This appears to be in XFA which is not shipped in any version of Chrome.

Possible dupe of  Issue 832603 ?

This specific stack is caused by the same issue as 835636 but, this test case triggers a second low severity probe after 835636 is fixed.

=================================================================
==164141==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000000f00 at pc 0x00000484ef44 bp 0x7fff03041810 sp 0x7fff03041808
READ of size 1 at 0x607000000f00 thread T0
    #0 0x484ef43 in fxcrt::UnownedPtr<CFX_XMLNode>::ProbeForLowSeverityLifetimeIssue() core/fxcrt/unowned_ptr.h:110:7
    #1 0x575fd7b in fxcrt::UnownedPtr<CFX_XMLNode>::~UnownedPtr() core/fxcrt/unowned_ptr.h:60:19
    #2 0x570055d in CXFA_Node::~CXFA_Node() xfa/fxfa/parser/cxfa_node.cpp:540:23
    #3 0x58a628b in CXFA_Packet::~CXFA_Packet() xfa/fxfa/parser/cxfa_packet.cpp:29:30
    #4 0x58a62cf in CXFA_Packet::~CXFA_Packet() xfa/fxfa/parser/cxfa_packet.cpp:29:29
    #5 0x5896533 in operator() buildtools/third_party/libc++/trunk/include/memory:2286:5
    #6 0x5896533 in reset buildtools/third_party/libc++/trunk/include/memory:2599
    #7 0x5896533 in ~unique_ptr buildtools/third_party/libc++/trunk/include/memory:2553
    #8 0x5896533 in __destroy<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> > > buildtools/third_party/libc++/trunk/include/memory:1732
    #9 0x5896533 in destroy<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> > > buildtools/third_party/libc++/trunk/include/memory:1595
    #10 0x5896533 in std::__1::__tree<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> >, std::__1::less<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> > >, std::__1::allocator<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> > > >::destroy(std::__1::__tree_node<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> >, void*>*) buildtools/third_party/libc++/trunk/include/__tree:1833
    #11 0x58962d3 in std::__1::__tree<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> >, std::__1::less<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> > >, std::__1::allocator<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> > > >::destroy(std::__1::__tree_node<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> >, void*>*) buildtools/third_party/libc++/trunk/include/__tree:1831:9
    #12 0x5896112 in std::__1::__tree<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> >, std::__1::less<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> > >, std::__1::allocator<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> > > >::~__tree() buildtools/third_party/libc++/trunk/include/__tree:1821:3
    #13 0x5895b4b in std::__1::set<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> >, std::__1::less<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> > >, std::__1::allocator<std::__1::unique_ptr<CXFA_Node, std::__1::default_delete<CXFA_Node> > > >::~set() buildtools/third_party/libc++/trunk/include/set:400:28
    #14 0x5894670 in CXFA_NodeOwner::~CXFA_NodeOwner() xfa/fxfa/parser/cxfa_nodeowner.cpp:16:33
    #15 0x55c6363 in CXFA_Document::~CXFA_Document() xfa/fxfa/parser/cxfa_document.cpp:1289:1
    #16 0x55c639f in CXFA_Document::~CXFA_Document() xfa/fxfa/parser/cxfa_document.cpp:1285:33
    #17 0x4ed7790 in operator() buildtools/third_party/libc++/trunk/include/memory:2286:5
    #18 0x4ed7790 in reset buildtools/third_party/libc++/trunk/include/memory:2599
    #19 0x4ed7790 in CXFA_FFDoc::CloseDoc() xfa/fxfa/cxfa_ffdoc.cpp:152
    #20 0x4db4608 in CPDFXFA_Context::CloseXFADoc() fpdfsdk/fpdfxfa/cpdfxfa_context.cpp:67:14
    #21 0x4db3c50 in CPDFXFA_Context::~CPDFXFA_Context() fpdfsdk/fpdfxfa/cpdfxfa_context.cpp:49:3
    #22 0x4db47af in CPDFXFA_Context::~CPDFXFA_Context() fpdfsdk/fpdfxfa/cpdfxfa_context.cpp:45:37
    #23 0x2ebbc9f in FPDF_CloseDocument fpdfsdk/fpdf_view.cpp:743:3
    #24 0x11fc5b7 in FPDFDocumentDeleter::operator()(void*) public/cpp/fpdf_deleters.h:31:47
    #25 0x11ea2fd in reset buildtools/third_party/libc++/trunk/include/memory:2599:7
    #26 0x11ea2fd in ~unique_ptr buildtools/third_party/libc++/trunk/include/memory:2553
    #27 0x11ea2fd in (anonymous namespace)::RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, (anonymous namespace)::Options const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) samples/pdfium_test.cc:756
    #28 0x11db79c in main samples/pdfium_test.cc:911:5
    #29 0x7fd05859e2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

0x607000000f00 is located 0 bytes inside of 80-byte region [0x607000000f00,0x607000000f50)
freed by thread T0 here:
    #0 0x11d5ad2 in operator delete(void*) /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cc:149:3
    #1 0x38af20b in CFX_XMLElement::~CFX_XMLElement() core/fxcrt/xml/cfx_xmlelement.cpp:24:33
    #2 0x38be196 in operator() buildtools/third_party/libc++/trunk/include/memory:2286:5
    #3 0x38be196 in reset buildtools/third_party/libc++/trunk/include/memory:2599
    #4 0x38be196 in ~unique_ptr buildtools/third_party/libc++/trunk/include/memory:2553
    #5 0x38be196 in destroy buildtools/third_party/libc++/trunk/include/memory:1860
    #6 0x38be196 in __destroy<std::__1::unique_ptr<CFX_XMLNode, std::__1::default_delete<CFX_XMLNode> > > buildtools/third_party/libc++/trunk/include/memory:1727
    #7 0x38be196 in destroy<std::__1::unique_ptr<CFX_XMLNode, std::__1::default_delete<CFX_XMLNode> > > buildtools/third_party/libc++/trunk/include/memory:1595
    #8 0x38be196 in __destruct_at_end buildtools/third_party/libc++/trunk/include/vector:413
    #9 0x38be196 in clear buildtools/third_party/libc++/trunk/include/vector:356
    #10 0x38be196 in std::__1::__vector_base<std::__1::unique_ptr<CFX_XMLNode, std::__1::default_delete<CFX_XMLNode> >, std::__1::allocator<std::__1::unique_ptr<CFX_XMLNode, std::__1::default_delete<CFX_XMLNode> > > >::~__vector_base() buildtools/third_party/libc++/trunk/include/vector:441
    #11 0x38bdbfb in std::__1::vector<std::__1::unique_ptr<CFX_XMLNode, std::__1::default_delete<CFX_XMLNode> >, std::__1::allocator<std::__1::unique_ptr<CFX_XMLNode, std::__1::default_delete<CFX_XMLNode> > > >::~vector() buildtools/third_party/libc++/trunk/include/vector:447:28
    #12 0x38bd9a2 in CFX_XMLDocument::~CFX_XMLDocument() core/fxcrt/xml/cfx_xmldocument.cpp:12:35
    #13 0x562e03b in operator() buildtools/third_party/libc++/trunk/include/memory:2286:5
    #14 0x562e03b in reset buildtools/third_party/libc++/trunk/include/memory:2599
    #15 0x562e03b in ~unique_ptr buildtools/third_party/libc++/trunk/include/memory:2553
    #16 0x562e03b in CXFA_DocumentParser::~CXFA_DocumentParser() xfa/fxfa/parser/cxfa_document_parser.cpp:307
    #17 0x4ed92a4 in CXFA_FFDoc::ParseDoc(CPDF_Object*) xfa/fxfa/cxfa_ffdoc.cpp:69:1
    #18 0x4edac24 in CXFA_FFDoc::OpenDoc(CPDF_Document*) xfa/fxfa/cxfa_ffdoc.cpp:107:8
    #19 0x4db5853 in CPDFXFA_Context::LoadXFADoc() fpdfsdk/fpdfxfa/cpdfxfa_context.cpp:94:19
    #20 0x2eb64eb in FPDF_LoadXFA fpdfsdk/fpdf_view.cpp:259:63
    #21 0x11e96b4 in (anonymous namespace)::RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, (anonymous namespace)::Options const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) samples/pdfium_test.cc:709:12
    #22 0x11db79c in main samples/pdfium_test.cc:911:5
    #23 0x7fd05859e2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

previously allocated by thread T0 here:
    #0 0x11d4ef2 in operator new(unsigned long) /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cc:92:3
    #1 0x3892021 in pdfium::internal::MakeUniqueResult<CFX_XMLElement>::Scalar pdfium::MakeUnique<CFX_XMLElement, fxcrt::WideString>(fxcrt::WideString&&) third_party/base/ptr_util.h:56:29
    #2 0x388330a in CFX_XMLElement* CFX_XMLDocument::CreateNode<CFX_XMLElement, fxcrt::WideString>(fxcrt::WideString&&) core/fxcrt/xml/cfx_xmldocument.h:32:22
    #3 0x387367e in CFX_XMLParser::Parse() core/fxcrt/xml/cfx_xmlparser.cpp:125:28
    #4 0x562eb3b in CXFA_DocumentParser::LoadXML(fxcrt::RetainPtr<IFX_SeekableStream> const&) xfa/fxfa/parser/cxfa_document_parser.cpp:333:49
    #5 0x562e1fa in CXFA_DocumentParser::Parse(fxcrt::RetainPtr<IFX_SeekableStream> const&, XFA_PacketType) xfa/fxfa/parser/cxfa_document_parser.cpp:311:14
    #6 0x4ed8d36 in CXFA_FFDoc::ParseDoc(CPDF_Object*) xfa/fxfa/cxfa_ffdoc.cpp:63:15
    #7 0x4edac24 in CXFA_FFDoc::OpenDoc(CPDF_Document*) xfa/fxfa/cxfa_ffdoc.cpp:107:8
    #8 0x4db5853 in CPDFXFA_Context::LoadXFADoc() fpdfsdk/fpdfxfa/cpdfxfa_context.cpp:94:19
    #9 0x2eb64eb in FPDF_LoadXFA fpdfsdk/fpdf_view.cpp:259:63
    #10 0x11e96b4 in (anonymous namespace)::RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, (anonymous namespace)::Options const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) samples/pdfium_test.cc:709:12
    #11 0x11db79c in main samples/pdfium_test.cc:911:5
    #12 0x7fd05859e2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free core/fxcrt/unowned_ptr.h:110:7 in fxcrt::UnownedPtr<CFX_XMLNode>::ProbeForLowSeverityLifetimeIssue()
Shadow bytes around the buggy address:
  0x0c0e7fff8190: fd fd fd fd fd fd fa fa fa fa fd fd fd fd fd fd
  0x0c0e7fff81a0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0e7fff81b0: fd fd fa fa fa fa fd fd fd fd fd fd fd fd fd fd
  0x0c0e7fff81c0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fa fa
  0x0c0e7fff81d0: fa fa fd fd fd fd fd fd fd fd fd fd fa fa fa fa
=>0x0c0e7fff81e0:[fd]fd fd fd fd fd fd fd fd fd fa fa fa fa fd fd
  0x0c0e7fff81f0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x0c0e7fff8200: fd fd fd fd fd fd fa fa fa fa 00 00 00 00 00 00
  0x0c0e7fff8210: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c0e7fff8220: 00 fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
  0x0c0e7fff8230: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==164141==ABORTING

https://pdfium-review.googlesource.com/c/pdfium/+/31710/

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/32ea6d0f847dab80e5fc03142ffa2238b552b357

commit 32ea6d0f847dab80e5fc03142ffa2238b552b357
Author: Dan Sinclair <dsinclair@chromium.org>
Date: Wed May 02 16:17:32 2018

Cleanup XFA document properly on failed load

When we fail to parse an XFA document we would free the XML document
that is created immediately. This causes issues because the XML nodes
may have been set into the CXFA_Document already. This CL changes
ParseDoc to always save the XMLDocument and then triggers the CloseDoc()
logic if the ParseDoc method fails.

This should properly cleanup any resources on a failed document load.

Bug:  chromium:837578 
Change-Id: I8af7e6e34e3b756455c58ea50b22af414ffa6cbf
Reviewed-on: https://pdfium-review.googlesource.com/31710
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>

[modify] https://crrev.com/32ea6d0f847dab80e5fc03142ffa2238b552b357/xfa/fxfa/cxfa_ffdoc.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/84f012e4b99bf22f19d2ad6937d8b14b2c01d6ec

commit 84f012e4b99bf22f19d2ad6937d8b14b2c01d6ec
Author: pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Wed May 02 21:12:03 2018

Roll src/third_party/pdfium/ d3b0f7cc7..303f9a3af (7 commits)

https://pdfium.googlesource.com/pdfium.git/+log/d3b0f7cc78e6..303f9a3afc4a

$ git log d3b0f7cc7..303f9a3af --date=short --no-merges --format='%ad %ae %s'
2018-05-02 dsinclair [xml] Simplify the CFX_XMLParser parse methods
2018-05-02 dsinclair [xml] Rename CFX_XMLParser::ParseTextChar
2018-05-02 hnakashima CFWL_MonthCalendar::GetTodayText() includes "Today" string.
2018-05-02 hnakashima Pass DPI as CFX_Size in XFA_DrawImage.
2018-05-02 dsinclair Cleanup XFA document properly on failed load
2018-05-02 dsinclair Add a CFX_XMLDocument class.
2018-05-02 hnakashima Remove out params from CalculateAccWidthAndHeight. Return CFX_Size.

Created with:
  roll-dep src/third_party/pdfium
BUG= chromium:837578 


The AutoRoll server is located here: https://pdfium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


TBR=dsinclair@chromium.org

Change-Id: Ia4cf7f68b647c08a999794d10f270247e6e803fa
Reviewed-on: https://chromium-review.googlesource.com/1040358
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#555532}
[modify] https://crrev.com/84f012e4b99bf22f19d2ad6937d8b14b2c01d6ec/DEPS

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Hi christian.jalio@, ProbeForLowSeverityLifetimeIssue alerts that there is a potential object lifecycle issue, but not that it can actually be reached. We'd consider rewarding if it could be demonstrated to be exploitable, but I'm afraid the panel declined to reward.