[3347:3347:0407/085650.392695:ERROR:third_party/blink/renderer/core/workers/dedicated_worker.cc:175] [POC] DedicatedWorker: triggering Freeze() [3347:3382:0407/085650.393327:ERROR:third_party/blink/renderer/core/workers/worker_thread.cc:956] [POC] PauseOrFreezeOnWorkerThread: entering nested loop, state=2 [3347:3382:0407/085650.394480:ERROR:third_party/blink/renderer/core/workers/worker_thread.cc:988] [POC] running __pocReentry on unpausable queue [POC] FutexWaitList::AddNode DOUBLE-ADD node=0x7e74d8ea6b18 prev=(nil) next=0x7ba4d8ed0250 loc=0x7a1000004004 [3268:3268:0407/085650.497426:INFO:CONSOLE:30] "[worker] inner Atomics.wait returned: timed-out", source: http://127.0.0.1:18080/worker.js (30) [3268:3268:0407/085650.503398:INFO:CONSOLE:7] "[main] inner wait done; list now cross-linked", source: http://127.0.0.1:18080/poc.html (7) [3268:3268:0407/085651.393808:INFO:CONSOLE:7] "[main] A resolved: timed-out", source: http://127.0.0.1:18080/poc.html (7) [3268:3268:0407/085652.393318:INFO:CONSOLE:7] "[main] C resolved: timed-out", source: http://127.0.0.1:18080/poc.html (7) [3268:3268:0407/085652.494299:INFO:CONSOLE:7] "[main] triggering UAF via Atomics.waitAsync(i32, 0, ...)", source: http://127.0.0.1:18080/poc.html (7) ================================================================= ==3347==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ba4d8ed0120 at pc 0x55cfe0c19313 bp 0x7ffe852a59d0 sp 0x7ffe852a59c8 WRITE of size 8 at 0x7ba4d8ed0120 thread T0 (chrome) [3268:3283:0407/085652.579636:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT #0 0x55cfe0c19312 in v8::internal::Tagged v8::internal::FutexEmulation::WaitAsync(v8::internal::Isolate*, v8::internal::DirectHandle, unsigned long, int, bool, long, v8::internal::FutexEmulation::CallType) v8/src/execution/futex-emulation.cc:232:28 #1 0x55cfe0c11575 in v8::internal::FutexEmulation::WaitJs32(v8::internal::Isolate*, v8::internal::FutexEmulation::WaitMode, v8::internal::DirectHandle, unsigned long, int, double) v8/src/execution/futex-emulation.cc:400:10 #2 0x55cfe09948d9 in v8::internal::DoWait(v8::internal::Isolate*, v8::internal::FutexEmulation::WaitMode, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle) v8/src/builtins/builtins-sharedarraybuffer.cc:247:12 #3 0x55cfe0995610 in v8::internal::Builtin_Impl_AtomicsWaitAsync(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-sharedarraybuffer.cc:274:10 #4 0x55cfe5a4caf5 in Builtins_CEntry_Return1_ArgvOnStack_BuiltinExit setup-isolate-deserialize.cc #5 0x55cfe5998902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc #6 0x55cfe59dc62d in Builtins_AsyncFunctionAwaitResolveClosure setup-isolate-deserialize.cc #7 0x55cfe5ad4fa9 in Builtins_PromiseFulfillReactionJob setup-isolate-deserialize.cc #8 0x55cfe59ca493 in Builtins_RunMicrotasks setup-isolate-deserialize.cc #9 0x55cfe59955ea in Builtins_JSRunMicrotasksEntry setup-isolate-deserialize.cc #10 0x55cfe0bea463 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12 #11 0x55cfe0bed8dd in v8::internal::(anonymous namespace)::InvokeWithTryCatch(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:534:18 #12 0x55cfe0bedd05 in v8::internal::Execution::TryRunMicrotasks(v8::internal::Isolate*, v8::internal::MicrotaskQueue*) v8/src/execution/execution.cc:638:10 #13 0x55cfe0c92105 in v8::internal::MicrotaskQueue::RunMicrotasks(v8::internal::Isolate*) v8/src/execution/microtask-queue.cc:185:22 #14 0x55cfe0c91b3a in v8::internal::MicrotaskQueue::PerformCheckpointInternal(v8::Isolate*) v8/src/execution/microtask-queue.cc:129:3 #15 0x55cffeeb1eb7 in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_microtasks_scope.h:22:7 #16 0x55d00454b746 in blink::bindings::CallbackInvokeHelper::Call(int, v8::Local*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:124:12 #17 0x55d004562ff5 in blink::V8Function::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:73:13 #18 0x55d004563759 in blink::V8Function::InvokeAndReportException(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:133:15 #19 0x55d00530c6a9 in blink::ScheduledAction::Execute(blink::ExecutionContext*) third_party/blink/renderer/core/scheduler/scheduled_action.cc:145:18 #20 0x55d005304694 in blink::DOMTimer::Fired() third_party/blink/renderer/core/scheduler/dom_timer.cc:448:11 #21 0x55d0034de13d in blink::TimerBase::RunInternal() third_party/blink/renderer/platform/timer.cc:166:3 #22 0x55cffee18aa0 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #23 0x55cff2a3f326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #24 0x55cff2ab69c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #25 0x55cff2ab583a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #26 0x55cff28fd927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #27 0x55cff2ab80d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #28 0x55cff29b9ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #29 0x55cffed431fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16 #30 0x55cfee5576ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14 #31 0x55cfee558a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12 #32 0x55cfee55b728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10 #33 0x55cfee555101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #34 0x55cfee5556fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 #35 0x55cfdaa89b39 in ChromeMain chrome/app/chrome_main.cc:191:12 #36 0x7f64dac0b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7ba4d8ed0120 is located 16 bytes inside of 48-byte region [0x7ba4d8ed0110,0x7ba4d8ed0140) freed by thread T0 (chrome) here: #0 0x55cfdaa89002 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e09002) (BuildId: 5978222fe07f8a28) #1 0x55cfe0c1567a in v8::internal::FutexEmulation::HandleAsyncWaiterTimeout(v8::internal::FutexWaitListNode*) v8/src/execution/futex-emulation.cc:956:3 #2 0x55cffa213030 in base::internal::Invoker>&&>, base::internal::BindState>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #3 0x55cff2a3f326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #4 0x55cff2ab69c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #5 0x55cff2ab583a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #6 0x55cff28fd927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #7 0x55cff2ab80d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #8 0x55cff29b9ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #9 0x55cffed431fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16 #10 0x55cfee5576ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14 #11 0x55cfee558a1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12 #12 0x55cfee55b728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10 #13 0x55cfee555101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #14 0x55cfee5556fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 #15 0x55cfdaa89b39 in ChromeMain chrome/app/chrome_main.cc:191:12 #16 0x7f64dac0b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 (chrome) here: #0 0x55cfdaa883fd in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x10e083fd) (BuildId: 5978222fe07f8a28) #1 0x55cfe0c1869e in v8::internal::Tagged v8::internal::FutexEmulation::WaitAsync(v8::internal::Isolate*, v8::internal::DirectHandle, unsigned long, int, bool, long, v8::internal::FutexEmulation::CallType) v8/src/execution/futex-emulation.cc:590:33 #2 0x55cfe0c11575 in v8::internal::FutexEmulation::WaitJs32(v8::internal::Isolate*, v8::internal::FutexEmulation::WaitMode, v8::internal::DirectHandle, unsigned long, int, double) v8/src/execution/futex-emulation.cc:400:10 #3 0x55cfe09948d9 in v8::internal::DoWait(v8::internal::Isolate*, v8::internal::FutexEmulation::WaitMode, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle) v8/src/builtins/builtins-sharedarraybuffer.cc:247:12 #4 0x55cfe0995610 in v8::internal::Builtin_Impl_AtomicsWaitAsync(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-sharedarraybuffer.cc:274:10 #5 0x55cfe5a4caf5 in Builtins_CEntry_Return1_ArgvOnStack_BuiltinExit setup-isolate-deserialize.cc #6 0x55cfe5998902 in Builtins_InterpreterEntryTrampoline setup-isolate-deserialize.cc #7 0x55cfe59dc62d in Builtins_AsyncFunctionAwaitResolveClosure setup-isolate-deserialize.cc #8 0x55cfe5ad4fa9 in Builtins_PromiseFulfillReactionJob setup-isolate-deserialize.cc #9 0x55cfe59ca493 in Builtins_RunMicrotasks setup-isolate-deserialize.cc #10 0x55cfe59955ea in Builtins_JSRunMicrotasksEntry setup-isolate-deserialize.cc #11 0x55cfe0bea463 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/simulator.h:216:12 #12 0x55cfe0bed8dd in v8::internal::(anonymous namespace)::InvokeWithTryCatch(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:534:18 #13 0x55cfe0bedd05 in v8::internal::Execution::TryRunMicrotasks(v8::internal::Isolate*, v8::internal::MicrotaskQueue*) v8/src/execution/execution.cc:638:10 #14 0x55cfe0c92105 in v8::internal::MicrotaskQueue::RunMicrotasks(v8::internal::Isolate*) v8/src/execution/microtask-queue.cc:185:22 #15 0x55cfe0c91b3a in v8::internal::MicrotaskQueue::PerformCheckpointInternal(v8::Isolate*) v8/src/execution/microtask-queue.cc:129:3 #16 0x55cffeeb1eb7 in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_microtasks_scope.h:22:7 #17 0x55d00454b746 in blink::bindings::CallbackInvokeHelper::Call(int, v8::Local*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:124:12 #18 0x55d004562ff5 in blink::V8Function::Invoke(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:73:13 #19 0x55d004563759 in blink::V8Function::InvokeAndReportException(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, blink::ScriptValue, 0u> const&) gen/third_party/blink/renderer/bindings/core/v8/v8_function.cc:133:15 #20 0x55d00530c6a9 in blink::ScheduledAction::Execute(blink::ExecutionContext*) third_party/blink/renderer/core/scheduler/scheduled_action.cc:145:18 #21 0x55d005304694 in blink::DOMTimer::Fired() third_party/blink/renderer/core/scheduler/dom_timer.cc:448:11 #22 0x55d0034de13d in blink::TimerBase::RunInternal() third_party/blink/renderer/platform/timer.cc:166:3 #23 0x55cffee18aa0 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #24 0x55cff2a3f326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #25 0x55cff2ab69c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #26 0x55cff2ab583a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #27 0x55cff28fd927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #28 0x55cff2ab80d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #29 0x55cff29b9ca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 SUMMARY: AddressSanitizer: heap-use-after-free v8/src/execution/futex-emulation.cc:232:28 in v8::internal::Tagged v8::internal::FutexEmulation::WaitAsync(v8::internal::Isolate*, v8::internal::DirectHandle, unsigned long, int, bool, long, v8::internal::FutexEmulation::CallType) Shadow bytes around the buggy address: 0x7ba4d8ecfe80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7ba4d8ecff00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7ba4d8ecff80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7ba4d8ed0000: f7 fa 00 00 00 00 00 00 f7 fa fd fd fd fd fd fd 0x7ba4d8ed0080: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fa =>0x7ba4d8ed0100: f7 fa fd fd[fd]fd fd fd f7 fa fd fd fd fd fd fd 0x7ba4d8ed0180: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd 0x7ba4d8ed0200: f7 fa 00 00 00 00 00 00 f7 fa fd fd fd fd fd fd 0x7ba4d8ed0280: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd 0x7ba4d8ed0300: f7 fa fd fd fd fd fd fd f7 fa 00 00 00 00 00 00 0x7ba4d8ed0380: f7 fa fd fd fd fd fd fd f7 fa fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3347==ADDITIONAL INFO ==3347==Note: Please include this section with the ASan report. Task trace: #0 0x55d0053032a1 in blink::DOMTimer::DOMTimer(blink::ExecutionContext&, blink::ScheduledAction*, base::TimeDelta, bool) third_party/blink/renderer/core/scheduler/dom_timer.cc:343:27