================================================================= ==500495==ERROR: AddressSanitizer: heap-use-after-free on address 0x6180001ddb20 at pc 0x557057427dcc bp 0x7ffca05479b0 sp 0x7ffca05479a8 READ of size 1 at 0x6180001ddb20 thread T0 (chrome) #0 0x557057427dcb in optional_data third_party/abseil-cpp/absl/types/internal/optional.h:208:13 #1 0x557057427dcb in optional third_party/abseil-cpp/absl/types/optional.h:139:3 #2 0x557057427dcb in group chrome/browser/ui/views/tabs/tab_slot_view.h:38:65 #3 0x557057427dcb in SlotIsCollapsedTab chrome/browser/ui/views/tabs/tab_strip_layout_helper.cc:443:69 #4 0x557057427dcb in TabStripLayoutHelper::CalculateIdealBounds(absl::optional) chrome/browser/ui/views/tabs/tab_strip_layout_helper.cc:299:54 #5 0x55705742a449 in TabStripLayoutHelper::CalculateMinimumWidth() chrome/browser/ui/views/tabs/tab_strip_layout_helper.cc:230:41 #6 0x5570573c1b34 in TabStrip::GetMinimumSize() const chrome/browser/ui/views/tabs/tab_strip.cc:2170:45 #7 0x55705587d6cf in get ui/views/layout/flex_layout_types.cc:62:15 #8 0x55705587d6cf in operator-> ui/views/layout/flex_layout_types.cc:58:48 #9 0x55705587d6cf in views::(anonymous namespace)::GetPreferredSize(views::MinimumFlexSizeRule, views::MaximumFlexSizeRule, views::MinimumFlexSizeRule, views::MaximumFlexSizeRule, bool, views::View const*, views::SizeBounds const&) ui/views/layout/flex_layout_types.cc:202:51 #10 0x55705587eccc in Invoke base/bind_internal.h:430:12 #11 0x55705587eccc in MakeItSo base/bind_internal.h:699:12 #12 0x55705587eccc in RunImpl &, 0UL, 1UL, 2UL, 3UL, 4UL> base/bind_internal.h:772:12 #13 0x55705587eccc in base::internal::Invoker, gfx::Size (views::View const*, views::SizeBounds const&)>::Run(base::internal::BindStateBase*, views::View const*, views::SizeBounds const&) base/bind_internal.h:754:12 #14 0x557055874327 in Run base/callback.h:241:12 #15 0x557055874327 in views::FlexLayout::GetPreferredSizeForRule(base::RepeatingCallback const&, views::View const*, views::SizeBound const&) const ui/views/layout/flex_layout.cc:483:12 #16 0x55705586e92c in views::FlexLayout::InitializeChildData(views::NormalizedSizeBounds const&, views::FlexLayout::FlexLayoutData&, std::__1::map >, std::__1::less, std::__1::allocator > > > >&) const ui/views/layout/flex_layout.cc:548:9 #17 0x55705586cfb3 in views::FlexLayout::CalculateProposedLayout(views::SizeBounds const&) const ui/views/layout/flex_layout.cc:421:3 #18 0x55705588035a in GetProposedLayout ui/views/layout/layout_manager_base.cc:104:22 #19 0x55705588035a in views::LayoutManagerBase::GetAvailableSize(views::View const*, views::View const*) const ui/views/layout/layout_manager_base.cc:68:5 #20 0x5570558e9a82 in views::View::GetAvailableSize(views::View const*) const ui/views/view.cc:563:32 #21 0x5570573b30bf in GetAvailableWidthForTabStrip chrome/browser/ui/views/tabs/tab_strip.cc:3184:26 #22 0x5570573b30bf in TabStrip::UpdateIdealBounds() chrome/browser/ui/views/tabs/tab_strip.cc:3170:27 #23 0x5570573b42ed in TabStrip::OnGroupVisualsChanged(tab_groups::TabGroupId const&, tab_groups::TabGroupVisualData const*, tab_groups::TabGroupVisualData const*) chrome/browser/ui/views/tabs/tab_strip.cc:1277:3 #24 0x55705734cfd0 in BrowserTabStripController::OnTabGroupChanged(TabGroupChange const&) chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc:718:18 #25 0x557056643bc0 in TabStripModel::ChangeTabGroupVisuals(tab_groups::TabGroupId const&, TabGroupChange::VisualsChange const&) chrome/browser/ui/tabs/tab_strip_model.cc:1228:14 #26 0x55705661fff8 in TabGroup::AddTab() chrome/browser/ui/tabs/tab_group.cc:68:18 #27 0x55705664020a in TabStripModel::GroupTab(int, tab_groups::TabGroupId const&) chrome/browser/ui/tabs/tab_strip_model.cc:2245:37 #28 0x557056628228 in TabStripModel::InsertWebContentsAtImpl(int, std::__1::unique_ptr >, int, absl::optional) chrome/browser/ui/tabs/tab_strip_model.cc:1758:5 #29 0x557056627233 in TabStripModel::InsertWebContentsAt(int, std::__1::unique_ptr >, int, absl::optional) chrome/browser/ui/tabs/tab_strip_model.cc:366:10 #30 0x557057386288 in TabDragController::Attach(TabDragContext*, gfx::Point const&, std::__1::unique_ptr >, bool) chrome/browser/ui/views/tabs/tab_drag_controller.cc:1175:46 #31 0x55705738d1d9 in DetachAndAttachToNewContext chrome/browser/ui/views/tabs/tab_drag_controller.cc:1058:3 #32 0x55705738d1d9 in TabDragController::DragBrowserToNewTabStrip(TabDragContext*, gfx::Point const&) chrome/browser/ui/views/tabs/tab_drag_controller.cc:921:7 #33 0x55705738b910 in TabDragController::ContinueDragging(gfx::Point const&) chrome/browser/ui/views/tabs/tab_drag_controller.cc:836:9 #34 0x557057384ad7 in TabDragController::Drag(gfx::Point const&) chrome/browser/ui/views/tabs/tab_drag_controller.cc:600:7 #35 0x55705738c585 in TabDragController::OnWidgetBoundsChanged(views::Widget*, gfx::Rect const&) chrome/browser/ui/views/tabs/tab_drag_controller.cc:689:3 #36 0x557055956096 in views::Widget::OnNativeWidgetMove() ui/views/widget/widget.cc:1438:14 #37 0x557055a459bd in views::DesktopNativeWidgetAura::OnHostMovedInPixels(aura::WindowTreeHost*, gfx::Point const&) ui/views/widget/desktop_aura/desktop_native_widget_aura.cc:1369:28 #38 0x5570510d9767 in aura::WindowTreeHost::OnHostMovedInPixels(gfx::Point const&) ui/aura/window_tree_host.cc:687:14 #39 0x557055a2e6d3 in aura::WindowTreeHostPlatform::OnBoundsChanged(ui::PlatformWindowDelegate::BoundsChange const&) ui/aura/window_tree_host_platform.cc:204:5 #40 0x557056e5a3a8 in OnBoundsChanged chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc:267:31 #41 0x557056e5a3a8 in non-virtual thunk to BrowserDesktopWindowTreeHostLinux::OnBoundsChanged(ui::PlatformWindowDelegate::BoundsChange const&) chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc #42 0x55704fa6d725 in OnXWindowBoundsChanged ui/platform_window/x11/x11_window.cc:1377:30 #43 0x55704fa6d725 in ui::X11Window::SetBounds(gfx::Rect const&) ui/platform_window/x11/x11_window.cc:533:3 #44 0x55704fa93a8a in ui::X11DesktopWindowMoveClient::OnMouseMovement(gfx::Point const&, int, base::TimeTicks) ui/base/x/x11_desktop_window_move_client.cc:23:12 #45 0x55704fa945bb in ui::X11WholeScreenMoveLoop::DispatchEvent(ui::Event* const&) ui/base/x/x11_whole_screen_move_loop.cc:108:18 #46 0x55704e52c020 in ui::PlatformEventSource::DispatchEvent(ui::Event*) ui/events/platform/platform_event_source.cc:93:38 #47 0x55704f8e1874 in ui::X11EventSource::OnEvent(x11::Event const&) ui/events/platform/x11/x11_event_source.cc:287:5 #48 0x55703f290bca in x11::Connection::DispatchEvent(x11::Event const&) ui/gfx/x/connection.cc:469:14 #49 0x55703f28fc31 in ProcessNextEvent ui/gfx/x/connection.cc:520:3 #50 0x55703f28fc31 in x11::Connection::Dispatch() ui/gfx/x/connection.cc:446:5 #51 0x55704f8ef934 in ui::(anonymous namespace)::XSourceDispatch(_GSource*, int (*)(void*), void*) ui/events/platform/x11/x11_event_watcher_glib.cc:55:15 #52 0x7ffb3111904d in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5204d) 0x6180001ddb20 is located 672 bytes inside of 816-byte region [0x6180001dd880,0x6180001ddbb0) freed by thread T0 (chrome) here: #0 0x55703dc9458d in operator delete(void*) /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cpp:152:3 #1 0x5570573dc15a in operator() buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:54:5 #2 0x5570573dc15a in reset buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:315:7 #3 0x5570573dc15a in ~unique_ptr buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:269:19 #4 0x5570573dc15a in TabGroupViews::~TabGroupViews() chrome/browser/ui/views/tabs/tab_group_views.cc:35:3 #5 0x5570573b280d in operator() buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:54:5 #6 0x5570573b280d in reset buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:315:7 #7 0x5570573b280d in operator= buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:234:5 #8 0x5570573b280d in TabStrip::OnGroupCreated(tab_groups::TabGroupId const&) chrome/browser/ui/views/tabs/tab_strip.cc:1245:23 #9 0x55705734cb33 in BrowserTabStripController::OnTabGroupChanged(TabGroupChange const&) chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc:677:18 #10 0x557056641d40 in TabStripModel::CreateTabGroup(tab_groups::TabGroupId const&) chrome/browser/ui/tabs/tab_strip_model.cc:1207:14 #11 0x55705661ff71 in TabGroup::AddTab() chrome/browser/ui/tabs/tab_group.cc:65:18 #12 0x55705664020a in TabStripModel::GroupTab(int, tab_groups::TabGroupId const&) chrome/browser/ui/tabs/tab_strip_model.cc:2245:37 #13 0x557056628228 in TabStripModel::InsertWebContentsAtImpl(int, std::__1::unique_ptr >, int, absl::optional) chrome/browser/ui/tabs/tab_strip_model.cc:1758:5 #14 0x557056627233 in TabStripModel::InsertWebContentsAt(int, std::__1::unique_ptr >, int, absl::optional) chrome/browser/ui/tabs/tab_strip_model.cc:366:10 #15 0x557057386288 in TabDragController::Attach(TabDragContext*, gfx::Point const&, std::__1::unique_ptr >, bool) chrome/browser/ui/views/tabs/tab_drag_controller.cc:1175:46 #16 0x55705738d1d9 in DetachAndAttachToNewContext chrome/browser/ui/views/tabs/tab_drag_controller.cc:1058:3 #17 0x55705738d1d9 in TabDragController::DragBrowserToNewTabStrip(TabDragContext*, gfx::Point const&) chrome/browser/ui/views/tabs/tab_drag_controller.cc:921:7 #18 0x55705738b910 in TabDragController::ContinueDragging(gfx::Point const&) chrome/browser/ui/views/tabs/tab_drag_controller.cc:836:9 #19 0x557057384ad7 in TabDragController::Drag(gfx::Point const&) chrome/browser/ui/views/tabs/tab_drag_controller.cc:600:7 #20 0x55705738c585 in TabDragController::OnWidgetBoundsChanged(views::Widget*, gfx::Rect const&) chrome/browser/ui/views/tabs/tab_drag_controller.cc:689:3 #21 0x557055956096 in views::Widget::OnNativeWidgetMove() ui/views/widget/widget.cc:1438:14 #22 0x557055a459bd in views::DesktopNativeWidgetAura::OnHostMovedInPixels(aura::WindowTreeHost*, gfx::Point const&) ui/views/widget/desktop_aura/desktop_native_widget_aura.cc:1369:28 #23 0x5570510d9767 in aura::WindowTreeHost::OnHostMovedInPixels(gfx::Point const&) ui/aura/window_tree_host.cc:687:14 #24 0x557055a2e6d3 in aura::WindowTreeHostPlatform::OnBoundsChanged(ui::PlatformWindowDelegate::BoundsChange const&) ui/aura/window_tree_host_platform.cc:204:5 #25 0x557056e5a3a8 in OnBoundsChanged chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc:267:31 #26 0x557056e5a3a8 in non-virtual thunk to BrowserDesktopWindowTreeHostLinux::OnBoundsChanged(ui::PlatformWindowDelegate::BoundsChange const&) chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc #27 0x55704fa6d725 in OnXWindowBoundsChanged ui/platform_window/x11/x11_window.cc:1377:30 #28 0x55704fa6d725 in ui::X11Window::SetBounds(gfx::Rect const&) ui/platform_window/x11/x11_window.cc:533:3 #29 0x55704fa93a8a in ui::X11DesktopWindowMoveClient::OnMouseMovement(gfx::Point const&, int, base::TimeTicks) ui/base/x/x11_desktop_window_move_client.cc:23:12 #30 0x55704fa945bb in ui::X11WholeScreenMoveLoop::DispatchEvent(ui::Event* const&) ui/base/x/x11_whole_screen_move_loop.cc:108:18 #31 0x55704e52c020 in ui::PlatformEventSource::DispatchEvent(ui::Event*) ui/events/platform/platform_event_source.cc:93:38 #32 0x55704f8e1874 in ui::X11EventSource::OnEvent(x11::Event const&) ui/events/platform/x11/x11_event_source.cc:287:5 #33 0x55703f290bca in x11::Connection::DispatchEvent(x11::Event const&) ui/gfx/x/connection.cc:469:14 #34 0x55703f28fc31 in ProcessNextEvent ui/gfx/x/connection.cc:520:3 #35 0x55703f28fc31 in x11::Connection::Dispatch() ui/gfx/x/connection.cc:446:5 #36 0x55704f8ef934 in ui::(anonymous namespace)::XSourceDispatch(_GSource*, int (*)(void*), void*) ui/events/platform/x11/x11_event_watcher_glib.cc:55:15 #37 0x7ffb3111904d in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5204d) previously allocated by thread T0 (chrome) here: #0 0x55703dc93d2d in operator new(unsigned long) /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cpp:95:3 #1 0x5570573dbe95 in make_unique &, const tab_groups::TabGroupId &> buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:725:28 #2 0x5570573dbe95 in TabGroupViews::TabGroupViews(TabStrip*, tab_groups::TabGroupId const&) chrome/browser/ui/views/tabs/tab_group_views.cc:27:7 #3 0x5570573b2712 in make_unique buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:725:32 #4 0x5570573b2712 in TabStrip::OnGroupCreated(tab_groups::TabGroupId const&) chrome/browser/ui/views/tabs/tab_strip.cc:1243:21 #5 0x55705734cb33 in BrowserTabStripController::OnTabGroupChanged(TabGroupChange const&) chrome/browser/ui/views/tabs/browser_tab_strip_controller.cc:677:18 #6 0x557056641d40 in TabStripModel::CreateTabGroup(tab_groups::TabGroupId const&) chrome/browser/ui/tabs/tab_strip_model.cc:1207:14 #7 0x55705661ff71 in TabGroup::AddTab() chrome/browser/ui/tabs/tab_group.cc:65:18 #8 0x55705664020a in TabStripModel::GroupTab(int, tab_groups::TabGroupId const&) chrome/browser/ui/tabs/tab_strip_model.cc:2245:37 #9 0x55705664e3e0 in TabStripModel::MoveAndSetGroup(int, int, absl::optional) chrome/browser/ui/tabs/tab_strip_model.cc:2194:5 #10 0x55705663da88 in TabStripModel::MoveTabsAndSetGroupImpl(std::__1::vector > const&, int, absl::optional) chrome/browser/ui/tabs/tab_strip_model.cc:2163:5 #11 0x55705663c8f1 in TabStripModel::AddToNewGroupImpl(std::__1::vector > const&, tab_groups::TabGroupId const&) chrome/browser/ui/tabs/tab_strip_model.cc:2110:3 #12 0x55705663c32c in TabStripModel::AddToNewGroup(std::__1::vector > const&) chrome/browser/ui/tabs/tab_strip_model.cc:1090:3 #13 0x557054a97783 in extensions::TabsGroupFunction::Run() chrome/browser/extensions/api/tabs/tabs_api.cc:1931:24 #14 0x55704537bac0 in ExtensionFunction::RunWithValidation() extensions/browser/extension_function.cc:514:10 #15 0x557045384d5f in extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal(extensions::mojom::RequestParams const&, content::RenderFrameHost*, int, base::OnceCallback, std::__1::allocator > const&)>) extensions/browser/extension_function_dispatcher.cc:401:15 #16 0x557045384060 in extensions::ExtensionFunctionDispatcher::Dispatch(mojo::StructPtr, content::RenderFrameHost*, int, base::OnceCallback, std::__1::allocator > const&)>) extensions/browser/extension_function_dispatcher.cc:257:3 #17 0x5570453793aa in extensions::ExtensionFrameHost::Request(mojo::StructPtr, base::OnceCallback, std::__1::allocator > const&)>) extensions/browser/extension_frame_host.cc:46:9 #18 0x5570420d8278 in extensions::mojom::LocalFrameHostStubDispatch::AcceptWithResponder(extensions::mojom::LocalFrameHost*, mojo::Message*, std::__1::unique_ptr >) gen/extensions/common/mojom/frame.mojom.cc:2087:13 #19 0x55704cb69f80 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:862:56 #20 0x55704cb7cb52 in mojo::MessageDispatcher::Accept(mojo::Message*) mojo/public/cpp/bindings/lib/message_dispatcher.cc:48:24 #21 0x55704cb6e297 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:657:20 #22 0x55704e461811 in IPC::(anonymous namespace)::ChannelAssociatedGroupController::AcceptOnEndpointThread(mojo::Message) ipc/ipc_mojo_bootstrap.cc:1008:24 #23 0x55704e459e54 in Invoke, mojo::Message> base/bind_internal.h:535:12 #24 0x55704e459e54 in MakeItSo, mojo::Message> base/bind_internal.h:699:12 #25 0x55704e459e54 in RunImpl, mojo::Message>, 0UL, 1UL> base/bind_internal.h:772:12 #26 0x55704e459e54 in base::internal::Invoker, mojo::Message>, void ()>::RunOnce(base::internal::BindStateBase*) base/bind_internal.h:741:12 #27 0x55704c02bd13 in Run base/callback.h:142:12 #28 0x55704c02bd13 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/task/common/task_annotator.cc:135:32 #29 0x55704c06af13 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:358:29)> base/task/common/task_annotator.h:74:5 #30 0x55704c06af13 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::sequence_manager::LazyNow*) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:356:21 #31 0x55704c06a727 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:261:30 #32 0x55704c06bae1 in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc #33 0x55704bf2204a in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:405:48 #34 0x55704c06c1a7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:468:12 #35 0x55704bfa3e19 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:140:14 #36 0x557042bdf340 in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1048:18 SUMMARY: AddressSanitizer: heap-use-after-free third_party/abseil-cpp/absl/types/internal/optional.h:208:13 in optional_data Shadow bytes around the buggy address: 0x0c3080033b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3080033b20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3080033b30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3080033b40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3080033b50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c3080033b60: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd 0x0c3080033b70: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa 0x0c3080033b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3080033b90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3080033ba0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3080033bb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==500495==ABORTING