[.] Sanitizer coverage enabled. Counter map size: 11597267, Cmp map size: 262144
Note: Google Test filter = PasswordGenerationAgentReentrantUafTest.GeneratedPasswordAcceptedReentrantFree
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from PasswordGenerationAgentReentrantUafTest
[ RUN      ] PasswordGenerationAgentReentrantUafTest.GeneratedPasswordAcceptedReentrantFree
=================================================================
==6879==ERROR: AddressSanitizer: heap-use-after-free on address 0x7030dd352818 at pc 0x6244e24c1bef bp 0x7fffa6724ff0 sp 0x7fffa6724fe8
READ of size 8 at 0x7030dd352818 thread T0
    #0 0x6244e24c1bee in blink::WebFormControlElement::SetAutofillValue(blink::WebString const&, blink::WebAutofillState) v8/include/cppgc/persistent.h:28:41
    #1 0x6244eb02a76d in autofill::PasswordGenerationAgent::GeneratedPasswordAccepted(std::__Cr::basic_string<char16_t, std::__Cr::char_traits<char16_t>, std::__Cr::allocator<char16_t>> const&) components/autofill/content/renderer/password_generation_agent.cc:408:22
    #2 0x6244aa062bd0 in autofill::(anonymous namespace)::PasswordGenerationAgentReentrantUafTest_GeneratedPasswordAcceptedReentrantFree_Test::TestBody() chrome/renderer/autofill/password_generation_agent_browsertest.cc:1686:25
    #3 0x6244c70d267b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #4 0x6244c70d57e7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #5 0x6244c70d78e3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #6 0x6244c71074aa in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #7 0x6244c7105f7e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x6244ced7b67c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #9 0x6244eb659920 in ChromeTestSuiteRunner::RunTestSuite(int, char**) chrome/test/base/chrome_test_launcher.cc:101:22
    #10 0x6244d0fafee2 in content::LaunchTestsInternal(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:423:31
    #11 0x6244d0fb0911 in content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:518:10
    #12 0x6244eb65a331 in LaunchChromeTests(unsigned long, content::TestLauncherDelegate*, int, char**) chrome/test/base/chrome_test_launcher.cc:360:10
    #13 0x6244ce66bc6b in main chrome/test/base/browser_tests_main.cc:60:10
    #14 0x7400dea2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7030dd352818 is located 8 bytes inside of 32-byte region [0x7030dd352810,0x7030dd352830)
freed by thread T0 here:
    #0 0x6244a6705c56 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/browser_tests+0x18efbc56) (BuildId: 5b388c39ed8a8ba6)
    #1 0x6244eb02e3fd in autofill::PasswordGenerationAgent::MaybeCreateCurrentGenerationItem(blink::WebInputElement, autofill::FieldRendererId, autofill::SynchronousFormCache const&) third_party/libc++/src/include/__vector/vector.h:258:67
    #2 0x6244eb02e886 in autofill::PasswordGenerationAgent::ShowPasswordGenerationSuggestions(blink::WebInputElement const&, autofill::SynchronousFormCache const&) components/autofill/content/renderer/password_generation_agent.cc:587:5
    #3 0x6244eaf72feb in autofill::AutofillAgent::ShowSuggestions(blink::WebFormControlElement const&, autofill::mojom::AutofillSuggestionTriggerSource, autofill::SynchronousFormCache const&, std::__Cr::optional<autofill::PasswordSuggestionRequest> const&) components/autofill/content/renderer/autofill_agent.cc:1609:37
    #4 0x6244eaf844bf in autofill::AutofillAgent::HandleFocusChangeComplete(bool, autofill::SynchronousFormCache const&) components/autofill/content/renderer/autofill_agent.cc
    #5 0x6244eaf6e752 in autofill::AutofillAgent::FocusedElementChanged(blink::WebElement const&)::$_1::operator()(base::optional_ref<autofill::FormData, (partition_alloc::internal::RawPtrTraits)0>) const components/autofill/content/renderer/autofill_agent.cc:689:7
    #6 0x6244eaf6db09 in autofill::AutofillAgent::FocusedElementChanged(blink::WebElement const&) components/autofill/content/renderer/autofill_agent.cc:716:9
    #7 0x6244dcad2618 in content::RenderFrameImpl::FocusedElementChanged(blink::WebElement const&) content/renderer/render_frame_impl.cc:5468:14
    #8 0x6244de611288 in blink::LocalFrameClientImpl::FocusedElementChanged(blink::Element*) third_party/blink/renderer/core/frame/local_frame_client_impl.cc:1179:25
    #9 0x6244e1a8cca3 in blink::Document::NotifyFocusedElementChanged(blink::Element*, blink::Element*, blink::mojom::FocusType) third_party/blink/renderer/core/dom/document.cc:6124:27
    #10 0x6244e1ab035f in blink::Document::SetFocusedElement(blink::Element*, blink::FocusParams const&) third_party/blink/renderer/core/dom/document.cc:6011:5
    #11 0x6244e003a35e in blink::FocusController::SetFocusedElement(blink::Element*, blink::Frame*, blink::FocusParams const&) third_party/blink/renderer/core/page/focus_controller.cc:2390:23
    #12 0x6244e1c7770d in blink::Element::Focus(blink::FocusParams const&) third_party/blink/renderer/core/dom/element.cc:8322:54
    #13 0x6244e1c76e21 in blink::Element::focusForBindings(blink::FocusOptions const*) third_party/blink/renderer/core/dom/element.cc:8224:3
    #14 0x6244e3b640fe in blink::(anonymous namespace)::v8_html_element::FocusOperationCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_html_element.cc:4735:17
    #15 0x6244c11626d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #16 0x6244c1160956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #17 0x6244c115d6db in Builtins_JSEntryTrampoline crtstuff.c
    #18 0x6244c115d42a in Builtins_JSEntry crtstuff.c
    #19 0x6244bc457ce1 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) v8/src/execution/execution.cc:475:22
    #20 0x6244bc456621 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) v8/src/execution/execution.cc:565:10
    #21 0x6244bc0a34dd in v8::Function::Call(v8::Isolate*, v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) v8/src/api/api.cc:5612:27
    #22 0x6244dce0b6ff in blink::V8ScriptRunner::CallFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:851:48
    #23 0x6244dcd29846 in blink::bindings::CallbackInvokeHelper<blink::CallbackInterfaceBase, (blink::bindings::CallbackInvokeHelperMode)0, (blink::bindings::CallbackReturnTypeIsPromise)0>::Call(int, v8::Local<v8::Value>*) third_party/blink/renderer/bindings/core/v8/callback_invoke_helper.cc:123:12
    #24 0x6244e261863a in blink::V8EventListener::InvokeWithoutRunnabilityCheck(blink::bindings::V8ValueOrScriptWrappableAdapter, blink::Event*) gen/third_party/blink/renderer/bindings/core/v8/v8_event_listener.cc:119:13
    #25 0x6244dcd4d678 in blink::JSBasedEventListener::Invoke(blink::ExecutionContext*, blink::Event*) third_party/blink/renderer/bindings/core/v8/js_based_event_listener.cc:189:5
    #26 0x6244dda9fefc in blink::EventTarget::FireEventListeners(blink::Event&, blink::EventTargetData*, blink::BasicHeapVector<(blink::internal::HeapCollectionType)1, cppgc::internal::BasicMember<blink::RegisteredEventListener, cppgc::internal::StrongMemberTag, cppgc::internal::DijkstraWriteBarrierPolicy, cppgc::internal::DisabledCheckingPolicy, cppgc::internal::CompressedPointer>, 1u>) third_party/blink/renderer/core/dom/events/event_target.cc:1081:15
    #27 0x6244dda9dc10 in blink::EventTarget::FireEventListeners(blink::Event&) third_party/blink/renderer/core/dom/events/event_target.cc:982:29
    #28 0x6244e1cfefcc in blink::EventDispatcher::DispatchEventAtBubbling() third_party/blink/renderer/core/dom/events/event_dispatcher.cc:356:21
    #29 0x6244e1cfdd62 in blink::EventDispatcher::Dispatch() third_party/blink/renderer/core/dom/events/event_dispatcher.cc:266:7

previously allocated by thread T0 here:
    #0 0x6244a6705051 in operator new(unsigned long) (/chromium/chromium/src/out/asan/browser_tests+0x18efb051) (BuildId: 5b388c39ed8a8ba6)
    #1 0x6244eb02dfc2 in autofill::PasswordGenerationAgent::MaybeCreateCurrentGenerationItem(blink::WebInputElement, autofill::FieldRendererId, autofill::SynchronousFormCache const&) third_party/libc++/src/include/__new/allocate.h:42:28
    #2 0x6244eb02e886 in autofill::PasswordGenerationAgent::ShowPasswordGenerationSuggestions(blink::WebInputElement const&, autofill::SynchronousFormCache const&) components/autofill/content/renderer/password_generation_agent.cc:587:5
    #3 0x6244eaf72feb in autofill::AutofillAgent::ShowSuggestions(blink::WebFormControlElement const&, autofill::mojom::AutofillSuggestionTriggerSource, autofill::SynchronousFormCache const&, std::__Cr::optional<autofill::PasswordSuggestionRequest> const&) components/autofill/content/renderer/autofill_agent.cc:1609:37
    #4 0x6244eaf844bf in autofill::AutofillAgent::HandleFocusChangeComplete(bool, autofill::SynchronousFormCache const&) components/autofill/content/renderer/autofill_agent.cc
    #5 0x6244eaf6e752 in autofill::AutofillAgent::FocusedElementChanged(blink::WebElement const&)::$_1::operator()(base::optional_ref<autofill::FormData, (partition_alloc::internal::RawPtrTraits)0>) const components/autofill/content/renderer/autofill_agent.cc:689:7
    #6 0x6244eaf6db09 in autofill::AutofillAgent::FocusedElementChanged(blink::WebElement const&) components/autofill/content/renderer/autofill_agent.cc:716:9
    #7 0x6244dcad2618 in content::RenderFrameImpl::FocusedElementChanged(blink::WebElement const&) content/renderer/render_frame_impl.cc:5468:14
    #8 0x6244de611288 in blink::LocalFrameClientImpl::FocusedElementChanged(blink::Element*) third_party/blink/renderer/core/frame/local_frame_client_impl.cc:1179:25
    #9 0x6244e1a8cca3 in blink::Document::NotifyFocusedElementChanged(blink::Element*, blink::Element*, blink::mojom::FocusType) third_party/blink/renderer/core/dom/document.cc:6124:27
    #10 0x6244e1ab035f in blink::Document::SetFocusedElement(blink::Element*, blink::FocusParams const&) third_party/blink/renderer/core/dom/document.cc:6011:5
    #11 0x6244e003a35e in blink::FocusController::SetFocusedElement(blink::Element*, blink::Frame*, blink::FocusParams const&) third_party/blink/renderer/core/page/focus_controller.cc:2390:23
    #12 0x6244deccbeab in blink::MouseEventManager::HandleMouseFocus(blink::HitTestResult const&, blink::InputDeviceCapabilities*) third_party/blink/renderer/core/input/mouse_event_manager.cc:624:35
    #13 0x6244dec9e4d5 in blink::EventHandler::HandleMousePressEvent(blink::WebMouseEvent const&) third_party/blink/renderer/core/input/event_handler.cc:969:42
    #14 0x6244ded22f45 in blink::WidgetEventHandler::HandleMouseDown(blink::LocalFrame&, blink::WebMouseEvent const&) third_party/blink/renderer/core/input/widget_event_handler.cc:187:32
    #15 0x6244de519f30 in blink::WebFrameWidgetImpl::HandleMouseDown(blink::LocalFrame&, blink::WebMouseEvent const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:1078:23
    #16 0x6244ded21f9b in blink::WidgetEventHandler::HandleInputEvent(blink::WebCoalescedInputEvent const&, blink::LocalFrame*) third_party/blink/renderer/core/input/widget_event_handler.cc
    #17 0x6244de533fce in blink::WebFrameWidgetImpl::HandleInputEvent(blink::WebCoalescedInputEvent const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:3156:30
    #18 0x6244e1622327 in blink::WidgetBaseInputHandler::HandleInputEvent(blink::WebCoalescedInputEvent const&, std::__Cr::unique_ptr<cc::EventMetrics, std::__Cr::default_delete<cc::EventMetrics>>, base::OnceCallback<void (blink::mojom::InputEventResultState, ui::LatencyInfo const&, std::__Cr::unique_ptr<blink::InputHandlerProxy::DidOverscrollParams, std::__Cr::default_delete<blink::InputHandlerProxy::DidOverscrollParams>>, std::__Cr::optional<cc::TouchAction>)>) third_party/blink/renderer/platform/widget/input/widget_base_input_handler.cc:421:40
    #19 0x6244de532f68 in blink::WebFrameWidgetImpl::ProcessInputEventSynchronouslyForTesting(blink::WebCoalescedInputEvent const&) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:3022:33
    #20 0x6244d0f5ae32 in content::RenderViewTest::SimulatePointClick(gfx::Point const&) content/public/test/render_view_test.cc:695:24
    #21 0x6244d0f5aa47 in content::RenderViewTest::SimulateElementClick(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) content/public/test/render_view_test.cc:685:3
    #22 0x6244aa06284f in autofill::(anonymous namespace)::PasswordGenerationAgentReentrantUafTest_GeneratedPasswordAcceptedReentrantFree_Test::TestBody() chrome/renderer/autofill/password_generation_agent_browsertest.cc:1657:15
    #23 0x6244c70d267b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #24 0x6244c70d57e7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #25 0x6244c70d78e3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #26 0x6244c71074aa in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #27 0x6244c7105f7e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #28 0x6244ced7b67c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #29 0x6244eb659920 in ChromeTestSuiteRunner::RunTestSuite(int, char**) chrome/test/base/chrome_test_launcher.cc:101:22

Shadow bytes around the buggy address:
  0x7030dd352580: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa
  0x7030dd352600: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fa
  0x7030dd352680: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
  0x7030dd352700: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x7030dd352780: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
=>0x7030dd352800: fa fa fd[fd]fd fd fa fa fd fd fd fd fa fa fd fd
  0x7030dd352880: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x7030dd352900: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00
  0x7030dd352980: fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa 00 00
  0x7030dd352a00: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x7030dd352a80: fd fd fd fd fa fa 00 00 00 00 fa fa fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
E0000 00:00:1779845509.492708    6879 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==6879==ADDITIONAL INFO
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779845509.492808    6879 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==6879==Note: Please include this section with the ASan report.
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779845509.492849    6879 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace:
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779845509.492881    6879 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779845509.492918    6879 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==6879==END OF ADDITIONAL INFO
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31

E0000 00:00:1779845509.492964    6879 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: 
==6879==ABORTING
=== Source Location Trace: === 
../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31