BraveNewTabUIBrowserTest.BraveNewTabIsDefault crashes when ASAN is enabled

[jumde]

$ npm run build -- --is_asan
$ npm run test -- brave_browser_tests  --filter=BraveNewTabUIBrowserTest.BraveNewTabIsDefault
=================================================================
==79571==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffee5168e40 at pc 0x00016e0dd364 bp 0x7ffee5168df0 sp 0x7ffee51685b0
READ of size 38 at 0x7ffee5168e40 thread T0
    #0 0x16e0dd363  (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x14363)
    #1 0x10f1f21c3 in ntp_widget_utils::GetCryptoRandomString(bool) ntp_widget_utils_oauth.cc:25
    #2 0x10f2107c7 in GeminiService::GetOAuthClientUrl() gemini_service.cc:152
    #3 0x10f18cf0d in extensions::api::GeminiGetClientUrlFunction::Run() gemini_api.cc:40
    #4 0x10c51f9f7 in ExtensionFunction::RunWithValidation() extension_function.cc:442
    #5 0x10c529cb2 in extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal(ExtensionHostMsg_Request_Params const&, content::RenderFrameHost*, int, base::RepeatingCallback<void (ExtensionFunction::ResponseType, base::ListValue const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char> > const&)> const&) extension_function_dispatcher.cc:345
    #6 0x10c528600 in extensions::ExtensionFunctionDispatcher::Dispatch(ExtensionHostMsg_Request_Params const&, content::RenderFrameHost*, int) extension_function_dispatcher.cc:257
    #7 0x10c5de306 in extensions::ExtensionWebContentsObserver::OnRequest(content::RenderFrameHost*, ExtensionHostMsg_Request_Params const&) extension_web_contents_observer.cc:311
    #8 0x10c5ddf30 in bool IPC::MessageT<ExtensionHostMsg_Request_Meta, std::__Cr::tuple<ExtensionHostMsg_Request_Params>, void>::Dispatch<extensions::ExtensionWebContentsObserver, extensions::ExtensionWebContentsObserver, content::RenderFrameHost, void (extensions::ExtensionWebContentsObserver::*)(content::RenderFrameHost*, ExtensionHostMsg_Request_Params const&)>(IPC::Message const*, extensions::ExtensionWebContentsObserver*, extensions::ExtensionWebContentsObserver*, content::RenderFrameHost*, void (extensions::ExtensionWebContentsObserver::*)(content::RenderFrameHost*, ExtensionHostMsg_Request_Params const&)) ipc_message_templates.h:140
    #9 0x10c5ddceb in extensions::ExtensionWebContentsObserver::OnMessageReceived(IPC::Message const&, content::RenderFrameHost*) extension_web_contents_observer.cc:235
    #10 0x1168225dc in extensions::ChromeExtensionWebContentsObserver::OnMessageReceived(IPC::Message const&, content::RenderFrameHost*) chrome_extension_web_contents_observer.cc:94
    #11 0x12e035afe in content::WebContentsImpl::OnMessageReceived(content::RenderFrameHostImpl*, IPC::Message const&) web_contents_impl.cc:1113
    #12 0x12d008350 in content::RenderFrameHostImpl::OnMessageReceived(IPC::Message const&) render_frame_host_impl.cc:1764
    #13 0x12d99c991 in content::RenderProcessHostImpl::OnMessageReceived(IPC::Message const&) render_process_host_impl.cc:3701
    #14 0x1337a69d3 in IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&) ipc_channel_proxy.cc:327
    #15 0x1337ae246 in base::internal::Invoker<base::internal::BindState<void (IPC::ChannelProxy::Context::*)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context>, IPC::Message>, void ()>::RunOnce(base::internal::BindStateBase*) bind_internal.h:679
    #16 0x1249a7be7 in base::TaskAnnotator::RunTask(char const*, base::PendingTask*) task_annotator.cc:142
    #17 0x124a068f3 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::sequence_manager::LazyNow*) thread_controller_with_message_pump_impl.cc:332
    #18 0x124a06037 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() thread_controller_with_message_pump_impl.cc:252
    #19 0x124b7d6ea in base::MessagePumpCFRunLoopBase::RunWork() message_pump_mac.mm:358
    #20 0x124b57cf9 in base::mac::CallWithEHFrame(void () block_pointer)+0x9 (libbase.dylib:x86_64+0x407cf9)
    #21 0x124b7bee5 in base::MessagePumpCFRunLoopBase::RunWorkSource(void*) message_pump_mac.mm:334
    #22 0x7fff37da9d51 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__+0x10 (CoreFoundation:x86_64h+0x83d51)
    #23 0x7fff37da9cf0 in __CFRunLoopDoSource0+0x66 (CoreFoundation:x86_64h+0x83cf0)
    #24 0x7fff37da9b0a in __CFRunLoopDoSources0+0xd0 (CoreFoundation:x86_64h+0x83b0a)
    #25 0x7fff37da8839 in __CFRunLoopRun+0x39e (CoreFoundation:x86_64h+0x82839)
    #26 0x7fff37da7e3d in CFRunLoopRunSpecific+0x1cd (CoreFoundation:x86_64h+0x81e3d)
    #27 0x7fff369d4abc in RunCurrentEventLoopInMode+0x123 (HIToolbox:x86_64+0x2fabc)
    #28 0x7fff369d47d4 in ReceiveNextEventCommon+0x247 (HIToolbox:x86_64+0x2f7d4)
    #29 0x7fff369d4578 in _BlockUntilNextEventMatchingListInModeWithFilter+0x3f (HIToolbox:x86_64+0x2f578)
    #30 0x7fff3501a038 in _DPSNextEvent+0x372 (AppKit:x86_64+0x41038)
    #31 0x7fff3501887f in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]+0x547 (AppKit:x86_64+0x3f87f)
    #32 0x1136605f2 in __71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke chrome_browser_application_mac.mm:227
    #33 0x124b57cf9 in base::mac::CallWithEHFrame(void () block_pointer)+0x9 (libbase.dylib:x86_64+0x407cf9)
    #34 0x11366019d in -[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:] chrome_browser_application_mac.mm:226
    #35 0x7fff3500a58d in -[NSApplication run]+0x291 (AppKit:x86_64+0x3158d)
    #36 0x124b807da in base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) message_pump_mac.mm:691
    #37 0x124b7ac09 in base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) message_pump_mac.mm:149
    #38 0x124a08082 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) thread_controller_with_message_pump_impl.cc:446
    #39 0x12491d0a0 in base::RunLoop::Run() run_loop.cc:124
    #40 0x112059c41 in content::DOMMessageQueue::WaitForMessage(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char> >*) browser_test_utils.cc:2466
    #41 0x11204b379 in content::(anonymous namespace)::ExecuteScriptHelper(content::RenderFrameHost*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char> > const&, bool, int, std::__Cr::unique_ptr<base::Value, std::__Cr::default_delete<base::Value> >*) browser_test_utils.cc:185
    #42 0x11204bd5d in content::ExecuteScriptAndExtractBool(content::ToRenderFrameHost const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char> > const&, bool*) browser_test_utils.cc:1283
    #43 0x10ac91a96 in BraveNewTabUIBrowserTest_BraveNewTabIsDefault_Test::RunTestOnMainThread() brave_new_tab_ui_browsertest.cc:82
    #44 0x112031919 in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop() browser_test_base.cc:707
    #45 0x112523a0d in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome_browser_main.cc:1657
    #46 0x112520be8 in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome_browser_main.cc:1032
    #47 0x12c85cc08 in content::BrowserMainLoop::PreMainMessageLoopRun() browser_main_loop.cc:985
    #48 0x12df3d48b in content::StartupTaskRunner::RunAllTasksNow() startup_task_runner.cc:41
    #49 0x12c859af9 in content::BrowserMainLoop::CreateStartupTasks() browser_main_loop.cc:895
    #50 0x12c862ca2 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) browser_main_runner_impl.cc:130
    #51 0x12c854496 in content::BrowserMain(content::MainFunctionParams const&) browser_main.cc:43
    #52 0x12f49641c in content::ContentMainRunnerImpl::RunServiceManager(content::MainFunctionParams&, bool) content_main_runner_impl.cc:997
    #53 0x12f4953c7 in content::ContentMainRunnerImpl::Run(bool) content_main_runner_impl.cc:881
    #54 0x151a7b794 in service_manager::Main(service_manager::MainParams const&) main.cc:453
    #55 0x12f492fac in content::ContentMain(content::ContentMainParams const&) content_main.cc:19
    #56 0x11202fe23 in content::BrowserTestBase::SetUp() browser_test_base.cc:544
    #57 0x11201358b in InProcessBrowserTest::SetUp() in_process_browser_test.cc:331
    #58 0x10b061707 in testing::Test::Run() gtest.cc:2684
    #59 0x10b0651f3 in testing::TestInfo::Run() gtest.cc:2866
    #60 0x10b06796e in testing::TestSuite::Run() gtest.cc:3020
    #61 0x10b0a498e in testing::internal::UnitTestImpl::RunAllTests() gtest.cc:5730
    #62 0x10b0a35a8 in testing::UnitTest::Run() gtest.cc:5313
    #63 0x1121d4a4e in base::TestSuite::Run() test_suite.cc:480
    #64 0x11217d437 in ChromeTestSuiteRunner::RunTestSuite(int, char**) chrome_test_launcher.cc:86
    #65 0x1120d9200 in content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) test_launcher.cc:372
    #66 0x11217de5e in LaunchChromeTests(unsigned long, content::TestLauncherDelegate*, int, char**) chrome_test_launcher.cc:245
    #67 0x110eb60d8 in main browser_tests_main.cc:36
    #68 0x7fff71e3ecc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)

Address 0x7ffee5168e40 is located in stack of thread T0 at offset 64 in frame
    #0 0x10f1f20bf in ntp_widget_utils::GetCryptoRandomString(bool) ntp_widget_utils_oauth.cc:17

  This frame has 2 object(s):
    [32, 64) 'random_seed_bytes'
    [96, 112) 'ref.tmp' <== Memory access at offset 64 partially underflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (libclang_rt.asan_osx_dynamic.dylib:x86_64+0x14363)
Shadow bytes around the buggy address:
  0x1fffdca2d170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1fffdca2d180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1fffdca2d190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1fffdca2d1a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1fffdca2d1b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x1fffdca2d1c0: f1 f1 f1 f1 00 00 00 00[f2]f2 f2 f2 00 00 f3 f3
  0x1fffdca2d1d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1fffdca2d1e0: f1 f1 f1 f1 00 00 00 00 f2 f2 f2 f2 00 00 00 00
  0x1fffdca2d1f0: f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00
  0x1fffdca2d200: f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00
  0x1fffdca2d210: f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

[jumde]

likely dupe of #11895

[jumde]

dupe of #11902