https://chromium-review.googlesource.com/c/chromium/src/+/1272556 seems suspicious?

CC today's sheriff Henrik

https://chromium-review.googlesource.com/c/chromium/src/+/1297405

As the stacktrace says Shell's destructor's memory leak, this CL seems the culprit?

Use-after-free:

==16842==ERROR: AddressSanitizer: heap-use-after-free on address 0x61600000c258 at pc 0x000009e7f79c bp 0x7fff15204950 sp 0x7fff15204948
READ of size 8 at 0x61600000c258 thread T0
    #0 0x9e7f79b in begin buildtools/third_party/libc++/trunk/include/vector:1506:30
    #1 0x9e7f79b in base::ObserverList<ash::TabletModeObserver, false, true, base::internal::UncheckedObserverAdapter>::RemoveObserver(ash::TabletModeObserver const*) base/observer_list.h:282
    #2 0x9e0a9e6 in RemoveAll base/scoped_observer.h:45:20
    #3 0x9e0a9e6 in ScopedObserver<ash::TabletModeController, ash::TabletModeObserver>::~ScopedObserver() base/scoped_observer.h:26
    #4 0x9e0b842 in ~WallpaperView ash/wallpaper/wallpaper_view.cc:150:1
    #5 0x9e0b842 in ash::WallpaperView::~WallpaperView() ash/wallpaper/wallpaper_view.cc:148
    #6 0xc1e0bb6 in views::View::~View() ui/views/view.cc:162:9
    #7 0x9e0e49d in ash::(anonymous namespace)::LayerControlView::~LayerControlView() ash/wallpaper/wallpaper_view.cc:43:7
    #8 0xc1e5950 in operator() buildtools/third_party/libc++/trunk/include/memory:2325:5
    #9 0xc1e5950 in reset buildtools/third_party/libc++/trunk/include/memory:2638
    #10 0xc1e5950 in ~unique_ptr buildtools/third_party/libc++/trunk/include/memory:2592
    #11 0xc1e5950 in views::View::DoRemoveChildView(views::View*, bool, bool, bool, views::View*) ui/views/view.cc:2053
    #12 0xc1e7568 in views::View::RemoveAllChildViews(bool) ui/views/view.cc:300:5
    #13 0xc2138e5 in views::internal::RootView::~RootView() ui/views/widget/root_view.cc:183:5
    #14 0xc213a9d in views::internal::RootView::~RootView() ui/views/widget/root_view.cc:179:23
    #15 0xc21d7fb in operator() buildtools/third_party/libc++/trunk/include/memory:2325:5
    #16 0xc21d7fb in reset buildtools/third_party/libc++/trunk/include/memory:2638
    #17 0xc21d7fb in DestroyRootView ui/views/widget/widget.cc:1456
    #18 0xc21d7fb in views::Widget::~Widget() ui/views/widget/widget.cc:187
    #19 0xc21e83d in views::Widget::~Widget() ui/views/widget/widget.cc:186:19
    #20 0xc273f12 in views::NativeWidgetAura::~NativeWidgetAura() ui/views/widget/native_widget_aura.cc
    #21 0xc2741ad in views::NativeWidgetAura::~NativeWidgetAura() ui/views/widget/native_widget_aura.cc:1034:39
    #22 0xbf738e5 in aura::Window::~Window() ui/aura/window.cc:139:16
    #23 0xbf753cd in aura::Window::~Window() ui/aura/window.cc:94:19
    #24 0x9c0b3a0 in ash::RootWindowController::CloseChildWindows() ash/root_window_controller.cc:501:7
    #25 0x9c68bb0 in ash::Shell::CloseAllRootWindowChildWindows() ash/shell.cc:1378:19
    #26 0x9c62d5c in ash::Shell::~Shell() ash/shell.cc:827:3
    #27 0x9c6928d in ash::Shell::~Shell() ash/shell.cc:716:17
    #28 0x10aab6b2 in ash::AshTestHelper::TearDown() ash/test/ash_test_helper.cc:335:3
    #29 0x10aa89dc in ash::AshTestBase::TearDown() ash/test/ash_test_base.cc:188:21
    #30 0x6a2dee4 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2698:11
    #31 0x6a2f386 in testing::TestCase::Run() third_party/googletest/src/googletest/src/gtest.cc:2816:28
    #32 0x6a56ef6 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:5182:43
    #33 0x6a56275 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> third_party/googletest/src/googletest/src/gtest.cc
    #34 0x6a56275 in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc:4791
    #35 0xa79916a in RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2333:46
    #36 0xa79916a in base::TestSuite::Run() base/test/test_suite.cc:294
    #37 0xa79ef07 in Run base/callback.h:99:12
    #38 0xa79ef07 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, bool, base::OnceCallback<void ()>) base/test/launcher/unit_test_launcher.cc:225
    #39 0xa79e9b0 in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>) base/test/launcher/unit_test_launcher.cc:575:10
    #40 0xaea107 in main ash/test/ash_unittests.cc:37:10
    #41 0x7fe8cc076f44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)

0x61600000c258 is located 472 bytes inside of 592-byte region [0x61600000c080,0x61600000c2d0)
freed by thread T0 here:
    #0 0xaaab02 in operator delete(void*) /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cc:167:3
    #1 0x9c6242b in operator() buildtools/third_party/libc++/trunk/include/memory:2325:5
    #2 0x9c6242b in reset buildtools/third_party/libc++/trunk/include/memory:2638
    #3 0x9c6242b in ash::Shell::~Shell() ash/shell.cc:780
    #4 0x9c6928d in ash::Shell::~Shell() ash/shell.cc:716:17
    #5 0x10aab6b2 in ash::AshTestHelper::TearDown() ash/test/ash_test_helper.cc:335:3
    #6 0x10aa89dc in ash::AshTestBase::TearDown() ash/test/ash_test_base.cc:188:21
    #7 0x6a2dee4 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2698:11
    #8 0x6a2f386 in testing::TestCase::Run() third_party/googletest/src/googletest/src/gtest.cc:2816:28
    #9 0x6a56ef6 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:5182:43
    #10 0x6a56275 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> third_party/googletest/src/googletest/src/gtest.cc
    #11 0x6a56275 in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc:4791
    #12 0xa79916a in RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2333:46
    #13 0xa79916a in base::TestSuite::Run() base/test/test_suite.cc:294
    #14 0xa79ef07 in Run base/callback.h:99:12
    #15 0xa79ef07 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, bool, base::OnceCallback<void ()>) base/test/launcher/unit_test_launcher.cc:225
    #16 0xa79e9b0 in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>) base/test/launcher/unit_test_launcher.cc:575:10
    #17 0xaea107 in main ash/test/ash_unittests.cc:37:10
    #18 0x7fe8cc076f44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)

previously allocated by thread T0 here:
    #0 0xaa9ec2 in operator new(unsigned long) /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cc:106:3
    #1 0x9c533e4 in make_unique<ash::TabletModeController> buildtools/third_party/libc++/trunk/include/memory:3118:28
    #2 0x9c533e4 in ash::Shell::Init(ui::ContextFactory*, ui::ContextFactoryPrivate*, std::__1::unique_ptr<base::Value, std::__1::default_delete<base::Value> >, std::__1::unique_ptr<ws::GpuInterfaceProvider, std::__1::default_delete<ws::GpuInterfaceProvider> >) ash/shell.cc:1020
    #3 0x9c527b3 in ash::Shell::CreateInstance(ash::ShellInitParams) ash/shell.cc:269:14
    #4 0x10aaaf6b in ash::AshTestHelper::CreateShell() ash/test/ash_test_helper.cc:447:3
    #5 0x10aaa52e in ash::AshTestHelper::SetUp(bool, bool) ash/test/ash_test_helper.cc:287:3
    #6 0x10aa852d in ash::AshTestBase::SetUp() ash/test/ash_test_base.cc:157:21
    #7 0xaad476 in ash::ScreenOrientationControllerTest::SetUp() ash/content/display/screen_orientation_controller_unittest.cc:220:16
    #8 0x6a2bde2 in HandleExceptionsInMethodIfSupported<testing::Test, void> third_party/googletest/src/googletest/src/gtest.cc
    #9 0x6a2bde2 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2518
    #10 0x6a2dee4 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2698:11
    #11 0x6a2f386 in testing::TestCase::Run() third_party/googletest/src/googletest/src/gtest.cc:2816:28
    #12 0x6a56ef6 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:5182:43
    #13 0x6a56275 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> third_party/googletest/src/googletest/src/gtest.cc
    #14 0x6a56275 in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc:4791
    #15 0xa79916a in RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2333:46
    #16 0xa79916a in base::TestSuite::Run() base/test/test_suite.cc:294
    #17 0xa79ef07 in Run base/callback.h:99:12
    #18 0xa79ef07 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, bool, base::OnceCallback<void ()>) base/test/launcher/unit_test_launcher.cc:225
    #19 0xa79e9b0 in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>) base/test/launcher/unit_test_launcher.cc:575:10
    #20 0xaea107 in main ash/test/ash_unittests.cc:37:10
    #21 0x7fe8cc076f44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)

https://chromium-review.googlesource.com/c/chromium/src/+/1298507 is the culprit, reverted that.

Oh, it was already reverted: https://chromium-review.googlesource.com/c/chromium/src/+/1301035

Checking if the M71 merge was reverted too.

It hadn't been merged yet. All good now.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e6f134abefe58874b15d44caf07d0e3f3fb39ec9

commit e6f134abefe58874b15d44caf07d0e3f3fb39ec9
Author: Kevin Strohbehn <ginko@google.com>
Date: Mon Oct 29 20:23:24 2018

Reland "Makes wallpaper dim in tablet mode, without relying on app_list_shield"

This is a reland of 0b1076357bef0f7fe024b66e64f6c4ec1cb2c1b9

Includes changes to fix MSAN issues

Bug:  898712 ,  899158 

Original change's description:
> Makes wallpaper dim in tablet mode, without relying on app_list_shield
>
> Bug:  898712 
> Change-Id: I96ba08fec3f7df8547d753ff4d31366345be0ac8
> Reviewed-on: https://chromium-review.googlesource.com/c/1298507
> Reviewed-by: Weidong Guo <weidongg@chromium.org>
> Reviewed-by: Xiyuan Xia <xiyuan@chromium.org>
> Commit-Queue: Kevin Strohbehn <ginko@google.com>
> Cr-Commit-Position: refs/heads/master@{#602938}

Bug:  898712 
Change-Id: Ief534b6dc58b5d36b3f96952141a51312c50a79f
Reviewed-on: https://chromium-review.googlesource.com/c/1303233
Commit-Queue: Kevin Strohbehn <ginko@google.com>
Reviewed-by: Xiyuan Xia <xiyuan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#603605}
[modify] https://crrev.com/e6f134abefe58874b15d44caf07d0e3f3fb39ec9/ash/app_list/app_list_presenter_delegate_unittest.cc
[modify] https://crrev.com/e6f134abefe58874b15d44caf07d0e3f3fb39ec9/ash/app_list/views/app_list_view.cc
[modify] https://crrev.com/e6f134abefe58874b15d44caf07d0e3f3fb39ec9/ash/wallpaper/wallpaper_view.cc
[modify] https://crrev.com/e6f134abefe58874b15d44caf07d0e3f3fb39ec9/ash/wallpaper/wallpaper_view.h
[modify] https://crrev.com/e6f134abefe58874b15d44caf07d0e3f3fb39ec9/ash/wm/overview/window_grid.cc
[modify] https://crrev.com/e6f134abefe58874b15d44caf07d0e3f3fb39ec9/ash/wm/overview/window_grid.h
[modify] https://crrev.com/e6f134abefe58874b15d44caf07d0e3f3fb39ec9/ash/wm/tablet_mode/tablet_mode_controller.cc
[modify] https://crrev.com/e6f134abefe58874b15d44caf07d0e3f3fb39ec9/ash/wm/tablet_mode/tablet_mode_observer.h