Abridged report:

```
==529==ERROR: AddressSanitizer: heap-use-after-free on address 0x6030000d5680 at pc 0x55d10f042120 bp 0x7f03d170ef30 sp 0x7f03d170ef28
READ of size 1 at 0x6030000d5680 thread T6 (VizCompositorTh)
    #0 0x55d10f04211f in mojo::SequenceLocalSyncEventWatcher::SequenceLocalState::OnEventSignaled() ./../../mojo/public/cpp/bindings/lib/sequence_local_sync_event_watcher.cc:214:47
[...]
    #9 0x55d104fcd6a7 in viz::mojom::DisplayClientProxy::IsOffscreen(bool*) ./gen/services/viz/privileged/mojom/compositing/display_private.mojom.cc:789:28
    #10 0x55d11adfe260 in viz::OutputSurfaceProviderImpl::CreateSoftwareOutputDeviceForPlatform(unsigned long, viz::mojom::DisplayClient*) ./../../components/viz/service/display_embedder/output_surface_provider_impl.cc:234:25
[...]

0x6030000d5680 is located 16 bytes inside of 24-byte region [0x6030000d5670,0x6030000d5688)
freed by thread T6 (VizCompositorTh) here:
    #0 0x55d1015515dd in operator delete(void*) /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cpp:160:3
[...]
    #9 0x55d10f0136da in mojo::internal::InterfacePtrStateBase::~InterfacePtrStateBase() ./../../mojo/public/cpp/bindings/lib/interface_ptr_state.cc:15:20
[...]
    #26 0x55d11ae4c3a0 in viz::FrameSinkManagerImpl::DestroyCompositorFrameSink(viz::FrameSinkId const&, base::OnceCallback<void ()>) ./../../components/viz/service/frame_sinks/frame_sink_manager_impl.cc:192:18
[...]

previously allocated by thread T6 (VizCompositorTh) here:
[...]
    #6 0x55d104fcd6a7 in viz::mojom::DisplayClientProxy::IsOffscreen(bool*) ./gen/services/viz/privileged/mojom/compositing/display_private.mojom.cc:789:28
    #7 0x55d11adfe260 in viz::OutputSurfaceProviderImpl::CreateSoftwareOutputDeviceForPlatform(unsigned long, viz::mojom::DisplayClient*) ./../../components/viz/service/display_embedder/output_surface_provider_impl.cc:234:25
```

Full ASan report:

<details>

```
=================================================================
==529==ERROR: AddressSanitizer: heap-use-after-free on address 0x6030000d5680 at pc 0x55d10f042120 bp 0x7f03d170ef30 sp 0x7f03d170ef28
READ of size 1 at 0x6030000d5680 thread T6 (VizCompositorTh)
    #0 0x55d10f04211f in mojo::SequenceLocalSyncEventWatcher::SequenceLocalState::OnEventSignaled() ./../../mojo/public/cpp/bindings/lib/sequence_local_sync_event_watcher.cc:214:47
    #1 0x55d10f04b109 in Run ./../../base/callback.h:133:12
    #2 0x55d10f04b109 in mojo::SyncHandleRegistry::Wait(bool const**, unsigned long) ./../../mojo/public/cpp/bindings/lib/sync_handle_registry.cc:153:20
    #3 0x55d10f0479ae in mojo::SyncEventWatcher::SyncWatch(bool const**, unsigned long) ./../../mojo/public/cpp/bindings/lib/sync_event_watcher.cc:51:28
    #4 0x55d10f0429ef in SyncWatch ./../../mojo/public/cpp/bindings/lib/sequence_local_sync_event_watcher.cc:162:34
    #5 0x55d10f0429ef in mojo::SequenceLocalSyncEventWatcher::SyncWatch(bool const*) ./../../mojo/public/cpp/bindings/lib/sequence_local_sync_event_watcher.cc:282:41
    #6 0x55d10f02a743 in mojo::internal::MultiplexRouter::InterfaceEndpoint::SyncWatch(bool const*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:147:27
    #7 0x55d10f000d5e in mojo::InterfaceEndpointClient::SendMessageWithResponder(mojo::Message*, bool, std::__1::unique_ptr<mojo::MessageReceiver, std::__1::default_delete<mojo::MessageReceiver> >) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:335:16
    #8 0x55d10f001617 in mojo::InterfaceEndpointClient::AcceptWithResponder(mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiver, std::__1::default_delete<mojo::MessageReceiver> >) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:247:10
    #9 0x55d104fcd6a7 in viz::mojom::DisplayClientProxy::IsOffscreen(bool*) ./gen/services/viz/privileged/mojom/compositing/display_private.mojom.cc:789:28
    #10 0x55d11adfe260 in viz::OutputSurfaceProviderImpl::CreateSoftwareOutputDeviceForPlatform(unsigned long, viz::mojom::DisplayClient*) ./../../components/viz/service/display_embedder/output_surface_provider_impl.cc:234:25
    #11 0x55d11adfd740 in viz::OutputSurfaceProviderImpl::CreateOutputSurface(unsigned long, bool, viz::mojom::DisplayClient*, viz::RendererSettings const&) ./../../components/viz/service/display_embedder/output_surface_provider_impl.cc:118:9
    #12 0x55d11ae898bc in viz::RootCompositorFrameSinkImpl::Create(mojo::StructPtr<viz::mojom::RootCompositorFrameSinkParams>, viz::FrameSinkManagerImpl*, viz::OutputSurfaceProvider*, unsigned int, bool) ./../../components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc:40:50
    #13 0x55d11ae4ae3a in viz::FrameSinkManagerImpl::CreateRootCompositorFrameSink(mojo::StructPtr<viz::mojom::RootCompositorFrameSinkParams>) ./../../components/viz/service/frame_sinks/frame_sink_manager_impl.cc:170:37
    #14 0x55d104fe3365 in viz::mojom::FrameSinkManagerStubDispatch::Accept(viz::mojom::FrameSinkManager*, mojo::Message*) ./gen/services/viz/privileged/mojom/compositing/frame_sink_manager.mojom.cc:1354:13
    #15 0x55d10effd618 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:554:54
    #16 0x55d10f015bc3 in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:41:19
    #17 0x55d10f001804 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:356:22
    #18 0x55d10f025beb in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:953:42
    #19 0x55d10f023cfc in mojo::internal::MultiplexRouter::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:620:38
    #20 0x55d10f015bc3 in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:41:19
    #21 0x55d10efef890 in mojo::Connector::DispatchMessage(mojo::Message) ./../../mojo/public/cpp/bindings/lib/connector.cc:539:49
    #22 0x55d10eff2564 in mojo::Connector::ReadAllAvailableMessages() ./../../mojo/public/cpp/bindings/lib/connector.cc:627:12
    #23 0x55d10eff1b52 in mojo::Connector::OnHandleReadyInternal(unsigned int) ./../../mojo/public/cpp/bindings/lib/connector.cc:446:3
    #24 0x55d101613b9c in Run ./../../base/callback.h:133:12
    #25 0x55d101613b9c in mojo::SimpleWatcher::DiscardReadyState(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.h:194:14
    #26 0x55d10f08c3a5 in Run ./../../base/callback.h:133:12
    #27 0x55d10f08c3a5 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.cc:292:14
    #28 0x55d10f08d44d in Invoke<void (mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState> ./../../base/bind_internal.h:490:12
    #29 0x55d10f08d44d in MakeItSo<void (mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState> ./../../base/bind_internal.h:644:5
    #30 0x55d10f08d44d in RunImpl<void (mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &), std::__1::tuple<base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, 0, 1, 2, 3> ./../../base/bind_internal.h:697:12
    #31 0x55d10f08d44d in base::internal::Invoker<base::internal::BindState<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/bind_internal.h:666:12
    #32 0x55d10dbb68b7 in Run ./../../base/callback.h:99:12
    #33 0x55d10dbb68b7 in base::TaskAnnotator::RunTask(char const*, base::PendingTask*) ./../../base/task/common/task_annotator.cc:142:33
    #34 0x55d10dc0f7fa in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::sequence_manager::LazyNow*) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:321:23
    #35 0x55d10dc0efdf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:246:36
    #36 0x55d10dace173 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:39:55
    #37 0x55d10dc10f07 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:425:12
    #38 0x55d10db57088 in base::RunLoop::Run() ./../../base/run_loop.cc:124:14
    #39 0x55d10dc9214d in base::Thread::Run(base::RunLoop*) ./../../base/threading/thread.cc:309:13
    #40 0x55d10dc92c4b in base::Thread::ThreadMain() ./../../base/threading/thread.cc:380:3
    #41 0x55d10dd9788b in base::(anonymous namespace)::ThreadFunc(void*) ./../../base/threading/platform_thread_posix.cc:81:13
    #42 0x7f03eb6936da in start_thread ??:0:0
0x6030000d5680 is located 16 bytes inside of 24-byte region [0x6030000d5670,0x6030000d5688)
freed by thread T6 (VizCompositorTh) here:
    #0 0x55d1015515dd in operator delete(void*) /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cpp:160:3
    #1 0x55d10f021be6 in operator() ./../../buildtools/third_party/libc++/trunk/include/memory:2378:5
    #2 0x55d10f021be6 in reset ./../../buildtools/third_party/libc++/trunk/include/memory:2633:7
    #3 0x55d10f021be6 in mojo::internal::MultiplexRouter::InterfaceEndpoint::DetachClient() ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:104:19
    #4 0x55d10f021766 in mojo::internal::MultiplexRouter::DetachEndpointClient(mojo::ScopedInterfaceEndpointHandle const&) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:497:13
    #5 0x55d10effecab in mojo::InterfaceEndpointClient::~InterfaceEndpointClient() ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:178:33
    #6 0x55d10effeedd in mojo::InterfaceEndpointClient::~InterfaceEndpointClient() ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:175:53
    #7 0x55d10f0136da in operator() ./../../buildtools/third_party/libc++/trunk/include/memory:2378:5
    #8 0x55d10f0136da in reset ./../../buildtools/third_party/libc++/trunk/include/memory:2633:7
    #9 0x55d10f0136da in mojo::internal::InterfacePtrStateBase::~InterfacePtrStateBase() ./../../mojo/public/cpp/bindings/lib/interface_ptr_state.cc:15:20
    #10 0x55d11ae8b60d in ~InterfacePtrState ./../../mojo/public/cpp/bindings/lib/interface_ptr_state.h:127:32
    #11 0x55d11ae8b60d in ~Remote ./../../mojo/public/cpp/bindings/remote.h:87:21
    #12 0x55d11ae8b60d in viz::RootCompositorFrameSinkImpl::~RootCompositorFrameSinkImpl() ./../../components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc:165:1
    #13 0x55d11ae8b76d in viz::RootCompositorFrameSinkImpl::~RootCompositorFrameSinkImpl() ./../../components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc:162:61
    #14 0x55d11ae5fa71 in operator() ./../../buildtools/third_party/libc++/trunk/include/memory:2378:5
    #15 0x55d11ae5fa71 in reset ./../../buildtools/third_party/libc++/trunk/include/memory:2633:7
    #16 0x55d11ae5fa71 in ~unique_ptr ./../../buildtools/third_party/libc++/trunk/include/memory:2587:19
    #17 0x55d11ae5fa71 in ~pair ./../../buildtools/third_party/libc++/trunk/include/utility:297:29
    #18 0x55d11ae5fa71 in destroy ./../../buildtools/third_party/libc++/trunk/include/memory:1920:64
    #19 0x55d11ae5fa71 in __destroy<std::__1::pair<viz::FrameSinkId, std::__1::unique_ptr<viz::RootCompositorFrameSinkImpl, std::__1::default_delete<viz::RootCompositorFrameSinkImpl>>>> ./../../buildtools/third_party/libc++/trunk/include/memory:1782:18
    #20 0x55d11ae5fa71 in destroy<std::__1::pair<viz::FrameSinkId, std::__1::unique_ptr<viz::RootCompositorFrameSinkImpl, std::__1::default_delete<viz::RootCompositorFrameSinkImpl>>>> ./../../buildtools/third_party/libc++/trunk/include/memory:1619:14
    #21 0x55d11ae5fa71 in __destruct_at_end ./../../buildtools/third_party/libc++/trunk/include/vector:426:9
    #22 0x55d11ae5fa71 in __destruct_at_end ./../../buildtools/third_party/libc++/trunk/include/vector:833:17
    #23 0x55d11ae5fa71 in std::__1::vector<std::__1::pair<viz::FrameSinkId, std::__1::unique_ptr<viz::RootCompositorFrameSinkImpl, std::__1::default_delete<viz::RootCompositorFrameSinkImpl> > >, std::__1::allocator<std::__1::pair<viz::FrameSinkId, std::__1::unique_ptr<viz::RootCompositorFrameSinkImpl, std::__1::default_delete<viz::RootCompositorFrameSinkImpl> > > > >::erase(std::__1::__wrap_iter<std::__1::pair<viz::FrameSinkId, std::__1::unique_ptr<viz::RootCompositorFrameSinkImpl, std::__1::default_delete<viz::RootCompositorFrameSinkImpl> > > const*>, std::__1::__wrap_iter<std::__1::pair<viz::FrameSinkId, std::__1::unique_ptr<viz::RootCompositorFrameSinkImpl, std::__1::default_delete<viz::RootCompositorFrameSinkImpl> > > const*>) ./../../buildtools/third_party/libc++/trunk/include/vector:1738:15
    #24 0x55d11ae4c3a0 in erase ./../../base/containers/flat_tree.h:792:22
    #25 0x55d11ae4c3a0 in erase<viz::FrameSinkId> ./../../base/containers/flat_tree.h:784:3
    #26 0x55d11ae4c3a0 in viz::FrameSinkManagerImpl::DestroyCompositorFrameSink(viz::FrameSinkId const&, base::OnceCallback<void ()>) ./../../components/viz/service/frame_sinks/frame_sink_manager_impl.cc:192:18
    #27 0x55d104fe547c in viz::mojom::FrameSinkManagerStubDispatch::AcceptWithResponder(viz::mojom::FrameSinkManager*, mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) ./gen/services/viz/privileged/mojom/compositing/frame_sink_manager.mojom.cc:1781:13
    #28 0x55d11ae5a32c in viz::mojom::FrameSinkManagerStub<mojo::RawPtrImplRefTraits<viz::mojom::FrameSinkManager> >::AcceptWithResponder(mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) ./gen/services/viz/privileged/mojom/compositing/frame_sink_manager.mojom.h:309:12
    #29 0x55d10effd563 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:528:56
    #30 0x55d10f015bc3 in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:41:19
    #31 0x55d10f001804 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:356:22
    #32 0x55d10f025beb in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:953:42
    #33 0x55d10f028b28 in mojo::internal::MultiplexRouter::ProcessFirstSyncMessageForEndpoint(unsigned int) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:825:20
    #34 0x55d10f02aef5 in mojo::internal::MultiplexRouter::InterfaceEndpoint::OnSyncEventSignaled() ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:166:37
    #35 0x55d10f041fe2 in Run ./../../base/callback.h:133:12
    #36 0x55d10f041fe2 in mojo::SequenceLocalSyncEventWatcher::SequenceLocalState::OnEventSignaled() ./../../mojo/public/cpp/bindings/lib/sequence_local_sync_event_watcher.cc:215:28
    #37 0x55d10f04b109 in Run ./../../base/callback.h:133:12
    #38 0x55d10f04b109 in mojo::SyncHandleRegistry::Wait(bool const**, unsigned long) ./../../mojo/public/cpp/bindings/lib/sync_handle_registry.cc:153:20
    #39 0x55d10f0479ae in mojo::SyncEventWatcher::SyncWatch(bool const**, unsigned long) ./../../mojo/public/cpp/bindings/lib/sync_event_watcher.cc:51:28
    #40 0x55d10f0429ef in SyncWatch ./../../mojo/public/cpp/bindings/lib/sequence_local_sync_event_watcher.cc:162:34
    #41 0x55d10f0429ef in mojo::SequenceLocalSyncEventWatcher::SyncWatch(bool const*) ./../../mojo/public/cpp/bindings/lib/sequence_local_sync_event_watcher.cc:282:41
    #42 0x55d10f02a743 in mojo::internal::MultiplexRouter::InterfaceEndpoint::SyncWatch(bool const*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:147:27
    #43 0x55d10f000d5e in mojo::InterfaceEndpointClient::SendMessageWithResponder(mojo::Message*, bool, std::__1::unique_ptr<mojo::MessageReceiver, std::__1::default_delete<mojo::MessageReceiver> >) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:335:16
    #44 0x55d10f001617 in mojo::InterfaceEndpointClient::AcceptWithResponder(mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiver, std::__1::default_delete<mojo::MessageReceiver> >) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:247:10
    #45 0x55d104fcd6a7 in viz::mojom::DisplayClientProxy::IsOffscreen(bool*) ./gen/services/viz/privileged/mojom/compositing/display_private.mojom.cc:789:28
    #46 0x55d11adfe260 in viz::OutputSurfaceProviderImpl::CreateSoftwareOutputDeviceForPlatform(unsigned long, viz::mojom::DisplayClient*) ./../../components/viz/service/display_embedder/output_surface_provider_impl.cc:234:25
    #47 0x55d11adfd740 in viz::OutputSurfaceProviderImpl::CreateOutputSurface(unsigned long, bool, viz::mojom::DisplayClient*, viz::RendererSettings const&) ./../../components/viz/service/display_embedder/output_surface_provider_impl.cc:118:9
    #48 0x55d11ae898bc in viz::RootCompositorFrameSinkImpl::Create(mojo::StructPtr<viz::mojom::RootCompositorFrameSinkParams>, viz::FrameSinkManagerImpl*, viz::OutputSurfaceProvider*, unsigned int, bool) ./../../components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc:40:50
    #49 0x55d11ae4ae3a in viz::FrameSinkManagerImpl::CreateRootCompositorFrameSink(mojo::StructPtr<viz::mojom::RootCompositorFrameSinkParams>) ./../../components/viz/service/frame_sinks/frame_sink_manager_impl.cc:170:37
previously allocated by thread T6 (VizCompositorTh) here:
    #0 0x55d101550d7d in operator new(unsigned long) /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cpp:99:3
    #1 0x55d10f02aac2 in make_unique<mojo::SequenceLocalSyncEventWatcher, base::RepeatingCallback<void ()>> ./../../buildtools/third_party/libc++/trunk/include/memory:3043:28
    #2 0x55d10f02aac2 in mojo::internal::MultiplexRouter::InterfaceEndpoint::EnsureSyncWatcherExists() ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:188:9
    #3 0x55d10f02a71e in mojo::internal::MultiplexRouter::InterfaceEndpoint::SyncWatch(bool const*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:146:5
    #4 0x55d10f000d5e in mojo::InterfaceEndpointClient::SendMessageWithResponder(mojo::Message*, bool, std::__1::unique_ptr<mojo::MessageReceiver, std::__1::default_delete<mojo::MessageReceiver> >) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:335:16
    #5 0x55d10f001617 in mojo::InterfaceEndpointClient::AcceptWithResponder(mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiver, std::__1::default_delete<mojo::MessageReceiver> >) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:247:10
    #6 0x55d104fcd6a7 in viz::mojom::DisplayClientProxy::IsOffscreen(bool*) ./gen/services/viz/privileged/mojom/compositing/display_private.mojom.cc:789:28
    #7 0x55d11adfe260 in viz::OutputSurfaceProviderImpl::CreateSoftwareOutputDeviceForPlatform(unsigned long, viz::mojom::DisplayClient*) ./../../components/viz/service/display_embedder/output_surface_provider_impl.cc:234:25
    #8 0x55d11adfd740 in viz::OutputSurfaceProviderImpl::CreateOutputSurface(unsigned long, bool, viz::mojom::DisplayClient*, viz::RendererSettings const&) ./../../components/viz/service/display_embedder/output_surface_provider_impl.cc:118:9
    #9 0x55d11ae898bc in viz::RootCompositorFrameSinkImpl::Create(mojo::StructPtr<viz::mojom::RootCompositorFrameSinkParams>, viz::FrameSinkManagerImpl*, viz::OutputSurfaceProvider*, unsigned int, bool) ./../../components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc:40:50
    #10 0x55d11ae4ae3a in viz::FrameSinkManagerImpl::CreateRootCompositorFrameSink(mojo::StructPtr<viz::mojom::RootCompositorFrameSinkParams>) ./../../components/viz/service/frame_sinks/frame_sink_manager_impl.cc:170:37
    #11 0x55d104fe3365 in viz::mojom::FrameSinkManagerStubDispatch::Accept(viz::mojom::FrameSinkManager*, mojo::Message*) ./gen/services/viz/privileged/mojom/compositing/frame_sink_manager.mojom.cc:1354:13
    #12 0x55d10effd618 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:554:54
    #13 0x55d10f015bc3 in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:41:19
    #14 0x55d10f001804 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:356:22
    #15 0x55d10f025beb in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:953:42
    #16 0x55d10f023cfc in mojo::internal::MultiplexRouter::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:620:38
    #17 0x55d10f015bc3 in mojo::MessageDispatcher::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/message_dispatcher.cc:41:19
    #18 0x55d10efef890 in mojo::Connector::DispatchMessage(mojo::Message) ./../../mojo/public/cpp/bindings/lib/connector.cc:539:49
    #19 0x55d10eff2564 in mojo::Connector::ReadAllAvailableMessages() ./../../mojo/public/cpp/bindings/lib/connector.cc:627:12
    #20 0x55d10eff1b52 in mojo::Connector::OnHandleReadyInternal(unsigned int) ./../../mojo/public/cpp/bindings/lib/connector.cc:446:3
    #21 0x55d101613b9c in Run ./../../base/callback.h:133:12
    #22 0x55d101613b9c in mojo::SimpleWatcher::DiscardReadyState(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.h:194:14
    #23 0x55d10f08c3a5 in Run ./../../base/callback.h:133:12
    #24 0x55d10f08c3a5 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.cc:292:14
    #25 0x55d10f08d44d in Invoke<void (mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState> ./../../base/bind_internal.h:490:12
    #26 0x55d10f08d44d in MakeItSo<void (mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState> ./../../base/bind_internal.h:644:5
    #27 0x55d10f08d44d in RunImpl<void (mojo::SimpleWatcher::*)(int, unsigned int, const mojo::HandleSignalsState &), std::__1::tuple<base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, 0, 1, 2, 3> ./../../base/bind_internal.h:697:12
    #28 0x55d10f08d44d in base::internal::Invoker<base::internal::BindState<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/bind_internal.h:666:12
    #29 0x55d10dbb68b7 in Run ./../../base/callback.h:99:12
    #30 0x55d10dbb68b7 in base::TaskAnnotator::RunTask(char const*, base::PendingTask*) ./../../base/task/common/task_annotator.cc:142:33
    #31 0x55d10dc0f7fa in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::sequence_manager::LazyNow*) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:321:23
    #32 0x55d10dc0efdf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:246:36
    #33 0x55d10dace173 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:39:55
    #34 0x55d10dc10f07 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:425:12
    #35 0x55d10db57088 in base::RunLoop::Run() ./../../base/run_loop.cc:124:14
    #36 0x55d10dc9214d in base::Thread::Run(base::RunLoop*) ./../../base/threading/thread.cc:309:13
Thread T6 (VizCompositorTh) created by T0 (electron) here:
    #0 0x55d10151271a in pthread_create /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_interceptors.cpp:214:3
    #1 0x55d10dd96701 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) ./../../base/threading/platform_thread_posix.cc:120:13
    #2 0x55d10dc9102a in base::Thread::StartWithOptions(base::Thread::Options const&) ./../../base/threading/thread.cc:186:15
    #3 0x55d10c1dd8f2 in CreateAndStartCompositorThread ./../../components/viz/service/main/viz_compositor_thread_runner_impl.cc:77:3
    #4 0x55d10c1dd8f2 in viz::VizCompositorThreadRunnerImpl::VizCompositorThreadRunnerImpl() ./../../components/viz/service/main/viz_compositor_thread_runner_impl.cc:91:15
    #5 0x55d10c1e352e in make_unique<viz::VizCompositorThreadRunnerImpl> ./../../buildtools/third_party/libc++/trunk/include/memory:3043:32
    #6 0x55d10c1e352e in viz::VizMainImpl::VizMainImpl(viz::VizMainImpl::Delegate*, viz::VizMainImpl::ExternalDependencies, std::__1::unique_ptr<gpu::GpuInit, std::__1::default_delete<gpu::GpuInit> >) ./../../components/viz/service/main/viz_main_impl.cc:82:9
    #7 0x55d11b091ee2 in content::GpuChildThread::GpuChildThread(base::RepeatingCallback<void ()>, content::ChildThreadImpl::Options, std::__1::unique_ptr<gpu::GpuInit, std::__1::default_delete<gpu::GpuInit> >) ./../../content/gpu/gpu_child_thread.cc:119:7
    #8 0x55d11b091b32 in content::GpuChildThread::GpuChildThread(base::RepeatingCallback<void ()>, std::__1::unique_ptr<gpu::GpuInit, std::__1::default_delete<gpu::GpuInit> >) ./../../content/gpu/gpu_child_thread.cc:101:7
    #9 0x55d11b09073b in content::GpuMain(content::MainFunctionParams const&) ./../../content/gpu/gpu_main.cc:375:11
    #10 0x55d109937303 in content::RunZygote(content::ContentMainDelegate*) ./../../content/app/content_main_runner_impl.cc:480:14
    #11 0x55d10993b368 in content::ContentMainRunnerImpl::Run(bool) ./../../content/app/content_main_runner_impl.cc:847:10
    #12 0x55d11369a9f4 in service_manager::Main(service_manager::MainParams const&) ./../../services/service_manager/embedder/main.cc:454:29
    #13 0x55d10573ba7f in content::ContentMain(content::ContentMainParams const&) ./../../content/app/content_main.cc:19:10
    #14 0x55d101553a2b in main ./../../electron/shell/app/electron_main.cc:231:10
    #15 0x7f03e3fc2b96 in __libc_start_main ??:0:0
SUMMARY: AddressSanitizer: heap-use-after-free (/home/builduser/project/src/out/Default/electron+0x1c3d611f)
Shadow bytes around the buggy address:
  0x0c0680012a80: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
  0x0c0680012a90: fa fa fd fd fd fa fa fa fd fd fd fd fa fa fd fd
  0x0c0680012aa0: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x0c0680012ab0: 00 00 00 fa fa fa 00 00 00 00 fa fa fd fd fd fd
  0x0c0680012ac0: fa fa fd fd fd fd fa fa fd fd fd fa fa fa fd fd
=>0x0c0680012ad0:[fd]fa fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x0c0680012ae0: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
  0x0c0680012af0: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x0c0680012b00: fd fa fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x0c0680012b10: fd fd fd fd fa fa fd fd fd fa fa fa fd fd fd fd
  0x0c0680012b20: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==529==ABORTING
```

</details>
shell/browser/osr/osr_render_widget_host_view.cc
void OffScreenRenderWidgetHostView::RenderProcessGone() {
  Destroy();
}
void OffScreenRenderWidgetHostView::Destroy() {
  if (!is_destroyed_) {
    is_destroyed_ = true;
    if (parent_host_view_ != nullptr) {
      CancelWidget();
    } else {
      if (popup_host_view_)
        popup_host_view_->CancelWidget();
      if (child_host_view_)
        child_host_view_->CancelWidget();
      if (!guest_host_views_.empty()) {
        
        
        
        for (auto* guest_host_view : guest_host_views_)
          guest_host_view->parent_host_view_ = nullptr;
        guest_host_views_.clear();
      }
      for (auto* proxy_view : proxy_views_)
        proxy_view->RemoveObserver();
      Hide();
    }
  }
  delete this;
}
void OffScreenRenderWidgetHostView::SetTooltipText(const base::string16&) {}