CVE-2026-3538

Critical patch-now ~ plausible CVSS 8.8 chrome Integer Overflow 📄 Reporter bug report 🔧 Commit mapped 🧬 A size or count is computed in a type too narrow to hold it

Overview

Critical

Severity

8.8

CVSS

Exploited ITW

Fixed

Fix Status

ImpactInteger overflow in Skia

DescriptionInteger overflow in Skia

ComponentSkia

Sub-componentGanesh

Bug ClassInteger Overflow

Action tierpatch-now — corruption primitive, web-reachable in default config (plausible) — upheld by independent review by AI
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.

Independent review by AIPlausible
Reviewer notes: Diff only adds overflow guards (canAdd, merge check, PreallocCount clamps, chunk-size clamp); it does not show the write path, so 'proceeds to write the full amount, causing heap buffer overflow' and 'likely code execution' are inferred, not demonstrated.
A second, independent AI reviewer (not a human) re-derived this analysis from the fixing commit and the vendor advisory, looking for errors.

Tracker484983991

Fix commit03d405099043 (skia) +39/-2

CWECWE-472, CWE-191 (Integer underflow)

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA KEVNot listed

CreditedSymeon Paraschoudis

Reported2026-02-17 (per vendor advisory)

Fix landed2026-02-20 (public git)

Disclosed2026-03-03

Patch gap11 days — fix public in source before the advisory

Background

Skia/Ganesh: Chrome’s GPU-accelerated 2D rasterization backend, which converts SkPath geometry into GPU vertex buffers via tessellation.
Path tessellation: the process that turns filled/stroked paths into triangle patches; buffer sizes are derived from totalCombinedPathVerbCnt, the summed verb count of all combined paths.
`GrVertexChunkArray` / `GrVertexChunkBuilder`: allocator that grows vertex storage in chunks, doubling fMinVerticesPerChunk and multiplying by fStride to size each allocation.
Verb count: the number of drawing commands (move/line/quad/cubic/close) in an SkPath, stored as a signed int.

Root Cause Analysis

Verify before building a PoC

This analysis is consistent with the fixing commit but not fully provable from it: part of the vulnerable path lives in code the fix commit does not touch. Confirm the trigger and the sink against the source before relying on it for exploit development.
What the commit does not establish: Diff only adds overflow guards (canAdd, merge check, PreallocCount clamps, chunk-size clamp); it does not show the write path, so 'proceeds to write the full amount, causing heap buffer overflow' and 'likely code execution' are inferred, not demonstrated.

Several tessellation code paths accumulate a running int fTotalCombinedPathVerbCnt across many paths (or across merged ops) with no bound on the sum. In AtlasRenderTask, AtlasPathList::add unconditionally did fTotalCombinedPathVerbCnt += path.countVerbs(), and PathTessellateOp::onCombineIfPossible merged two ops by summing their totals, either of which can exceed INT_MAX and wrap to a negative or small value. The PreallocCount helpers in FixedCountBufferUtils.h then compute allocation sizes from that total using multiply-and-add expressions (e.g. count + (count+3)/2, count*5/4, count*2 + 8) that themselves overflow int even for large-but-valid inputs. Finally, GrVertexChunkBuilder doubled fMinVerticesPerChunk and multiplied by fStride without checking that the product fits in int. Any of these overflows produces a bogus (too-small or negative-then-truncated) allocation size while the code proceeds to write the full, real amount of vertex data, causing a heap buffer overflow.

Key insight

Buffer allocation sizes throughout the tessellator are derived from a signed-int accumulated verb count via unchecked arithmetic, so the size used to allocate diverges from the size actually written once the count (or its scaled derivatives) crosses INT_MAX.

Attack Path

Craft heavy geometry A malicious page builds one or more SkPath objects (e.g. via Canvas 2D or WebGL-backed drawing) with an enormous combined verb count.
Feed the tessellator Rendering these paths routes through AtlasRenderTask::addPath / PathTessellateOp, accumulating fTotalCombinedPathVerbCnt toward or past INT_MAX, optionally aided by op merging.
Trigger overflow The accumulated total, or its scaled value inside PreallocCount / GrVertexChunkBuilder, overflows int, yielding an undersized vertex buffer allocation.
Write past the buffer Tessellation emits the true (much larger) volume of vertex data into the undersized GPU/CPU buffer, corrupting adjacent heap memory.
Exploit The controlled heap overflow is leveraged toward memory corruption and potential remote code execution in the GPU process.

Impact Assessment

This is a critical heap buffer overflow reachable from web content that renders complex path geometry through Skia’s Ganesh GPU backend. Because allocation size is computed from attacker-influenced verb counts via overflowing signed arithmetic, an attacker can force writes beyond a too-small buffer, enabling heap corruption and likely code execution in the GPU process. Exploitation requires only that a victim render a malicious page’s drawing commands.

Changed Functions

Function	Change	Notes
`if` src/gpu/ganesh/GrVertexChunkArray.cpp	modified
`AtlasPathList` src/gpu/ganesh/ops/AtlasRenderTask.h	modified
`if` src/gpu/ganesh/ops/PathTessellateOp.cpp	modified

Files Changed

src/gpu/ganesh/GrVertexChunkArray.cpp
src/gpu/ganesh/ops/AtlasRenderTask.cpp
src/gpu/ganesh/ops/AtlasRenderTask.h
src/gpu/ganesh/ops/PathTessellateOp.cpp
src/gpu/tessellate/FixedCountBufferUtils.h

Audit Directions

Accumulated size counters
Audit every int/int32_t running total that grows across items (verb counts, vertex counts, element sums) and later feeds an allocation; require an INT_MAX - total >= addend check before each +=.
Multiply-add allocation math
Flag constexpr/inline size helpers like count*N/M + K used to size buffers; clamp the input so the scaled expression cannot exceed INT_MAX, as done for the PreallocCount variants.
Geometric growth allocators
Review chunked/doubling allocators (*= 2, size * stride) for overflow; ensure the grown value is capped at INT_MAX / stride like GrVertexChunkBuilder.

Patch

view commit

From 03d405099043409a7925e54d7cfad73a9c5ad8db Mon Sep 17 00:00:00 2001
From: Michael Ludwig <michaelludwig@google.com>
Date: Thu, 19 Feb 2026 16:29:16 -0500
Subject: [PATCH] [ganesh] Guard verb counts in tessellation accumulation against overflow

Rejects adding a path if the total verb count would overflow.
Rejects merging ops if their total verb counts would overflow.
Clamps the min allocation size in the GrVertexChunkArray to prevent
overflow.
Clamps the preallocation verb count parameter to avoid overflow in their
intermediate calculations.

Bug: b/484983991
Change-Id: I32359cf10a996baf46b023a6cb8c608834942e0b
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1169977
Commit-Queue: Michael Ludwig <michaelludwig@google.com>
Reviewed-by: Thomas Smith <thomsmit@google.com>
---

diff --git a/src/gpu/ganesh/GrVertexChunkArray.cpp b/src/gpu/ganesh/GrVertexChunkArray.cpp
index 337e394..3d80581 100644
--- a/src/gpu/ganesh/GrVertexChunkArray.cpp
+++ b/src/gpu/ganesh/GrVertexChunkArray.cpp
@@ -10,6 +10,7 @@
 #include "src/gpu/ganesh/GrMeshDrawTarget.h"
 
 #include <algorithm>
+#include <limits>
 
 GrVertexChunkBuilder::~GrVertexChunkBuilder() {
     if (!fChunks->empty()) {
@@ -37,6 +38,12 @@
         fCurrChunkVertexCapacity = 0;
         return false;
     }
-    fMinVerticesPerChunk *= 2;
+
+    int maxVerticesPerChunk = std::numeric_limits<int>::max() / fStride;
+    if (maxVerticesPerChunk / 2 > fMinVerticesPerChunk) {
+        fMinVerticesPerChunk *= 2;
+    } else {
+        fMinVerticesPerChunk = maxVerticesPerChunk;
+    }
     return true;
 }
diff --git a/src/gpu/ganesh/ops/AtlasRenderTask.cpp b/src/gpu/ganesh/ops/AtlasRenderTask.cpp
index 5f05079..13b2ff4 100644
--- a/src/gpu/ganesh/ops/AtlasRenderTask.cpp
+++ b/src/gpu/ganesh/ops/AtlasRenderTask.cpp
@@ -54,6 +54,17 @@
     SkASSERT(this->isEmpty());
     SkASSERT(!fDynamicAtlas->isInstantiated());  // Paths can't be added after instantiate().
 
+    // Check for room in the list first and return false if prior draws need to be flushed first.
+    if (GrFillRuleForSkPath(path) == GrFillRule::kNonzero) {
+        if (!fWindingPathList.canAdd(path)) {
+            return false;
+        }
+    } else {
+        if (!fEvenOddPathList.canAdd(path)) {
+            return false;
+        }
+    }
+
     if (!fDynamicAtlas->addRect(widthInAtlas, heightInAtlas, locationInAtlas)) {
         return false;
     }
diff --git a/src/gpu/ganesh/ops/AtlasRenderTask.h b/src/gpu/ganesh/ops/AtlasRenderTask.h
index c44b426..de056f1 100644
--- a/src/gpu/ganesh/ops/AtlasRenderTask.h
+++ b/src/gpu/ganesh/ops/AtlasRenderTask.h
@@ -22,6 +22,7 @@
 #include "src/gpu/ganesh/ops/OpsTask.h"
 #include "src/gpu/ganesh/tessellate/PathTessellator.h"
 
+#include <limits>
 #include <memory>
 #include <utility>
 
@@ -89,6 +90,7 @@
     class AtlasPathList : SkNoncopyable {
     public:
         void add(PathDrawAllocator* alloc, const SkMatrix& pathMatrix, const SkPath& path) {
+            SkASSERT(this->canAdd(path));
             fPathDrawList = &alloc->emplace_back(pathMatrix, path, SK_PMColor4fTRANSPARENT,
                                                  fPathDrawList);
             if (path.isInverseFillType()) {
@@ -98,6 +100,12 @@
             fTotalCombinedPathVerbCnt += path.countVerbs();
             ++fPathCount;
         }
+
+        bool canAdd(const SkPath& path) const {
+            // Return true so long as we won't overflow the total verb count
+            return std::numeric_limits<int>::max() - fTotalCombinedPathVerbCnt >= path.countVerbs();
+        }
+
         const PathDrawList* pathDrawList() const { return fPathDrawList; }
         int totalCombinedPathVerbCnt() const { return fTotalCombinedPathVerbCnt; }
         int pathCount() const { return fPathCount; }
diff --git a/src/gpu/ganesh/ops/PathTessellateOp.cpp b/src/gpu/ganesh/ops/PathTessellateOp.cpp
index 3bc370f..f879a2e 100644
--- a/src/gpu/ganesh/ops/PathTessellateOp.cpp
+++ b/src/gpu/ganesh/ops/PathTessellateOp.cpp
@@ -5,6 +5,7 @@
  * found in the LICENSE file.
  */
 #include "src/gpu/ganesh/ops/PathTessellateOp.h"
+#include <limits>
 
 #include "include/core/SkColor.h"
 #include "include/gpu/ganesh/GrRecordingContext.h"
@@ -53,10 +54,13 @@
                                                               SkArenaAlloc*,
                                                               const GrCaps&) {
     auto* op = grOp->cast<PathTessellateOp>();
+    bool verbCountOverflow = std::numeric_limits<int>::max() - fTotalCombinedPathVerbCnt <
+            op->fTotalCombinedPathVerbCnt;
     bool canMerge = fAAType == op->fAAType &&
                     fStencil == op->fStencil &&
                     fProcessors == op->fProcessors &&
-                    fShaderMatrix == op->fShaderMatrix;
+                    fShaderMatrix == op->fShaderMatrix &&
+                    !verbCountOverflow;
     if (canMerge) {
         fTotalCombinedPathVerbCnt += op->fTotalCombinedPathVerbCnt;
         fPatchAttribs |= op->fPatchAttribs;
diff --git a/src/gpu/tessellate/FixedCountBufferUtils.h b/src/gpu/tessellate/FixedCountBufferUtils.h
index f2ab0f4..055f6a0 100644
--- a/src/gpu/tessellate/FixedCountBufferUtils.h
+++ b/src/gpu/tessellate/FixedCountBufferUtils.h
@@ -14,6 +14,7 @@
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
+#include <limits>
 
 namespace skgpu { struct VertexWriter; }
 
@@ -44,6 +45,8 @@
         // Over-allocate enough curves for 1 in 4 to chop. Every chop introduces 2 new patches:
         // another curve patch and a triangle patch that glues the two chops together,
         // i.e. + 2 * ((count + 3) / 4) == (count + 3) / 2
+        constexpr int kMaxVerbCount = std::numeric_limits<int>::max() >> 2;
+        totalCombinedPathVerbCnt = std::min(kMaxVerbCount, totalCombinedPathVerbCnt);
         return totalCombinedPathVerbCnt + (totalCombinedPathVerbCnt + 3) / 2;
     }
 
@@ -88,6 +91,8 @@
 
     static constexpr int PreallocCount(int totalCombinedPathVerbCnt)  {
         // Over-allocate enough wedges for 1 in 4 to chop, i.e., ceil(maxWedges * 5/4)
+        constexpr int kMaxVerbCount = std::numeric_limits<int>::max() >> 3;
+        totalCombinedPathVerbCnt = std::min(kMaxVerbCount, totalCombinedPathVerbCnt);
         return (totalCombinedPathVerbCnt * 5 + 3) / 4;
     }
 
@@ -140,6 +145,8 @@
         // Over-allocate enough patches for each stroke to chop once, and for 8 extra caps. Since
         // we have to chop at inflections, points of 180 degree rotation, and anywhere a stroke
         // requires too many parametric segments, many strokes will end up getting choppped.
+        constexpr int kMaxVerbCount = std::numeric_limits<int>::max() >> 2;
+        totalCombinedPathVerbCnt = std::min(kMaxVerbCount, totalCombinedPathVerbCnt);
         return (totalCombinedPathVerbCnt * 2) + 8/* caps */;
     }

Loading diff…

Original Bug Report

reported by si...@gmail.com

Heap-buffer-overflow in Skia PathStencilCoverOp via AtlasPathRenderer integer overflow

Security Bug

Important: Please do not change the component of this bug manually.

VULNERABILITY DETAILS

Component: Skia Ganesh GPU backend — AtlasPathRenderer / PathStencilCoverOp (Canvas 2D fill path)

An integer overflow in AtlasRenderTask::AtlasPathList::add() allows a user to trigger a heap-buffer-overflow write in PathStencilCoverOp::onPrepare() via the HTML Canvas 2D API. The attacker controls the data written past the buffer (path vertex coordinates).

AtlasRenderTask.h:98 accumulates path verb counts with no overflow check:

fTotalCombinedPathVerbCnt += path.countVerbs();  // int32, no overflow check

The atlas only validates path pixel bounds (must fit in 2048x2048), not verb count.

This overflowed count is passed to PathStencilCoverOp (AtlasRenderTask.cpp:120), which uses it to allocate a single contiguous fan triangle buffer (GrEagerDynamicVertexAllocator):

// PathStencilCoverOp.cpp:277-280
int maxTrianglesInFans = std::max(fTotalCombinedPathVerbCnt - 2, 0);
vertexAlloc.lockWriter(sizeof(SkPoint), maxTrianglesInFans * 3);  // undersized!

The fan triangle write loop (PathStencilCoverOp.cpp:281-289) then iterates all actual paths with no runtime bounds checking (VertexWriter::validate() is gated on SK_DEBUG, which is off in official builds):

for (auto [pathMatrix, path, color] : *fPathDrawList) {
    for (tess::PathMiddleOutFanIter it(path); !it.done();) {
        for (auto [p0, p1, p2] : it.nextStack()) {
            triangleVertexWriter << m.map2Points(p0, p1) << m.mapPoint(p2);  // OOB write
        }
    }
}

VERSION Chrome Version: Chrome 147.0.7691.0 ASAN, Windows stable

Operating System: Windows 11 Version 24H2, OS Build 26100.7840

REPRODUCTION CASE

The following flags were used: chrome.exe --disable-gpu-sandbox --enable-gpu-rasterization --disable-features=SkiaGraphite --disable-gpu-watchdog --disable-gpu-driver-bug-workarounds --use-angle=vulkan --user-data-dir="%TEMP%\chrome-test-profile" --no-first-run --no-default-browser-check skia_atlas_overflow_poc.html

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: browser

chrome.exe --disable-gpu-sandbox --enable-gpu-rasterization --disable-features=SkiaGraphite --disable-gpu-watchdog --disable-gpu-driver-bug-workarounds --use-angle=vulkan --user-data-dir="%TEMP%\chrome-test-profile" --no-first-run --no-default-browser-check skia_atlas_overflow_poc.html
=================================================================
==46964==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x11acaa5d1820 at pc 0x7fff153543db bp 0x001237ffd540 sp 0x001237ffd588
WRITE of size 16 at 0x11acaa5d1820 thread T0
    #0 0x7fff153543da in skgpu::BufferWriter::write C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\BufferWriter.h:92
    #1 0x7fff153543da in skgpu::operator<< C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\BufferWriter.h:321
    #2 0x7fff153543da in skgpu::ganesh::PathStencilCoverOp::onPrepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\PathStencilCoverOp.cpp:285:46
    #3 0x7fff15116c04 in GrOp::prepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\GrOp.cpp:59:11
    #4 0x7fff1511e412 in skgpu::ganesh::OpsTask::onPrepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\OpsTask.cpp:548:27
    #5 0x7fff15284653 in GrRenderTask::prepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrRenderTask.cpp:111:11
    #6 0x7fff153ec37a in GrDrawingManager::executeRenderTasks(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:266:21
    #7 0x7fff153ea19a in GrDrawingManager::flush(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:209:34
    #8 0x7fff153ed7cd in GrDrawingManager::flushSurfaces(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:540:27
    #9 0x7fff1540584b in GrDirectContextPriv::flushSurfaces(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContextPriv.cpp:92:47
    #10 0x7fff1541794a in GrDirectContextPriv::flushSurface C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContextPriv.h:106
    #11 0x7fff1541794a in GrDirectContext::flush(class SkSurface *, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContext.cpp:520:25
    #12 0x7fff150c88ed in skgpu::ganesh::Flush(class SkSurface *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\surface\SkSurface_Ganesh.cpp:759:45
    #13 0x7fff1937ff06 in gpu::SharedContextState::FlushWriteAccess(class gpu::SkiaImageRepresentation::ScopedWriteAccess *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\shared_context_state.cc:869:9
    #14 0x7fff19627512 in gpu::raster::RasterDecoderImpl::DoEndRasterCHROMIUM(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder.cc:3099:30
    #15 0x7fff19622078 in gpu::raster::RasterDecoderImpl::HandleEndRasterCHROMIUM(unsigned int, void const volatile *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder_autogen.h:151:3
    #16 0x7fff1962c03d in gpu::raster::RasterDecoderImpl::DoCommandsImpl<0>(unsigned int, void const volatile *, int, int *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder.cc:1526:18
    #17 0x7fff035de36b in gpu::CommandBufferService::Flush(int, class gpu::AsyncAPIInterface *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\command_buffer_service.cc:267:35
    #18 0x7fff196e36e1 in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, class std::__Cr::vector<struct gpu::SyncToken, class std::__Cr::allocator<struct gpu::SyncToken>> const &) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:504:22
    #19 0x7fff196e25f3 in gpu::CommandBufferStub::ExecuteDeferredRequest(class gpu::mojom::DeferredCommandBufferRequestParams &, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:173:7
    #20 0x7fff196af4a1 in gpu::GpuChannel::ExecuteDeferredRequest(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\gpu_channel.cc:833:13
    #21 0x7fff196bf4cf in base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:740
    #22 0x7fff196bf4cf in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:956
    #23 0x7fff196bf4cf in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,base::internal::BindState<1,1,0,void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel>,mojo::StructPtr<gpu::mojom::DeferredRequestParams> >,void (gpu::FenceSyncReleaseDelegate *)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069
    #24 0x7fff196bf4cf in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl gpu::GpuChannel::*&&)(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *), class base::WeakPtr<class gpu::GpuChannel> &&, class mojo::StructPtr<class gpu::mojom::DeferredRequestParams> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl gpu::GpuChannel::*)(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *), class base::WeakPtr<class gpu::GpuChannel>, class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>>, (class gpu::FenceSyncReleaseDelegate *)>::RunOnce(class base::internal::BindStateBase *, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982:12
    #25 0x7fff036204cb in base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
    #26 0x7fff036204cb in base::internal::DecayedFunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,gpu::FenceSyncReleaseDelegate *>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:815
    #27 0x7fff036204cb in base::internal::InvokeHelper<0,base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)> &&,gpu::FenceSyncReleaseDelegate *>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:932
    #28 0x7fff036204cb in base::internal::Invoker<struct base::internal::FunctorTraits<class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)> &&, class gpu::FenceSyncReleaseDelegate *>, struct base::internal::BindState<0, 1, 1, class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)>, class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>>, (void)>::RunImpl<class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)>, class std::__Cr::tuple<class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>>, 0>(class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)> &&, class std::__Cr::tuple<class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>> &&, struct std::__Cr::integer_sequence<unsigned __int64, 0>) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069:14
    #29 0x7fff035f42f2 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
    #30 0x7fff035f42f2 in gpu::Scheduler::ExecuteSequence(class base::IdType<class gpu::SyncPointOrderData, unsigned int, 0, 1>) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:707:29
    #31 0x7fff035f2420 in gpu::Scheduler::RunNextTask(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:625:3
    #32 0x7fff035f6fa4 in base::internal::DecayedFunctorTraits<void (gpu::Scheduler::*)(),gpu::Scheduler *>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:740
    #33 0x7fff035f6fa4 in base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(),gpu::Scheduler *>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:932
    #34 0x7fff035f6fa4 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(),gpu::Scheduler *>,base::internal::BindState<1,1,0,void (gpu::Scheduler::*)(),base::internal::UnretainedWrapper<gpu::Scheduler,base::unretained_traits::MayNotDangle,0> >,void ()>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069
    #35 0x7fff035f6fa4 in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl gpu::Scheduler::*&&)(void), class gpu::Scheduler *>, struct base::internal::BindState<1, 1, 0, void (__cdecl gpu::Scheduler::*)(void), class base::internal::UnretainedWrapper<class gpu::Scheduler, struct base::unretained_traits::MayNotDangle, 0>>, (void)>::RunOnce(class base::internal::BindStateBase *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982:12
    #36 0x7fff1434a988 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
    #37 0x7fff1434a988 in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:229:34
    #38 0x7fff1431add1 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:112
    #39 0x7fff1431add1 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:475:23
    #40 0x7fff14319c33 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:346:40
    #41 0x7fff14484b10 in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42:55
    #42 0x7fff1431cb1f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:650:12
    #43 0x7fff143c25ac in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:135:14
    #44 0x7fff1deb4f03 in content::GpuMain(struct content::MainFunctionParams) C:\b\s\w\ir\cache\builder\src\content\gpu\gpu_main.cc:479:14
    #45 0x7fff0ff97536 in content::RunOtherNamedProcessTypeMain(class std::__Cr::basic_string<char, struct std::__Cr::char_traits<char>, class std::__Cr::allocator<char>> const &, struct content::MainFunctionParams, class content::ContentMainDelegate *) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:762:14
    #46 0x7fff0ff99bcb in content::ContentMainRunnerImpl::Run(void) C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1147:10
    #47 0x7fff0ff8da9f in content::RunContentProcess(struct content::ContentMainParams, class content::ContentMainRunner *) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:358:36
    #48 0x7fff0ff8e242 in content::ContentMain(struct content::ContentMainParams) C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:371:10
    #49 0x7ffefff02b06 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:191:12
    #50 0x7ff7bac44807 in MainDllLoader::Launch(struct HINSTANCE__*, class base::TimeTicks) C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:204:12
    #51 0x7ff7bac42074 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:351:20
    #52 0x7ff7bb13c83f in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #53 0x7ff7bb13c83f in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #54 0x7ff84e4be8d6  (C:\Windows\System32\KERNEL32.DLL+0x18002e8d6)
    #55 0x7ff84f06c40b  (C:\Windows\SYSTEM32\ntdll.dll+0x18008c40b)

0x11acaa5d1820 is located 0 bytes after 1572896-byte region [0x11acaa451800,0x11acaa5d1820)
allocated by thread T0 here:
    #0 0x7fff6924e51f  (C:\Users\symeon\Desktop\chromium-147.0.7691.0-win64-asan\clang_rt.asan_dynamic-x86_64.dll+0x18005e51f)
    #1 0x7fff15436d32 in GrCpuBuffer::Make C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrCpuBuffer.h:29
    #2 0x7fff15436d32 in GrBufferAllocPool::CpuBufferCache::makeBuffer(unsigned __int64, bool) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrBufferAllocPool.cpp:56:30
    #3 0x7fff15437fc7 in GrBufferAllocPool::resetCpuData(unsigned __int64) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrBufferAllocPool.cpp:389:60
    #4 0x7fff15439cd1 in GrBufferAllocPool::createBlock(unsigned __int64) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrBufferAllocPool.cpp:362:15
    #5 0x7fff15438fce in GrBufferAllocPool::makeSpace(unsigned __int64, unsigned __int64, class sk_sp<class GrBuffer const> *, unsigned __int64 *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrBufferAllocPool.cpp:229:16
    #6 0x7fff1543b8c0 in GrVertexBufferAllocPool::makeSpace(unsigned __int64, int, class sk_sp<class GrBuffer const> *, int *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrBufferAllocPool.cpp:445:28
    #7 0x7fff15349b27 in GrEagerDynamicVertexAllocator::lock(unsigned __int64, int) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrEagerVertexAllocator.cpp:20:31
    #8 0x7fff153528b8 in GrEagerVertexAllocator::lockWriter C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrEagerVertexAllocator.h:39
    #9 0x7fff153528b8 in skgpu::ganesh::PathStencilCoverOp::onPrepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\PathStencilCoverOp.cpp:280:33
    #10 0x7fff15116c04 in GrOp::prepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\GrOp.cpp:59:11
    #11 0x7fff1511e412 in skgpu::ganesh::OpsTask::onPrepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\ops\OpsTask.cpp:548:27
    #12 0x7fff15284653 in GrRenderTask::prepare(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrRenderTask.cpp:111:11
    #13 0x7fff153ec37a in GrDrawingManager::executeRenderTasks(class GrOpFlushState *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:266:21
    #14 0x7fff153ea19a in GrDrawingManager::flush(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:209:34
    #15 0x7fff153ed7cd in GrDrawingManager::flushSurfaces(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDrawingManager.cpp:540:27
    #16 0x7fff1540584b in GrDirectContextPriv::flushSurfaces(class SkSpan<class GrSurfaceProxy *>, enum SkSurfaces::BackendSurfaceAccess, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContextPriv.cpp:92:47
    #17 0x7fff1541794a in GrDirectContextPriv::flushSurface C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContextPriv.h:106
    #18 0x7fff1541794a in GrDirectContext::flush(class SkSurface *, struct GrFlushInfo const &, class skgpu::MutableTextureState const *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\GrDirectContext.cpp:520:25
    #19 0x7fff150c88ed in skgpu::ganesh::Flush(class SkSurface *) C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\ganesh\surface\SkSurface_Ganesh.cpp:759:45
    #20 0x7fff1937ff06 in gpu::SharedContextState::FlushWriteAccess(class gpu::SkiaImageRepresentation::ScopedWriteAccess *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\shared_context_state.cc:869:9
    #21 0x7fff19627512 in gpu::raster::RasterDecoderImpl::DoEndRasterCHROMIUM(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder.cc:3099:30
    #22 0x7fff19622078 in gpu::raster::RasterDecoderImpl::HandleEndRasterCHROMIUM(unsigned int, void const volatile *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder_autogen.h:151:3
    #23 0x7fff1962c03d in gpu::raster::RasterDecoderImpl::DoCommandsImpl<0>(unsigned int, void const volatile *, int, int *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\raster_decoder.cc:1526:18
    #24 0x7fff035de36b in gpu::CommandBufferService::Flush(int, class gpu::AsyncAPIInterface *) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\command_buffer_service.cc:267:35
    #25 0x7fff196e36e1 in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, class std::__Cr::vector<struct gpu::SyncToken, class std::__Cr::allocator<struct gpu::SyncToken>> const &) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:504:22
    #26 0x7fff196e25f3 in gpu::CommandBufferStub::ExecuteDeferredRequest(class gpu::mojom::DeferredCommandBufferRequestParams &, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:173:7
    #27 0x7fff196af4a1 in gpu::GpuChannel::ExecuteDeferredRequest(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\gpu_channel.cc:833:13
    #28 0x7fff196bf4cf in base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:740
    #29 0x7fff196bf4cf in base::internal::InvokeHelper<1,base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,void,0,1>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:956
    #30 0x7fff196bf4cf in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,base::internal::BindState<1,1,0,void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel>,mojo::StructPtr<gpu::mojom::DeferredRequestParams> >,void (gpu::FenceSyncReleaseDelegate *)>::RunImpl C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069
    #31 0x7fff196bf4cf in base::internal::Invoker<struct base::internal::FunctorTraits<void (__cdecl gpu::GpuChannel::*&&)(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *), class base::WeakPtr<class gpu::GpuChannel> &&, class mojo::StructPtr<class gpu::mojom::DeferredRequestParams> &&>, struct base::internal::BindState<1, 1, 0, void (__cdecl gpu::GpuChannel::*)(class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>, class gpu::FenceSyncReleaseDelegate *), class base::WeakPtr<class gpu::GpuChannel>, class mojo::StructPtr<class gpu::mojom::DeferredRequestParams>>, (class gpu::FenceSyncReleaseDelegate *)>::RunOnce(class base::internal::BindStateBase *, class gpu::FenceSyncReleaseDelegate *) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:982:12
    #32 0x7fff036204cb in base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
    #33 0x7fff036204cb in base::internal::DecayedFunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,gpu::FenceSyncReleaseDelegate *>::Invoke C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:815
    #34 0x7fff036204cb in base::internal::InvokeHelper<0,base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)> &&,gpu::FenceSyncReleaseDelegate *>,void,0>::MakeItSo C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:932
    #35 0x7fff036204cb in base::internal::Invoker<struct base::internal::FunctorTraits<class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)> &&, class gpu::FenceSyncReleaseDelegate *>, struct base::internal::BindState<0, 1, 1, class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)>, class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>>, (void)>::RunImpl<class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)>, class std::__Cr::tuple<class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>>, 0>(class base::OnceCallback<(class gpu::FenceSyncReleaseDelegate *)> &&, class std::__Cr::tuple<class base::internal::UnretainedWrapper<class gpu::FenceSyncReleaseDelegate, struct base::unretained_traits::MayNotDangle, 0>> &&, struct std::__Cr::integer_sequence<unsigned __int64, 0>) C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1069:14
    #36 0x7fff035f42f2 in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\functional\callback.h:155
    #37 0x7fff035f42f2 in gpu::Scheduler::ExecuteSequence(class base::IdType<class gpu::SyncPointOrderData, unsigned int, 0, 1>) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:707:29

SUMMARY: AddressSanitizer: heap-buffer-overflow C:\b\s\w\ir\cache\builder\src\third_party\skia\src\gpu\BufferWriter.h:92 in skgpu::BufferWriter::write
Shadow bytes around the buggy address:
  0x11acaa5d1580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x11acaa5d1600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x11acaa5d1680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x11acaa5d1700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x11acaa5d1780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x11acaa5d1800: 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa
  0x11acaa5d1880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x11acaa5d1900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x11acaa5d1980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x11acaa5d1a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x11acaa5d1a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==46964==ADDITIONAL INFO

==46964==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7fff035f28a3 in gpu::Scheduler::RunNextTask(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:647:27
    #1 0x7fff035f28a3 in gpu::Scheduler::RunNextTask(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:647:27
    #2 0x7fff035f28a3 in gpu::Scheduler::RunNextTask(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:647:27
    #3 0x7fff035f28a3 in gpu::Scheduler::RunNextTask(void) C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:647:27


Command line: `"C:\Users\symeon\Desktop\chromium-147.0.7691.0-win64-asan\chrome.exe" --type=gpu-process --disable-gpu-sandbox --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --use-angle=vulkan --user-data-dir="C:\Users\symeon\AppData\Local\Temp\chrome-test-profile" --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=SAAAAAAAAADoAQAEAAAAAAAAAAAAAMAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2020,i,2711572133984203719,598222915878074520,262144 --field-trial-handle=2184,i,4859281458461868149,12462582824067425576,262144 --disable-features=SkiaGraphite --variations-seed-version --pseudonymization-salt-handle=2188,i,1596115968977333280,2659678181742721290,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2180 /prefetch:2`


==46964==END OF ADDITIONAL INFO

==46964==ABORTING
[47764:48420:0217/095337.032:ERROR:content\browser\gpu\gpu_process_host.cc:999] GPU process exited unexpectedly: exit_code=1
[47764:48420:0217/095344.320:ERROR:components\device_event_log\device_event_log_impl.cc:202] [09:53:44.319] USB: usb_service_win.cc:108 SetupDiGetDeviceProperty({{A45C254E-DF1C-4EFD-8020-67D146A850E0}, 6}) failed: Element not found. (0x490)
[47764:47488:0217/095344.506:ERROR:google_apis\gcm\engine\connection_factory_impl.cc:434] Failed to connect to MCS endpoint with error -105
[47764:47488:0217/095344.508:ERROR:google_apis\gcm\engine\registration_request.cc:275] Registration URL fetching failed.

CREDIT INFORMATION Reporter credit: Symeon Paraschoudis

View on issue tracker

References

Vendor advisory Fix commit Bug tracker NVD

On This Page