After https://chromium-review.googlesource.com/c/chromium/src/+/653723 landed the following failure happened. In particular note the read-after-free in network_state.h:

https://chromium-swarm.appspot.com/task?id=38911930030b2610&refresh=10&show_raw=1

[ RUN      ] AutoConnectHandlerTest.ReconnectOnCertLoading
=================================================================
==3236==ERROR: AddressSanitizer: heap-use-after-free on address 0x6180000184da at pc 0x0000036d4c90 bp 0x7ffca39cdda0 sp 0x7ffca39cdd98
READ of size 1 at 0x6180000184da thread T0
    #0 0x36d4c8f in visible chromeos/network/network_state.h:56:33
    #1 0x36d4c8f in chromeos::NetworkState::IsConnectingState() const chromeos/network/network_state.cc:386
    #2 0x362772e in chromeos::AutoConnectHandler::DisconnectFromUnmanagedSharedWiFiNetworks() chromeos/network/auto_connect_handler.cc:256:20
    #3 0x3625307 in chromeos::AutoConnectHandler::DisconnectIfPolicyRequires() chromeos/network/auto_connect_handler.cc:246:5
    #4 0x3659abb in chromeos::ManagedNetworkConfigurationHandlerImpl::SetPolicy(onc::ONCSource, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::ListValue const&, base::DictionaryValue const&) chromeos/network/managed_network_configuration_handler_impl.cc:534:14
    #5 0x97922b in chromeos::AutoConnectHandlerTest::SetupPolicy(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::DictionaryValue const&, bool) chromeos/network/auto_connect_handler_unittest.cc:235:32
    #6 0x976718 in chromeos::AutoConnectHandlerTest_ReconnectOnCertLoading_Test::TestBody() chromeos/network/auto_connect_handler_unittest.cc:319:3
    #7 0xe6e4dc in HandleExceptionsInMethodIfSupported<testing::Test, void> third_party/googletest/src/googletest/src/gtest.cc:2456:12
    #8 0xe6e4dc in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2472
    #9 0xe70124 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2654:11
    #10 0xe71486 in testing::TestCase::Run() third_party/googletest/src/googletest/src/gtest.cc:2772:28
    #11 0xe86f46 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:4677:43
    #12 0xe864c8 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> third_party/googletest/src/googletest/src/gtest.cc:2456:12
    #13 0xe864c8 in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc:4285
    #14 0x2ae52d5 in RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2237:46
    #15 0x2ae52d5 in base::TestSuite::Run() base/test/test_suite.cc:270
    #16 0x2ae9c60 in Run base/callback.h:92:12
    #17 0x2ae9c60 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::RepeatingCallback<int ()> const&, unsigned long, int, bool, base::RepeatingCallback<void ()> const&) base/test/launcher/unit_test_launcher.cc:216
    #18 0x2ae9869 in base::LaunchUnitTests(int, char**, base::RepeatingCallback<int ()> const&) base/test/launcher/unit_test_launcher.cc:475:10
    #19 0x2adeaef in main base/test/run_all_unittests.cc:12:10
    #20 0x7fde2ec8bf44 in __libc_start_main /build/eglibc-SvCtMH/eglibc-2.19/csu/libc-start.c:287

0x6180000184da is located 90 bytes inside of 896-byte region [0x618000018480,0x618000018800)
freed by thread T0 here:
    #0 0x550942 in operator delete(void*) (/b/s/w/ir/out/Release/chromeos_unittests+0x550942)
    #1 0x36f916c in operator() buildtools/third_party/libc++/trunk/include/memory:2272:5
    #2 0x36f916c in reset buildtools/third_party/libc++/trunk/include/memory:2585
    #3 0x36f916c in ~unique_ptr buildtools/third_party/libc++/trunk/include/memory:2539
    #4 0x36f916c in ~pair buildtools/third_party/libc++/trunk/include/utility:312
    #5 0x36f916c in __destroy<std::__1::pair<const std::__1::basic_string<char>, std::__1::unique_ptr<chromeos::ManagedState, std::__1::default_delete<chromeos::ManagedState> > > > buildtools/third_party/libc++/trunk/include/memory:1726
    #6 0x36f916c in destroy<std::__1::pair<const std::__1::basic_string<char>, std::__1::unique_ptr<chromeos::ManagedState, std::__1::default_delete<chromeos::ManagedState> > > > buildtools/third_party/libc++/trunk/include/memory:1589
    #7 0x36f916c in std::__1::__tree<std::__1::__value_type<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::unique_ptr<chromeos::ManagedState, std::__1::default_delete<chromeos::ManagedState> > >, std::__1::__map_value_compare<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::__value_type<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::unique_ptr<chromeos::ManagedState, std::__1::default_delete<chromeos::ManagedState> > >, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, true>, std::__1::allocator<std::__1::__value_type<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::unique_ptr<chromeos::ManagedState, std::__1::default_delete<chromeos::ManagedState> > > > >::destroy(std::__1::__tree_node<std::__1::__value_type<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::unique_ptr<chromeos::ManagedState, std::__1::default_delete<chromeos::ManagedState> > >, void*>*) buildtools/third_party/libc++/trunk/include/__tree:1831
    #8 0x36f029f in ~__tree buildtools/third_party/libc++/trunk/include/__tree:1819:3
    #9 0x36f029f in ~map buildtools/third_party/libc++/trunk/include/__tree:1488
    #10 0x36f029f in chromeos::NetworkStateHandler::UpdateManagedList(chromeos::ManagedState::ManagedType, base::ListValue const&) chromeos/network/network_state_handler.cc:1064
    #11 0x376cb18 in chromeos::internal::ShillPropertyHandler::ManagerPropertyChanged(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::Value const&) chromeos/network/shill_property_handler.cc:325:18
    #12 0x376c4f1 in chromeos::internal::ShillPropertyHandler::OnPropertyChanged(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::Value const&) chromeos/network/shill_property_handler.cc:276:3
    #13 0x385364f in chromeos::FakeShillManagerClient::NotifyObserversPropertyChanged(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) chromeos/dbus/fake_shill_manager_client.cc:969:16
    #14 0x385ab48 in Invoke<const base::WeakPtr<chromeos::FakeShillManagerClient> &, const std::__1::basic_string<char> &> base/bind_internal.h:194:12
    #15 0x385ab48 in MakeItSo<void (chromeos::FakeShillManagerClient::*const &)(const std::__1::basic_string<char> &), const base::WeakPtr<chromeos::FakeShillManagerClient> &, const std::__1::basic_string<char> &> base/bind_internal.h:297
    #16 0x385ab48 in RunImpl<void (chromeos::FakeShillManagerClient::*const &)(const std::__1::basic_string<char> &), const std::__1::tuple<base::WeakPtr<chromeos::FakeShillManagerClient>, std::__1::basic_string<char> > &, 0, 1> base/bind_internal.h:349
    #17 0x385ab48 in base::internal::Invoker<base::internal::BindState<void (chromeos::FakeShillManagerClient::*)(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&), base::WeakPtr<chromeos::FakeShillManagerClient>, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:331
    #18 0x3addab1 in Run base/callback.h:64:12
    #19 0x3addab1 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:61
    #20 0x3af3b01 in base::internal::IncomingTaskQueue::RunTask(base::PendingTask*) base/message_loop/incoming_task_queue.cc:145:19
    #21 0x3996e9b in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:406:25
    #22 0x3998b53 in DeferOrRunPendingTask base/message_loop/message_loop.cc:417:5
    #23 0x3998b53 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:524
    #24 0x39a2c10 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_libevent.cc:220:31
    #25 0x3995e38 in base::MessageLoop::Run() base/message_loop/message_loop.cc:346:10
    #26 0x39ea2d0 in base::RunLoop::Run() base/run_loop.cc:123:14
    #27 0x39eb4be in base::RunLoop::RunUntilIdle() base/run_loop.cc:137:3
    #28 0x2adccd9 in chromeos::NetworkStateTest::SetServiceProperty(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::Value const&) chromeos/network/network_state_test.cc:111:19
    #29 0x98f9d4 in chromeos::AutoConnectHandlerTest::SetDisconnected(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) chromeos/network/auto_connect_handler_unittest.cc:169:5
    #30 0x98fcb6 in Run base/callback.h:92:12
    #31 0x98fcb6 in chromeos::(anonymous namespace)::TestNetworkConnectionHandler::DisconnectNetwork(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::RepeatingCallback<void ()> const&, base::RepeatingCallback<void (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::unique_ptr<base::DictionaryValue, std::__1::default_delete<base::DictionaryValue> >)> const&) chromeos/network/auto_connect_handler_unittest.cc:71
    #32 0x3627b3b in chromeos::AutoConnectHandler::DisconnectFromUnmanagedSharedWiFiNetworks() chromeos/network/auto_connect_handler.cc:270:34
    #33 0x3625307 in chromeos::AutoConnectHandler::DisconnectIfPolicyRequires() chromeos/network/auto_connect_handler.cc:246:5
    #34 0x3659abb in chromeos::ManagedNetworkConfigurationHandlerImpl::SetPolicy(onc::ONCSource, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::ListValue const&, base::DictionaryValue const&) chromeos/network/managed_network_configuration_handler_impl.cc:534:14
    #35 0x97922b in chromeos::AutoConnectHandlerTest::SetupPolicy(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::DictionaryValue const&, bool) chromeos/network/auto_connect_handler_unittest.cc:235:32
    #36 0x976718 in chromeos::AutoConnectHandlerTest_ReconnectOnCertLoading_Test::TestBody() chromeos/network/auto_connect_handler_unittest.cc:319:3
    #37 0xe6e4dc in HandleExceptionsInMethodIfSupported<testing::Test, void> third_party/googletest/src/googletest/src/gtest.cc:2456:12
    #38 0xe6e4dc in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2472
    #39 0xe70124 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2654:11
    #40 0xe71486 in testing::TestCase::Run() third_party/googletest/src/googletest/src/gtest.cc:2772:28
    #41 0xe86f46 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:4677:43
    #42 0xe864c8 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> third_party/googletest/src/googletest/src/gtest.cc:2456:12
    #43 0xe864c8 in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc:4285
    #44 0x2ae52d5 in RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2237:46
    #45 0x2ae52d5 in base::TestSuite::Run() base/test/test_suite.cc:270
    #46 0x2ae9c60 in Run base/callback.h:92:12
    #47 0x2ae9c60 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::RepeatingCallback<int ()> const&, unsigned long, int, bool, base::RepeatingCallback<void ()> const&) base/test/launcher/unit_test_launcher.cc:216

previously allocated by thread T0 here:
    #0 0x54fd22 in operator new(unsigned long) (/b/s/w/ir/out/Release/chromeos_unittests+0x54fd22)
    #1 0x36d5fa4 in make_unique<chromeos::NetworkState, char const (&)[10]> buildtools/third_party/libc++/trunk/include/memory:3065:28
    #2 0x36d5fa4 in _ZN4base10MakeUniqueIN8chromeos12NetworkStateEJRA10_KcEEEDTclsr3stdE11make_uniqueIT_Espclsr3stdE7forwardIT0_Efp_EEEDpOS7_ base/memory/ptr_util.h:25
    #3 0x36d5c53 in chromeos::NetworkState::CreateDefaultCellular(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) chromeos/network/network_state.cc:495:20
    #4 0x36f77a0 in chromeos::NetworkStateHandler::EnsureCellularNetwork(std::__1::vector<std::__1::unique_ptr<chromeos::ManagedState, std::__1::default_delete<chromeos::ManagedState> >, std::__1::allocator<std::__1::unique_ptr<chromeos::ManagedState, std::__1::default_delete<chromeos::ManagedState> > > >*) chromeos/network/network_state_handler.cc:1474:9
    #5 0x36e0d66 in chromeos::NetworkStateHandler::SortNetworkList() chromeos/network/network_state_handler.cc:1333:3
    #6 0x36f69f3 in chromeos::NetworkStateHandler::ManagedStateListChanged(chromeos::ManagedState::ManagedType) chromeos/network/network_state_handler.cc:1278:5
    #7 0x376c243 in chromeos::internal::ShillPropertyHandler::GetPropertiesCallback(chromeos::ManagedState::ManagedType, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, chromeos::DBusMethodCallStatus, base::DictionaryValue const&) chromeos/network/shill_property_handler.cc:503:16
    #8 0x377313f in Invoke<const base::WeakPtr<chromeos::internal::ShillPropertyHandler> &, const chromeos::ManagedState::ManagedType &, const std::__1::basic_string<char> &, chromeos::DBusMethodCallStatus, const base::DictionaryValue &> base/bind_internal.h:194:12
    #9 0x377313f in MakeItSo<void (chromeos::internal::ShillPropertyHandler::*const &)(chromeos::ManagedState::ManagedType, const std::__1::basic_string<char> &, chromeos::DBusMethodCallStatus, const base::DictionaryValue &), const base::WeakPtr<chromeos::internal::ShillPropertyHandler> &, const chromeos::ManagedState::ManagedType &, const std::__1::basic_string<char> &, chromeos::DBusMethodCallStatus, const base::DictionaryValue &> base/bind_internal.h:297
    #10 0x377313f in RunImpl<void (chromeos::internal::ShillPropertyHandler::*const &)(chromeos::ManagedState::ManagedType, const std::__1::basic_string<char> &, chromeos::DBusMethodCallStatus, const base::DictionaryValue &), const std::__1::tuple<base::WeakPtr<chromeos::internal::ShillPropertyHandler>, chromeos::ManagedState::ManagedType, std::__1::basic_string<char> > &, 0, 1, 2> base/bind_internal.h:349
    #11 0x377313f in base::internal::Invoker<base::internal::BindState<void (chromeos::internal::ShillPropertyHandler::*)(chromeos::ManagedState::ManagedType, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, chromeos::DBusMethodCallStatus, base::DictionaryValue const&), base::WeakPtr<chromeos::internal::ShillPropertyHandler>, chromeos::ManagedState::ManagedType, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, void (chromeos::DBusMethodCallStatus, base::DictionaryValue const&)>::Run(base::internal::BindStateBase*, chromeos::DBusMethodCallStatus&&, base::DictionaryValue const&) base/bind_internal.h:331
    #12 0x3861e5b in Run base/callback.h:92:12
    #13 0x3861e5b in chromeos::(anonymous namespace)::PassStubServiceProperties(base::RepeatingCallback<void (chromeos::DBusMethodCallStatus, base::DictionaryValue const&)> const&, chromeos::DBusMethodCallStatus, base::DictionaryValue const*) chromeos/dbus/fake_shill_service_client.cc:41
    #14 0x3addab1 in Run base/callback.h:64:12
    #15 0x3addab1 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:61
    #16 0x3af3b01 in base::internal::IncomingTaskQueue::RunTask(base::PendingTask*) base/message_loop/incoming_task_queue.cc:145:19
    #17 0x3996e9b in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:406:25
    #18 0x3998b53 in DeferOrRunPendingTask base/message_loop/message_loop.cc:417:5
    #19 0x3998b53 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:524
    #20 0x39a2c10 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_libevent.cc:220:31
    #21 0x3995e38 in base::MessageLoop::Run() base/message_loop/message_loop.cc:346:10
    #22 0x39ea2d0 in base::RunLoop::Run() base/run_loop.cc:123:14
    #23 0x39eb4be in base::RunLoop::RunUntilIdle() base/run_loop.cc:137:3
    #24 0x2adc5b1 in chromeos::NetworkStateTest::ConfigureService(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) chromeos/network/network_state_test.cc:81:19
    #25 0x9756fe in chromeos::AutoConnectHandlerTest_ReconnectOnCertLoading_Test::TestBody() chromeos/network/auto_connect_handler_unittest.cc:300:3
    #26 0xe6e4dc in HandleExceptionsInMethodIfSupported<testing::Test, void> third_party/googletest/src/googletest/src/gtest.cc:2456:12
    #27 0xe6e4dc in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2472
    #28 0xe70124 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2654:11
    #29 0xe71486 in testing::TestCase::Run() third_party/googletest/src/googletest/src/gtest.cc:2772:28
    #30 0xe86f46 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:4677:43
    #31 0xe864c8 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> third_party/googletest/src/googletest/src/gtest.cc:2456:12
    #32 0xe864c8 in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc:4285
    #33 0x2ae52d5 in RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2237:46
    #34 0x2ae52d5 in base::TestSuite::Run() base/test/test_suite.cc:270
    #35 0x2ae9c60 in Run base/callback.h:92:12
    #36 0x2ae9c60 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::RepeatingCallback<int ()> const&, unsigned long, int, bool, base::RepeatingCallback<void ()> const&) base/test/launcher/unit_test_launcher.cc:216
    #37 0x2ae9869 in base::LaunchUnitTests(int, char**, base::RepeatingCallback<int ()> const&) base/test/launcher/unit_test_launcher.cc:475:10
    #38 0x2adeaef in main base/test/run_all_unittests.cc:12:10
    #39 0x7fde2ec8bf44 in __libc_start_main /build/eglibc-SvCtMH/eglibc-2.19/csu/libc-start.c:287

SUMMARY: AddressSanitizer: heap-use-after-free chromeos/network/network_state.h:56:33 in visible
Shadow bytes around the buggy address:
  0x0c307fffb040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fffb050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fffb060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fffb070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fffb080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c307fffb090: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
  0x0c307fffb0a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c307fffb0b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c307fffb0c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c307fffb0d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c307fffb0e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3236==ABORTING
[899/899] AutoConnectHandlerTest.ReconnectOnCertLoading (CRASHED)
1 test crashed:
    AutoConnectHandlerTest.ReconnectOnCertLoading (../../chromeos/network/auto_connect_handler_unittest.cc:298)