[.] Sanitizer coverage enabled. Counter map size: 8287843, Cmp map size: 262144 Note: Google Test filter = InputRouterImplTest.SynchronousDestructionDuringSendKeyboardEvent [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from InputRouterImplTest [ RUN ] InputRouterImplTest.SynchronousDestructionDuringSendKeyboardEvent ================================================================= ==5465==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c2760e36668 at pc 0x5e7cd65c3c7b bp 0x7ffc36523730 sp 0x7ffc36523728 READ of size 8 at 0x7c2760e36668 thread T0 #0 0x5e7cd65c3c7a in input::GestureEventQueue::AckCompletedEvents() base/containers/circular_deque.h:732:31 #1 0x5e7cd65c31db in input::GestureEventQueue::ProcessGestureAck(blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState, blink::mojom::EventType, ui::LatencyInfo const&) components/input/gesture_event_queue.cc:217:3 #2 0x5e7cd65d8285 in input::InputRouterImpl::GestureEventHandled(input::EventWithLatencyInfo const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr) components/input/input_router_impl.cc:853:24 #3 0x5e7cd65dc9ae in void base::internal::DecayedFunctorTraits const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr), base::WeakPtr&&, input::EventWithLatencyInfo&&>::Invoke const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr), base::WeakPtr const&, input::EventWithLatencyInfo, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr>(void (input::InputRouterImpl::*)(input::EventWithLatencyInfo const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr), base::WeakPtr const&, input::EventWithLatencyInfo&&, blink::mojom::InputEventResultSource&&, ui::LatencyInfo const&, blink::mojom::InputEventResultState&&, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:740:12 #4 0x5e7cd65dc723 in base::internal::Invoker const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr), base::WeakPtr&&, input::EventWithLatencyInfo&&>, base::internal::BindState const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr), base::WeakPtr, input::EventWithLatencyInfo>, void (blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr)>::RunOnce(base::internal::BindStateBase*, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:956:5 #5 0x5e7cd65d069c in input::InputRouterImpl::FilterAndSendWebInputEvent(blink::WebInputEvent const&, ui::LatencyInfo const&, base::OnceCallback, mojo::StructPtr)>, base::OnceCallback&) base/functional/callback.h:155:12 #6 0x5e7cd65d86e7 in non-virtual thunk to input::InputRouterImpl::SendGestureEventImmediately(input::EventWithLatencyInfo const&, base::OnceCallback&) components/input/input_router_impl.cc:548:3 #7 0x5e7cd65c196c in input::GestureEventQueue::ForwardGestureEvent(input::EventWithLatencyInfo const&, base::OnceCallback&) components/input/gesture_event_queue.cc:185:12 #8 0x5e7cd65c0f29 in input::GestureEventQueue::DebounceOrForwardEvent(input::EventWithLatencyInfo const&, base::OnceCallback&) components/input/gesture_event_queue.cc:71:3 #9 0x5e7cd65d1d48 in input::InputRouterImpl::SendGestureEventWithoutQueueing(input::EventWithLatencyInfo&, input::FilterGestureEventResult const&, base::OnceCallback&) components/input/input_router_impl.cc:248:29 #10 0x5e7cd65d1398 in input::InputRouterImpl::SendGestureEvent(input::EventWithLatencyInfo const&, base::OnceCallback&) components/input/input_router_impl.cc:190:3 #11 0x5e7cc02ff2b1 in content::MockInputRouterClient::ForwardGestureEventWithLatencyInfo(blink::WebGestureEvent const&, ui::LatencyInfo const&) content/browser/renderer_host/input/mock_input_router_client.cc:73:20 #12 0x5e7cd65be51d in input::FlingController::GenerateAndSendFlingEndEvents(base::TimeTicks) components/input/fling_controller.cc:329:25 #13 0x5e7cd65bd2a3 in input::FlingController::EndCurrentFling(base::TimeTicks) components/input/fling_controller.cc:381:3 #14 0x5e7cd65cec8f in input::InputRouterImpl::SendKeyboardEvent(input::EventWithLatencyInfo const&, base::OnceCallback const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>, base::OnceCallback&) components/input/input_router_impl.cc:154:24 #15 0x5e7cc02656e2 in content::InputRouterImplTestBase::SimulateKeyboardEvent(blink::mojom::EventType) content/browser/renderer_host/input/input_router_impl_unittest.cc:186:22 #16 0x5e7cc02df276 in content::InputRouterImplTest_SynchronousDestructionDuringSendKeyboardEvent_Test::TestBody() content/browser/renderer_host/input/input_router_impl_unittest.cc:3037:3 #17 0x5e7cc607c40b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #18 0x5e7cc607f577 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #19 0x5e7cc6081673 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #20 0x5e7cc60b132a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #21 0x5e7cc60afdfe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #22 0x5e7cd603922c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #23 0x5e7cd5ae93d5 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #24 0x5e7cd56cd791 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #25 0x5e7cd608dda4 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #26 0x5e7cd608d6cb in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #27 0x5e7cd56cd304 in main content/test/run_all_unittests.cc:17:10 #28 0x7e1762c2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 93ac61ec5a8eb1396f9fbd350e3169a558528a40) 0x7c2760e36668 is located 360 bytes inside of 4056-byte region [0x7c2760e36500,0x7c2760e374d8) freed by thread T0 here: #0 0x5e7cbb6f5991 in operator delete(void*) (/chromium/chromium/src/out/asan/content_unittests+0xfb4e991) (BuildId: 0f38e7949cc3bdcd) #1 0x5e7cc02ea88c in base::internal::Invoker>* const&, content::MockInputRouterClient* const&, content::MockInputDispositionHandler* const&>, base::internal::BindState>, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, base::internal::UnretainedWrapper, base::internal::UnretainedWrapper>, void ()>::Run(base::internal::BindStateBase*) third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x5e7cbb9ab4ff in base::RepeatingCallback::Run() const & base/functional/callback.h:346:12 #3 0x5e7cc02fd899 in content::MockInputDispositionHandler::OnGestureEventAck(input::EventWithLatencyInfo const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState) content/browser/renderer_host/input/mock_input_disposition_handler.cc:77:35 #4 0x5e7cd65c39a8 in input::GestureEventQueue::AckCompletedEvents() components/input/gesture_event_queue.cc:243:12 #5 0x5e7cd65c31db in input::GestureEventQueue::ProcessGestureAck(blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState, blink::mojom::EventType, ui::LatencyInfo const&) components/input/gesture_event_queue.cc:217:3 #6 0x5e7cd65d8285 in input::InputRouterImpl::GestureEventHandled(input::EventWithLatencyInfo const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr) components/input/input_router_impl.cc:853:24 #7 0x5e7cd65dc9ae in void base::internal::DecayedFunctorTraits const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr), base::WeakPtr&&, input::EventWithLatencyInfo&&>::Invoke const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr), base::WeakPtr const&, input::EventWithLatencyInfo, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr>(void (input::InputRouterImpl::*)(input::EventWithLatencyInfo const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr), base::WeakPtr const&, input::EventWithLatencyInfo&&, blink::mojom::InputEventResultSource&&, ui::LatencyInfo const&, blink::mojom::InputEventResultState&&, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:740:12 #8 0x5e7cd65dc723 in base::internal::Invoker const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr), base::WeakPtr&&, input::EventWithLatencyInfo&&>, base::internal::BindState const&, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr), base::WeakPtr, input::EventWithLatencyInfo>, void (blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr, mojo::StructPtr)>::RunOnce(base::internal::BindStateBase*, blink::mojom::InputEventResultSource, ui::LatencyInfo const&, blink::mojom::InputEventResultState, mojo::StructPtr&&, mojo::StructPtr&&) base/functional/bind_internal.h:956:5 #9 0x5e7cd65d069c in input::InputRouterImpl::FilterAndSendWebInputEvent(blink::WebInputEvent const&, ui::LatencyInfo const&, base::OnceCallback, mojo::StructPtr)>, base::OnceCallback&) base/functional/callback.h:155:12 #10 0x5e7cd65d86e7 in non-virtual thunk to input::InputRouterImpl::SendGestureEventImmediately(input::EventWithLatencyInfo const&, base::OnceCallback&) components/input/input_router_impl.cc:548:3 #11 0x5e7cd65c196c in input::GestureEventQueue::ForwardGestureEvent(input::EventWithLatencyInfo const&, base::OnceCallback&) components/input/gesture_event_queue.cc:185:12 #12 0x5e7cd65c0f29 in input::GestureEventQueue::DebounceOrForwardEvent(input::EventWithLatencyInfo const&, base::OnceCallback&) components/input/gesture_event_queue.cc:71:3 #13 0x5e7cd65d1d48 in input::InputRouterImpl::SendGestureEventWithoutQueueing(input::EventWithLatencyInfo&, input::FilterGestureEventResult const&, base::OnceCallback&) components/input/input_router_impl.cc:248:29 #14 0x5e7cd65d1398 in input::InputRouterImpl::SendGestureEvent(input::EventWithLatencyInfo const&, base::OnceCallback&) components/input/input_router_impl.cc:190:3 #15 0x5e7cc02ff2b1 in content::MockInputRouterClient::ForwardGestureEventWithLatencyInfo(blink::WebGestureEvent const&, ui::LatencyInfo const&) content/browser/renderer_host/input/mock_input_router_client.cc:73:20 #16 0x5e7cd65be51d in input::FlingController::GenerateAndSendFlingEndEvents(base::TimeTicks) components/input/fling_controller.cc:329:25 #17 0x5e7cd65bd2a3 in input::FlingController::EndCurrentFling(base::TimeTicks) components/input/fling_controller.cc:381:3 #18 0x5e7cd65cec8f in input::InputRouterImpl::SendKeyboardEvent(input::EventWithLatencyInfo const&, base::OnceCallback const&, blink::mojom::InputEventResultSource, blink::mojom::InputEventResultState)>, base::OnceCallback&) components/input/input_router_impl.cc:154:24 #19 0x5e7cc02656e2 in content::InputRouterImplTestBase::SimulateKeyboardEvent(blink::mojom::EventType) content/browser/renderer_host/input/input_router_impl_unittest.cc:186:22 #20 0x5e7cc02df276 in content::InputRouterImplTest_SynchronousDestructionDuringSendKeyboardEvent_Test::TestBody() content/browser/renderer_host/input/input_router_impl_unittest.cc:3037:3 #21 0x5e7cc607c40b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #22 0x5e7cc607f577 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #23 0x5e7cc6081673 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #24 0x5e7cc60b132a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #25 0x5e7cc60afdfe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #26 0x5e7cd603922c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #27 0x5e7cd5ae93d5 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #28 0x5e7cd56cd791 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #29 0x5e7cd608dda4 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 previously allocated by thread T0 here: #0 0x5e7cbb6f5151 in operator new(unsigned long) (/chromium/chromium/src/out/asan/content_unittests+0xfb4e151) (BuildId: 0f38e7949cc3bdcd) #1 0x5e7cc02eaeb6 in content::InputRouterImplTestBase::SetUpWithInputRouterActiveState(bool) components/input/input_router_impl.h:58:3 #2 0x5e7cc607c2a1 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x5e7cc607f577 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x5e7cc6081673 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x5e7cc60b132a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x5e7cc60afdfe in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x5e7cd603922c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x5e7cd5ae93d5 in content::UnitTestTestSuite::Run() content/public/test/unittest_test_suite.cc:193:23 #9 0x5e7cd56cd791 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #10 0x5e7cd608dda4 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #11 0x5e7cd608d6cb in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #12 0x5e7cd56cd304 in main content/test/run_all_unittests.cc:17:10 #13 0x7e1762c2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 93ac61ec5a8eb1396f9fbd350e3169a558528a40) Shadow bytes around the buggy address: 0x7c2760e36380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c2760e36400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c2760e36480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c2760e36500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c2760e36580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x7c2760e36600: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd 0x7c2760e36680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c2760e36700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c2760e36780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c2760e36800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c2760e36880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb WARNING: All log messages before absl::InitializeLog() is called are written to STDERR E0000 00:00:1781646018.359789 5465 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==5465==ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781646018.359907 5465 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==5465==Note: Please include this section with the ASan report. === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781646018.359940 5465 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781646018.359966 5465 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781646018.359987 5465 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==5465==END OF ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1781646018.360013 5465 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==5465==ABORTING === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31