In MSAN build 
 10704 and test case MaybeSetMetadata/SafeBrowsingServiceMetadataTest.MalwareImg/0 of viz_browser_tests, after aplpying my CL https://chromium-review.googlesource.com/c/chromium/src/+/1109964

https://ci.chromium.org/p/chromium/builders/luci.chromium.ci/Linux%20MSan%20Tests/10704

MSAN finds an uninitialized variable read in 

    #0 0xf0eb789 in safe_browsing::ThreatDetails::OnReceivedThreatDOMDetails(mojo::InterfacePtr<safe_browsing::mojom::ThreatReporter>, content::RenderFrameHost*, std::__1::vector<mojo::StructPtr<safe_browsing::mojom::ThreatDOMDetailsNode>, std::__1::allocator<mojo::StructPtr<safe_browsing::mojom::ThreatDOMDetailsNode> > >) ./../../components/safe_browsing/browser/threat_details.cc:593:41

From the log [1] it looks like the RenderFrameHost object (which is the sender variable in that function) has gone away due to all tabs being closed:

 Uninitialized value was created by a heap deallocation
    #0 0x2ad3e29 in operator delete(void*) /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/msan/msan_new_delete.cc:75:44
    #1 0xccc81d2 in operator() ./../../buildtools/third_party/libc++/trunk/include/memory:2321:5
    #2 0xccc81d2 in reset ./../../buildtools/third_party/libc++/trunk/include/memory:2634:0
    #3 0xccc81d2 in ~unique_ptr ./../../buildtools/third_party/libc++/trunk/include/memory:2588:0
    #4 0xccc81d2 in content::RenderFrameHostManager::~RenderFrameHostManager() ./../../content/browser/frame_host/render_frame_host_manager.cc:96:0
    #5 0xcafcc26 in content::FrameTreeNode::~FrameTreeNode() ./../../content/browser/frame_host/frame_tree_node.cc:172:1
    #6 0xcaee4fc in content::FrameTree::~FrameTree() ./../../content/browser/frame_host/frame_tree.cc:119:3
    #7 0xdb7a20d in content::WebContentsImpl::~WebContentsImpl() ./../../content/browser/web_contents/web_contents_impl.cc:793:1
    #8 0xdb7d17c in content::WebContentsImpl::~WebContentsImpl() ./../../content/browser/web_contents/web_contents_impl.cc:688:37
    #9 0x20c7cbde in operator() ./../../buildtools/third_party/libc++/trunk/include/memory:2321:5
    #10 0x20c7cbde in reset ./../../buildtools/third_party/libc++/trunk/include/memory:2634:0
    #11 0x20c7cbde in TabStripModel::SendDetachWebContentsNotifications(TabStripModel::DetachNotifications*) ./../../chrome/browser/ui/tabs/tab_strip_model.cc:468:0
    #12 0x20c96d02 in TabStripModel::CloseWebContentses(base::span<content::WebContents* const, 18446744073709551615ul>, unsigned int) ./../../chrome/browser/ui/tabs/tab_strip_model.cc:1383:3
    #13 0x20c84be1 in TabStripModel::InternalCloseTabs(base::span<content::WebContents* const, 18446744073709551615ul>, unsigned int) ./../../chrome/browser/ui/tabs/tab_strip_model.cc:1296:27
    #14 0x20c83a0d in TabStripModel::CloseAllTabs() ./../../chrome/browser/ui/tabs/tab_strip_model.cc:590:3



[1] https://logs.chromium.org/v/?s=chromium%2Fbuildbucket%2Fcr-buildbucket.appspot.com%2F8941906168571925216%2F%2B%2Fsteps%2Fviz_browser_tests%2F0%2Flogs%2FMaybeSetMetadata__x2f_SafeBrowsingServiceMetadataTest.MalwareImg__x2f_0%2F0


I don't think this is a failure that my CL introduced, but rather an existing race condition in this safe browsing test. 

Also, this test is part of a set of tests #ifdef'ed by:
ENABLE_FLAKY_PVER3_TESTS - I am not sure what the history of this #ifdef is.

This issue was the trigger for FindIt to report my CL as the culprit, compare  issue 860349 .