UAF: V8RuntimeAgentImpl freed during reportToFrontend re-entrancy
=================================================================
==8584==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b3ce2df5b48 at pc 0x57e207656c6f bp 0x7a2c43759ad0 sp 0x7a2c43759ac8
READ of size 1 at 0x7b3ce2df5b48 thread T18 (Task Runner)
    #0 0x57e207656c6e in v8_inspector::InjectedScript::wrapObjectMirror(v8_inspector::ValueMirror const&, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, v8::MaybeLocal<v8::Value>, int, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*) v8/src/inspector/injected-script.cc:630:30
    #1 0x57e207659718 in v8_inspector::InjectedScript::wrapObject(v8::Local<v8::Value>, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*) v8/src/inspector/injected-script.cc:621:10
    #2 0x57e2077454c4 in v8_inspector::V8InspectorSessionImpl::wrapObject(v8::Local<v8::Context>, v8::Local<v8::Value>, v8_inspector::String16 const&, bool) v8/src/inspector/v8-inspector-session-impl.cc:329:19
    #3 0x57e20768a736 in v8_inspector::V8ConsoleMessage::wrapArguments(v8_inspector::V8InspectorSessionImpl*, bool) const v8/src/inspector/v8-console-message.cc:302:20
    #4 0x57e20768b74a in v8_inspector::V8ConsoleMessage::reportToFrontend(v8_inspector::protocol::Runtime::Frontend*, v8_inspector::V8InspectorSessionImpl*, bool) const v8/src/inspector/v8-console-message.cc:369:21
    #5 0x57e207769a9e in v8_inspector::V8RuntimeAgentImpl::messageAdded(v8_inspector::V8ConsoleMessage*) v8/src/inspector/v8-runtime-agent-impl.cc:1219:12
    #6 0x57e20773053f in v8_inspector::V8InspectorImpl::forEachSession(int, std::__Cr::function<void (v8_inspector::V8InspectorSessionImpl*)> const&) third_party/libc++/src/include/__functional/function.h:502:12
    #7 0x57e2076905c3 in v8_inspector::V8ConsoleMessageStorage::addMessage(std::__Cr::unique_ptr<v8_inspector::V8ConsoleMessage, std::__Cr::default_delete<v8_inspector::V8ConsoleMessage>>) v8/src/inspector/v8-console-message.cc:581:14
    #8 0x57e20769f029 in v8_inspector::(anonymous namespace)::ConsoleHelper::reportCall(v8_inspector::ConsoleAPIType, v8::MemorySpan<v8::Local<v8::Value> const>) v8/src/inspector/v8-console.cc:147:30
    #9 0x57e20769a37e in v8_inspector::(anonymous namespace)::ConsoleHelper::reportCall(v8_inspector::ConsoleAPIType) v8/src/inspector/v8-console.cc:82:5
    #10 0x57e20769ac03 in v8_inspector::V8Console::Log(v8::debug::ConsoleCallArguments const&, v8::debug::ConsoleContext const&) v8/src/inspector/v8-console.cc:255:8
    #11 0x57e204880e96 in v8::internal::(anonymous namespace)::ConsoleCall(v8::internal::Isolate*, v8::internal::BuiltinArguments const&, void (v8::debug::ConsoleDelegate::*)(v8::debug::ConsoleCallArguments const&, v8::debug::ConsoleContext const&)) v8/src/builtins/builtins-console.cc:170:3
    #12 0x57e20487e904 in v8::internal::Builtin_ConsoleLog(int, unsigned long*, v8::internal::Isolate*) v8/src/builtins/builtins-console.cc:209:36
    #13 0x57e209fa5435 in Builtins_CEntry_Return1_ArgvOnStack_BuiltinExit crtstuff.c
    #14 0x57e209ef3956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #15 0x57e209ef06db in Builtins_JSEntryTrampoline crtstuff.c
    #16 0x57e209ef042a in Builtins_JSEntry crtstuff.c
    #17 0x57e204b23cc1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #18 0x57e204b26622 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) v8/src/execution/execution.cc:575:10
    #19 0x57e204769513 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) v8/src/api/api.cc:2040:7
    #20 0x57e20475307c in v8::internal::ExecuteStringTask::Run(v8::internal::InspectorIsolateData*) v8/test/inspector/tasks.cc:129:22
    #21 0x57e204750ddc in v8::internal::TaskRunner::RunMessageLoop(bool) v8/test/inspector/task-runner.cc:80:11
    #22 0x57e204750a2d in v8::internal::TaskRunner::Run() v8/test/inspector/task-runner.cc:66:3
    #23 0x57e20a1a427d in v8::base::ThreadEntry(void*) v8/src/base/platform/platform-posix.cc:1308:11
    #24 0x57e2046f0a6a in asan_thread_start(void*) asan_interceptors.cpp

0x7b3ce2df5b48 is located 200 bytes inside of 208-byte region [0x7b3ce2df5a80,0x7b3ce2df5b50)
freed by thread T18 (Task Runner) here:
    #0 0x57e20472de56 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/Default/inspector-test+0x1534e56) (BuildId: 820cbe7fe598eab3)
    #1 0x57e207676ca4 in std::__Cr::__hash_table<std::__Cr::__hash_value_type<int, std::__Cr::unique_ptr<v8_inspector::InjectedScript, std::__Cr::default_delete<v8_inspector::InjectedScript>>>, std::__Cr::__unordered_map_hasher<int, std::__Cr::pair<int const, std::__Cr::unique_ptr<v8_inspector::InjectedScript, std::__Cr::default_delete<v8_inspector::InjectedScript>>>, std::__Cr::hash<int>, std::__Cr::equal_to<int>>, std::__Cr::__unordered_map_equal<int, std::__Cr::pair<int const, std::__Cr::unique_ptr<v8_inspector::InjectedScript, std::__Cr::default_delete<v8_inspector::InjectedScript>>>, std::__Cr::equal_to<int>, std::__Cr::hash<int>>, std::__Cr::allocator<std::__Cr::pair<int const, std::__Cr::unique_ptr<v8_inspector::InjectedScript, std::__Cr::default_delete<v8_inspector::InjectedScript>>>>>::erase(std::__Cr::__hash_const_iterator<std::__Cr::__hash_node<std::__Cr::__hash_value_type<int, std::__Cr::unique_ptr<v8_inspector::InjectedScript, std::__Cr::default_delete<v8_inspector::InjectedScript>>>, void*>*>) third_party/libc++/src/include/__memory/unique_ptr.h:74:5
    #2 0x57e20773459a in v8_inspector::V8InspectorImpl::forEachContext(int, std::__Cr::function<void (v8_inspector::InspectedContext*)> const&) third_party/libc++/src/include/__functional/function.h:502:12
    #3 0x57e207742f67 in v8_inspector::V8InspectorSessionImpl::discardInjectedScripts() v8/src/inspector/v8-inspector-session-impl.cc:224:16
    #4 0x57e2077422f3 in v8_inspector::V8InspectorSessionImpl::~V8InspectorSessionImpl() v8/src/inspector/v8-inspector-session-impl.cc:163:3
    #5 0x57e2077430c3 in v8_inspector::V8InspectorSessionImpl::~V8InspectorSessionImpl() v8/src/inspector/v8-inspector-session-impl.cc:161:51
    #6 0x57e20474010c in v8::internal::DevToolsSession::Disconnect() third_party/libc++/src/include/__memory/shared_count.h:65:7
    #7 0x57e204744a0b in v8::internal::InspectorIsolateData::DisconnectSessionSync(int) v8/test/inspector/isolate-data.cc:232:15
    #8 0x57e209ef56d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #9 0x57e209ef3956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #10 0x57e209ef06db in Builtins_JSEntryTrampoline crtstuff.c
    #11 0x57e209ef042a in Builtins_JSEntry crtstuff.c
    #12 0x57e204b23cc1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #13 0x57e204b22601 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) v8/src/execution/execution.cc:565:10
    #14 0x57e2058b1de4 in v8::internal::Object::GetPropertyWithAccessor(v8::internal::LookupIterator*) v8/src/objects/objects.cc:1730:22
    #15 0x57e2058af9f7 in v8::internal::Object::GetProperty(v8::internal::LookupIterator*, bool) v8/src/objects/objects.cc:1348:16
    #16 0x57e205d09eb9 in v8::internal::Runtime::GetObjectProperty(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, bool*) v8/src/runtime/runtime-object.cc:42:38
    #17 0x57e20477f8d1 in v8::Object::Get(v8::Local<v8::Context>, v8::Local<v8::Value>) v8/src/api/api.cc:4800:7
    #18 0x57e20779528b in v8_inspector::(anonymous namespace)::getErrorProperty(v8::Local<v8::Context>, v8::Local<v8::Object>, v8::Local<v8::String>) v8/src/inspector/value-mirror.cc
    #19 0x57e207781f78 in v8_inspector::(anonymous namespace)::descriptionForError(v8::Local<v8::Context>, v8::Local<v8::Object>) v8/src/inspector/value-mirror.cc:335:9
    #20 0x57e20777e1f8 in v8_inspector::ValueMirror::create(v8::Local<v8::Context>, v8::Local<v8::Value>) v8/src/inspector/value-mirror.cc:1886:43
    #21 0x57e2076596ed in v8_inspector::InjectedScript::wrapObject(v8::Local<v8::Value>, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*) v8/src/inspector/injected-script.cc:619:41
    #22 0x57e2077454c4 in v8_inspector::V8InspectorSessionImpl::wrapObject(v8::Local<v8::Context>, v8::Local<v8::Value>, v8_inspector::String16 const&, bool) v8/src/inspector/v8-inspector-session-impl.cc:329:19
    #23 0x57e20768a736 in v8_inspector::V8ConsoleMessage::wrapArguments(v8_inspector::V8InspectorSessionImpl*, bool) const v8/src/inspector/v8-console-message.cc:302:20
    #24 0x57e20768b74a in v8_inspector::V8ConsoleMessage::reportToFrontend(v8_inspector::protocol::Runtime::Frontend*, v8_inspector::V8InspectorSessionImpl*, bool) const v8/src/inspector/v8-console-message.cc:369:21
    #25 0x57e207769a9e in v8_inspector::V8RuntimeAgentImpl::messageAdded(v8_inspector::V8ConsoleMessage*) v8/src/inspector/v8-runtime-agent-impl.cc:1219:12
    #26 0x57e20773053f in v8_inspector::V8InspectorImpl::forEachSession(int, std::__Cr::function<void (v8_inspector::V8InspectorSessionImpl*)> const&) third_party/libc++/src/include/__functional/function.h:502:12
    #27 0x57e2076905c3 in v8_inspector::V8ConsoleMessageStorage::addMessage(std::__Cr::unique_ptr<v8_inspector::V8ConsoleMessage, std::__Cr::default_delete<v8_inspector::V8ConsoleMessage>>) v8/src/inspector/v8-console-message.cc:581:14
    #28 0x57e20769f029 in v8_inspector::(anonymous namespace)::ConsoleHelper::reportCall(v8_inspector::ConsoleAPIType, v8::MemorySpan<v8::Local<v8::Value> const>) v8/src/inspector/v8-console.cc:147:30
    #29 0x57e20769a37e in v8_inspector::(anonymous namespace)::ConsoleHelper::reportCall(v8_inspector::ConsoleAPIType) v8/src/inspector/v8-console.cc:82:5

previously allocated by thread T18 (Task Runner) here:
    #0 0x57e20472d251 in operator new(unsigned long) (/chromium/chromium/src/out/Default/inspector-test+0x1534251) (BuildId: 820cbe7fe598eab3)
    #1 0x57e20767454e in v8_inspector::InspectedContext::createInjectedScript(int) third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x57e207743a43 in v8_inspector::V8InspectorSessionImpl::findInjectedScript(int, v8_inspector::InjectedScript*&, std::__Cr::shared_ptr<v8_inspector::InspectedContext>*) v8/src/inspector/v8-inspector-session-impl.cc:241:31
    #3 0x57e20774541f in v8_inspector::V8InspectorSessionImpl::wrapObject(v8::Local<v8::Context>, v8::Local<v8::Value>, v8_inspector::String16 const&, bool) v8/src/inspector/v8-inspector-session-impl.cc:325:3
    #4 0x57e20768a736 in v8_inspector::V8ConsoleMessage::wrapArguments(v8_inspector::V8InspectorSessionImpl*, bool) const v8/src/inspector/v8-console-message.cc:302:20
    #5 0x57e20768b74a in v8_inspector::V8ConsoleMessage::reportToFrontend(v8_inspector::protocol::Runtime::Frontend*, v8_inspector::V8InspectorSessionImpl*, bool) const v8/src/inspector/v8-console-message.cc:369:21
    #6 0x57e207769a9e in v8_inspector::V8RuntimeAgentImpl::messageAdded(v8_inspector::V8ConsoleMessage*) v8/src/inspector/v8-runtime-agent-impl.cc:1219:12
    #7 0x57e20773053f in v8_inspector::V8InspectorImpl::forEachSession(int, std::__Cr::function<void (v8_inspector::V8InspectorSessionImpl*)> const&) third_party/libc++/src/include/__functional/function.h:502:12
    #8 0x57e2076905c3 in v8_inspector::V8ConsoleMessageStorage::addMessage(std::__Cr::unique_ptr<v8_inspector::V8ConsoleMessage, std::__Cr::default_delete<v8_inspector::V8ConsoleMessage>>) v8/src/inspector/v8-console-message.cc:581:14
    #9 0x57e20769f029 in v8_inspector::(anonymous namespace)::ConsoleHelper::reportCall(v8_inspector::ConsoleAPIType, v8::MemorySpan<v8::Local<v8::Value> const>) v8/src/inspector/v8-console.cc:147:30
    #10 0x57e20769a37e in v8_inspector::(anonymous namespace)::ConsoleHelper::reportCall(v8_inspector::ConsoleAPIType) v8/src/inspector/v8-console.cc:82:5
    #11 0x57e20769ac03 in v8_inspector::V8Console::Log(v8::debug::ConsoleCallArguments const&, v8::debug::ConsoleContext const&) v8/src/inspector/v8-console.cc:255:8
    #12 0x57e204880e96 in v8::internal::(anonymous namespace)::ConsoleCall(v8::internal::Isolate*, v8::internal::BuiltinArguments const&, void (v8::debug::ConsoleDelegate::*)(v8::debug::ConsoleCallArguments const&, v8::debug::ConsoleContext const&)) v8/src/builtins/builtins-console.cc:170:3
    #13 0x57e20487e904 in v8::internal::Builtin_ConsoleLog(int, unsigned long*, v8::internal::Isolate*) v8/src/builtins/builtins-console.cc:209:36
    #14 0x57e209fa5435 in Builtins_CEntry_Return1_ArgvOnStack_BuiltinExit crtstuff.c
    #15 0x57e209ef3956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #16 0x57e209ef06db in Builtins_JSEntryTrampoline crtstuff.c
    #17 0x57e209ef042a in Builtins_JSEntry crtstuff.c
    #18 0x57e204b23cc1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #19 0x57e204b26622 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) v8/src/execution/execution.cc:575:10
    #20 0x57e204769513 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) v8/src/api/api.cc:2040:7
    #21 0x57e20475307c in v8::internal::ExecuteStringTask::Run(v8::internal::InspectorIsolateData*) v8/test/inspector/tasks.cc:129:22
    #22 0x57e204750ddc in v8::internal::TaskRunner::RunMessageLoop(bool) v8/test/inspector/task-runner.cc:80:11
    #23 0x57e204750a2d in v8::internal::TaskRunner::Run() v8/test/inspector/task-runner.cc:66:3
    #24 0x57e20a1a427d in v8::base::ThreadEntry(void*) v8/src/base/platform/platform-posix.cc:1308:11
    #25 0x57e2046f0a6a in asan_thread_start(void*) asan_interceptors.cpp

Thread T18 (Task Runner) created by T0 here:
    #0 0x57e2046d6795 in pthread_create (/chromium/chromium/src/out/Default/inspector-test+0x14dd795) (BuildId: 820cbe7fe598eab3)
    #1 0x57e20a1a40bb in v8::base::Thread::Start() v8/src/base/platform/platform-posix.cc:1340:14
    #2 0x57e204750355 in v8::internal::TaskRunner::TaskRunner(std::__Cr::vector<std::__Cr::unique_ptr<v8::internal::InspectorIsolateData::SetupGlobalTask, std::__Cr::default_delete<v8::internal::InspectorIsolateData::SetupGlobalTask>>, std::__Cr::allocator<std::__Cr::unique_ptr<v8::internal::InspectorIsolateData::SetupGlobalTask, std::__Cr::default_delete<v8::internal::InspectorIsolateData::SetupGlobalTask>>>>, v8::internal::CatchExceptions, v8::base::Semaphore*, v8::StartupData*, v8::internal::WithInspector) v8/test/inspector/task-runner.cc:57:9
    #3 0x57e20472f312 in main v8/test/inspector/inspector-test.cc:916:16
    #4 0x7e2ce3bc0249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free v8/src/inspector/injected-script.cc:630:30 in v8_inspector::InjectedScript::wrapObjectMirror(v8_inspector::ValueMirror const&, v8_inspector::String16 const&, v8_inspector::WrapOptions const&, v8::MaybeLocal<v8::Value>, int, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::RemoteObject, std::__Cr::default_delete<v8_inspector::protocol::Runtime::RemoteObject>>*)
Shadow bytes around the buggy address:
  0x7b3ce2df5880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b3ce2df5900: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x7b3ce2df5980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7b3ce2df5a00: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b3ce2df5a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7b3ce2df5b00: fd fd fd fd fd fd fd fd fd[fd]fa fa fa fa fa fa
  0x7b3ce2df5b80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x7b3ce2df5c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7b3ce2df5c80: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x7b3ce2df5d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7b3ce2df5d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==8584==ABORTING