaf
=================================================================
==2563==ERROR: AddressSanitizer: heap-use-after-free on address 0x7493813e3e10 at pc 0x5c9133076fda bp 0x7ffd431fb4b0 sp 0x7ffd431fb4a8
READ of size 1 at 0x7493813e3e10 thread T0
    #0 0x5c9133076fd9 in ui::X11Window::SetOverrideRedirect(bool) ui/ozone/platform/x11/x11_window.cc:1340:9
    #1 0x5c91319ffcc5 in ui::X11WindowTest_SetOverrideRedirectSelfDeleteUaf_Test::TestBody() ui/ozone/platform/x11/test/x11_window_unittest.cc:650:15
    #2 0x5c91322cc00b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x5c91322ce1d7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x5c91322d02d3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x5c91322ff71a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x5c91322fe1ee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x5c9133bddacc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x5c91319a7811 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), mojo::core::test::MojoTestSuiteBase*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<mojo::core::test::MojoTestSuiteBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x5c9133be58bb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x5c9133be51db in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x5c91319a70cb in main mojo/core/test/run_all_unittests.cc:30:10
    #12 0x773382b5a249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7493813e3e10 is located 400 bytes inside of 600-byte region [0x7493813e3c80,0x7493813e3ed8)
freed by thread T0 here:
    #0 0x5c91319a6616 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/ozone_x11_unittests+0x2997616) (BuildId: b9b19c69b7bac81c)
    #1 0x5c913307f5f8 in ui::X11Window::OnBoundsChanged(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) ui/ozone/platform/x11/x11_window.cc:2629:30
    #2 0x5c9133087b85 in base::internal::Invoker<base::internal::FunctorTraits<void (ui::X11Window::* const&)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), ui::X11Window*>, base::internal::BindState<true, true, false, void (ui::X11Window::*)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), base::internal::UnretainedWrapper<ui::X11Window, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(base::internal::BindStateBase*, std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) base/functional/bind_internal.h:740:12
    #3 0x5c913746e8f2 in base::RepeatingCallback<void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) const & base/functional/callback.h:346:12
    #4 0x5c913746e62e in x11::GeometryCache::NotifyGeometryChanged() ui/gfx/x/geometry_cache.cc:131:28
    #5 0x5c913746fd80 in base::internal::Invoker<base::internal::FunctorTraits<void (x11::GeometryCache::* const&)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), base::WeakPtr<x11::GeometryCache> const&>, base::internal::BindState<true, true, false, void (x11::GeometryCache::*)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), base::WeakPtr<x11::GeometryCache>>, void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(base::internal::BindStateBase*, std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) base/functional/bind_internal.h:740:12
    #6 0x5c913746e8f2 in base::RepeatingCallback<void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) const & base/functional/callback.h:346:12
    #7 0x5c913746e62e in x11::GeometryCache::NotifyGeometryChanged() ui/gfx/x/geometry_cache.cc:131:28
    #8 0x5c913746fd80 in base::internal::Invoker<base::internal::FunctorTraits<void (x11::GeometryCache::* const&)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), base::WeakPtr<x11::GeometryCache> const&>, base::internal::BindState<true, true, false, void (x11::GeometryCache::*)(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&), base::WeakPtr<x11::GeometryCache>>, void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(base::internal::BindStateBase*, std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) base/functional/bind_internal.h:740:12
    #9 0x5c913746e8f2 in base::RepeatingCallback<void (std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&)>::Run(std::__Cr::optional<gfx::Rect> const&, gfx::Rect const&) const & base/functional/callback.h:346:12
    #10 0x5c913746e62e in x11::GeometryCache::NotifyGeometryChanged() ui/gfx/x/geometry_cache.cc:131:28
    #11 0x5c913746cf33 in x11::GeometryCache::OnGetGeometryResponse(x11::Response<x11::GetGeometryReply>) ui/gfx/x/geometry_cache.cc:101:3
    #12 0x5c913746f9dc in base::internal::Invoker<base::internal::FunctorTraits<void (x11::GeometryCache::*&&)(x11::Response<x11::GetGeometryReply>), base::WeakPtr<x11::GeometryCache>&&>, base::internal::BindState<true, true, false, void (x11::GeometryCache::*)(x11::Response<x11::GetGeometryReply>), base::WeakPtr<x11::GeometryCache>>, void (x11::Response<x11::GetGeometryReply>)>::RunOnce(base::internal::BindStateBase*, x11::Response<x11::GetGeometryReply>&&) base/functional/bind_internal.h:740:12
    #13 0x5c9137470c05 in base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>::Run(x11::Response<x11::GetGeometryReply>) && base/functional/callback.h:155:12
    #14 0x5c9137471399 in x11::Future<x11::GetGeometryReply>::OnResponse(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>)::'lambda'(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>, scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>)::operator()(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>, scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>) const ui/gfx/x/future.h:142:27
    #15 0x5c91374710a2 in base::internal::Invoker<base::internal::FunctorTraits<x11::Future<x11::GetGeometryReply>::OnResponse(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>)::'lambda'(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>, scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>)&&, base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>&&>, base::internal::BindState<false, false, false, x11::Future<x11::GetGeometryReply>::OnResponse(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>)::'lambda'(base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>, scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>), base::OnceCallback<void (x11::Response<x11::GetGeometryReply>)>>, void (scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>)>::RunOnce(base::internal::BindStateBase*, scoped_refptr<x11::UnsizedRefCountedMemory>&&, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>&&) base/functional/bind_internal.h:658:12
    #16 0x5c913744f1b2 in base::OnceCallback<void (scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>)>::Run(scoped_refptr<x11::UnsizedRefCountedMemory>, std::__Cr::unique_ptr<x11::Error, std::__Cr::default_delete<x11::Error>>) && base/functional/callback.h:155:12
    #17 0x5c913746a5fd in x11::FutureImpl::ProcessResponse() ui/gfx/x/future.cc:62:8
    #18 0x5c913746bb6e in x11::FutureBase::DispatchNow() ui/gfx/x/future.cc:27:3
    #19 0x5c913746d5fb in x11::GeometryCache::GetBoundsPx() ui/gfx/x/geometry_cache.cc:46:22
    #20 0x5c913746d67f in x11::GeometryCache::GetBoundsPx() ui/gfx/x/geometry_cache.cc:56:33
    #21 0x5c913746d67f in x11::GeometryCache::GetBoundsPx() ui/gfx/x/geometry_cache.cc:56:33
    #22 0x5c91330664bb in ui::X11Window::Map(bool) ui/ozone/platform/x11/x11_window.cc:1995:28
    #23 0x5c9133076e43 in ui::X11Window::SetOverrideRedirect(bool) ui/ozone/platform/x11/x11_window.cc:1336:5
    #24 0x5c91319ffcc5 in ui::X11WindowTest_SetOverrideRedirectSelfDeleteUaf_Test::TestBody() ui/ozone/platform/x11/test/x11_window_unittest.cc:650:15
    #25 0x5c91322cc00b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #26 0x5c91322ce1d7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #27 0x5c91322d02d3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #28 0x5c91322ff71a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #29 0x5c91322fe1ee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc

previously allocated by thread T0 here:
    #0 0x5c91319a5a11 in operator new(unsigned long) (/chromium/chromium/src/out/asan/ozone_x11_unittests+0x2996a11) (BuildId: b9b19c69b7bac81c)
    #1 0x5c91319ff57a in ui::X11WindowTest_SetOverrideRedirectSelfDeleteUaf_Test::TestBody() third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x5c91322cc00b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x5c91322ce1d7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x5c91322d02d3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x5c91322ff71a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x5c91322fe1ee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x5c9133bddacc in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x5c91319a7811 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), mojo::core::test::MojoTestSuiteBase*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<mojo::core::test::MojoTestSuiteBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x5c9133be58bb in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x5c9133be51db in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x5c91319a70cb in main mojo/core/test/run_all_unittests.cc:30:10
    #12 0x773382b5a249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free ui/ozone/platform/x11/x11_window.cc:1340:9 in ui::X11Window::SetOverrideRedirect(bool)
Shadow bytes around the buggy address:
  0x7493813e3b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa
  0x7493813e3c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7493813e3c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7493813e3d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7493813e3d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7493813e3e00: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7493813e3e80: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x7493813e3f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7493813e3f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7493813e4000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7493813e4080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==2563==ADDITIONAL INFO

==2563==Note: Please include this section with the ASan report.
Task trace:


==2563==END OF ADDITIONAL INFO

==2563==ABORTING