CVE-2026-4676

High chrome UAF 📄 Reporter bug report 🔧 Commit mapped

Overview

High

Severity

—

CVSS

Exploited ITW

Fixed

Fix Status

ImpactUse after free in Dawn

DescriptionUse after free in Dawn

ComponentDawn

Bug ClassUAF

Tracker488613135

Fix commitb2a0c4eb105f (dawn) +193/-117

CISA KEVNot listed

Credited86ac1f1587b71893ed2ad792cd7dde32

Disclosed2026-03-23

Changed Functions

Function	Change	Notes
`Guard` src/dawn/common/MutexProtected.h	modified

Files Changed

src/dawn/common/MutexProtected.h
src/dawn/wire/server/ObjectStorage.h
src/dawn/wire/server/ServerBuffer.cpp

Patch

view commit

From b2a0c4eb105fa5dfc7335280613c882699a87b9a Mon Sep 17 00:00:00 2001
From: Lokbondo Kung <lokokung@google.com>
Date: Tue, 10 Mar 2026 15:30:49 -0700
Subject: [PATCH] [dawn][wire] Adds a lock to the server-side buffer object.

- The lock is necessary now since the server's callbacks are allowed
  to be spontaneous which means it may be run on different threads.
  The lock ensures that if the main server thread processing commands
  from the client is running an Unmap or Destroy operation on a
  buffer, that it is protected against a race with a thread calling
  the spontaneous callback that may update the mapping state.
- Also adds and updates MutexProtected/MutexRefProtected to allow for
  copy/move constructors and assignment when it makes sense. This was
  necessary because we needed to be able to move assign the wire
  server data fields.

Bug: 488613135
Change-Id: I6c2eae3324fa6c551f2c2bb0e6eacf5371284dad
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/295217
Auto-Submit: Loko Kung <lokokung@google.com>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Commit-Queue: Kai Ninomiya <kainino@chromium.org>
---

diff --git a/src/dawn/common/MutexProtected.h b/src/dawn/common/MutexProtected.h
index b1481a1..d0b68b2 100644
--- a/src/dawn/common/MutexProtected.h
+++ b/src/dawn/common/MutexProtected.h
@@ -97,6 +97,20 @@
     static const ObjectType* GetObj(const Ref<T>* const obj) { return obj->Get(); }
 };
 
+template <typename T>
+struct MutexRefProtectedTraits {
+    using MutexType = Ref<Mutex>;
+    using LockType = Mutex::AutoLock;
+    using ObjectType = T;
+
+    static constexpr bool kSupportsTryLock = false;
+
+    static MutexType CreateMutex() { return AcquireRef(new Mutex()); }
+    static Mutex* GetMutex(MutexType& m) { return m.Get(); }
+    static ObjectType* GetObj(T* const obj) { return obj; }
+    static const ObjectType* GetObj(const T* const obj) { return obj; }
+};
+
 template <typename T, typename Traits>
 class Guard;
 template <typename T, typename Traits, NotifyType NotifyT>
@@ -267,11 +281,29 @@
     using ConstUsage = Guard<const T, Traits>;
 
     template <typename... Args>
+        requires(sizeof...(Args) != 1 ||
+                 !(std::is_same_v<std::decay_t<Args>, MutexProtected> && ...))
     // NOLINTNEXTLINE(runtime/explicit) allow implicit construction
     MutexProtected(Args&&... args)
         : mMutex(Traits::CreateMutex()), mObj(std::forward<Args>(args)...) {}
     virtual ~MutexProtected() = default;
 
+    MutexProtected(const MutexProtected&)
+        requires std::copy_constructible<typename Traits::MutexType> && std::copy_constructible<T>
+    = default;
+    MutexProtected& operator=(const MutexProtected&)
+        requires std::is_copy_assignable_v<typename Traits::MutexType> &&
+                     std::is_copy_assignable_v<T>
+    = default;
+
+    MutexProtected(MutexProtected&&)
+        requires std::move_constructible<typename Traits::MutexType> && std::move_constructible<T>
+    = default;
+    MutexProtected& operator=(MutexProtected&&)
+        requires std::is_move_assignable_v<typename Traits::MutexType> &&
+                     std::is_move_assignable_v<T>
+    = default;
+
     Usage operator->() { return Usage(&mObj, mMutex); }
     template <typename Fn>
     auto Use(Fn&& fn) {
@@ -309,6 +341,10 @@
     T mObj;
 };
 
+// A moveable version of MutexProtected.
+template <typename T>
+using MutexRefProtected = MutexProtected<T, detail::Guard, detail::MutexRefProtectedTraits<T>>;
+
 // Wrapping class for object members to provide the protections with a mutex of a MutexProtected
 // with some additional helpers to allow waiting with a conditional variable as well. The general
 // usage should look the same as MutexProtected above, with additional usages like the following
@@ -338,11 +374,29 @@
     using ConstUsage = Guard<const T, Traits, NotifyType::None>;
 
     template <typename... Args>
+        requires(sizeof...(Args) != 1 ||
+                 !(std::is_same_v<std::decay_t<Args>, MutexCondVarProtected> && ...))
     // NOLINTNEXTLINE(runtime/explicit) allow implicit construction
     MutexCondVarProtected(Args&&... args)
         : mMutex(Traits::CreateMutex()), mObj(std::forward<Args>(args)...) {}
     virtual ~MutexCondVarProtected() = default;
 
+    MutexCondVarProtected(const MutexCondVarProtected&)
+        requires std::copy_constructible<typename Traits::MutexType> && std::copy_constructible<T>
+    = default;
+    MutexCondVarProtected& operator=(const MutexCondVarProtected&)
+        requires std::is_copy_assignable_v<typename Traits::MutexType> &&
+                     std::is_copy_assignable_v<T>
+    = default;
+
+    MutexCondVarProtected(MutexCondVarProtected&&)
+        requires std::move_constructible<typename Traits::MutexType> && std::move_constructible<T>
+    = default;
+    MutexCondVarProtected& operator=(MutexCondVarProtected&&)
+        requires std::is_move_assignable_v<typename Traits::MutexType> &&
+                     std::is_move_assignable_v<T>
+    = default;
+
     Usage operator->() { return Usage(&mObj, mMutex, &mCv); }
     template <NotifyType NotifyT = NotifyType::All, typename Fn>
     auto Use(Fn&& fn) {
diff --git a/src/dawn/wire/server/ObjectStorage.h b/src/dawn/wire/server/ObjectStorage.h
index 45fbdc8..c9ecb25 100644
--- a/src/dawn/wire/server/ObjectStorage.h
+++ b/src/dawn/wire/server/ObjectStorage.h
@@ -35,6 +35,7 @@
 #include <vector>
 
 #include "absl/container/flat_hash_set.h"
+#include "dawn/common/MutexProtected.h"
 #include "dawn/wire/WireCmd_autogen.h"
 #include "dawn/wire/WireServer.h"
 #include "partition_alloc/pointers/raw_ptr.h"
@@ -64,12 +65,16 @@
 
 enum class BufferMapWriteState { Unmapped, Mapped, MapError };
 
+struct BufferMapState {
+    std::unique_ptr<MemoryTransferService::ReadHandle> readHandle = nullptr;
+    std::unique_ptr<MemoryTransferService::WriteHandle> writeHandle = nullptr;
+    BufferMapWriteState writeState = BufferMapWriteState::Unmapped;
+};
+
 template <>
 struct ObjectData<WGPUBuffer> : public ObjectDataBase<WGPUBuffer> {
-    // TODO(enga): Use a tagged pointer to save space.
-    std::unique_ptr<MemoryTransferService::ReadHandle> readHandle;
-    std::unique_ptr<MemoryTransferService::WriteHandle> writeHandle;
-    BufferMapWriteState mapWriteState = BufferMapWriteState::Unmapped;
+    MutexRefProtected<BufferMapState> mapState;
+
     WGPUBufferUsage usage = WGPUBufferUsage_None;
     // Indicate if writeHandle needs to be destroyed on unmap
     bool mappedAtCreation = false;
diff --git a/src/dawn/wire/server/ServerBuffer.cpp b/src/dawn/wire/server/ServerBuffer.cpp
index ba8e9e0..059243b 100644
--- a/src/dawn/wire/server/ServerBuffer.cpp
+++ b/src/dawn/wire/server/ServerBuffer.cpp
@@ -56,14 +56,15 @@
     Known<WGPUBuffer> buffer;
     WIRE_TRY(Get(cmd.selfId, &buffer));
 
-    if (buffer->mappedAtCreation && !(buffer->usage & WGPUBufferUsage_MapWrite)) {
-        // This indicates the writeHandle is for mappedAtCreation only. Destroy on unmap
-        // writeHandle could have possibly been deleted if buffer is already destroyed so we
-        // don't assert it's non-null
-        buffer->writeHandle = nullptr;
-    }
-
-    buffer->mapWriteState = BufferMapWriteState::Unmapped;
+    buffer->mapState.Use([&](auto mapState) {
+        if (buffer->mappedAtCreation && !(buffer->usage & WGPUBufferUsage_MapWrite)) {
+            // This indicates the writeHandle is for mappedAtCreation only. Destroy on unmap
+            // writeHandle could have possibly been deleted if buffer is already destroyed so we
+            // don't assert it's non-null
+            mapState->writeHandle = nullptr;
+        }
+        mapState->writeState = BufferMapWriteState::Unmapped;
+    });
 
     return WireResult::Success;
 }
@@ -74,9 +75,11 @@
     WIRE_TRY(Get(cmd.selfId, &buffer));
 
     // The buffer was destroyed. Clear the Read/WriteHandle.
-    buffer->readHandle = nullptr;
-    buffer->writeHandle = nullptr;
-    buffer->mapWriteState = BufferMapWriteState::Unmapped;
+    buffer->mapState.Use([](auto mapState) {
+        mapState->readHandle = nullptr;
+        mapState->writeHandle = nullptr;
+        mapState->writeState = BufferMapWriteState::Unmapped;
+    });
 
     return WireResult::Success;
 }
@@ -155,58 +158,61 @@
         return WireResult::FatalError;
     }

Loading diff…

Original Bug Report

reported by se...@gmail.com

Use-after-free in Dawn wire server buffer map callback due to spontaneous callback race condition

Summary

When Dawn’s spontaneous wire server mode is enabled (the default on platforms where WebGPU is active), the GPU process’s wire server processes incoming commands on the scheduler thread without holding the server mutex, while asynchronous callbacks from GPU completion handlers fire on separate threads and do acquire the mutex. This single-sided locking provides no mutual exclusion. A renderer can issue a buffer map request followed by a buffer destroy, causing the scheduler thread to free the ReadHandle object via PreHandleBufferDestroy while a Metal GPU completion callback thread is concurrently dereferencing the same ReadHandle inside OnBufferMapAsyncCallback. This results in a heap use-after-free in the GPU process, which constitutes a sandbox escape since the crash occurs outside the renderer sandbox. This vulnerability does not require a compromised renderer: the PoC uses only standard WebGPU JavaScript APIs (createBuffer, mapAsync, destroy, setTimeout) that are available to any web page on platforms where WebGPU is enabled. The vulnerability is specific to the Metal GPU backend and therefore affects macOS and iOS; no specific GPU model is required, any Metal-capable GPU is sufficient.

Bisect

The vulnerability was introduced by a series of commits that added the spontaneous wire server mode to Dawn and wired it into Chromium.

Introducing Commit (Dawn): 7c133fa8ce744ac73d0ec4b960b919d9db7bc250

Date: 2025-09-03
Author: Lokbondo Kung <lokokung@google.com>
Review: https://dawn-review.googlesource.com/c/dawn/+/237777

Introducing Commit (Chromium, feature flag): 821883aea1cdecc988290dc976614d783199486c

Date: 2025-10-20
Author: Lokbondo Kung <lokokung@google.com>
Review: https://chromium-review.googlesource.com/c/chromium/src/+/7050205

Introducing Commit (Chromium, wiring): 47978f61eaf56f03fb140b1eaa73de53e630c921

Date: 2025-10-22
Author: Lokbondo Kung <lokokung@google.com>
Review: https://chromium-review.googlesource.com/c/chromium/src/+/6918406

Root Cause

The Dawn wire server uses a split architecture where the renderer process serializes WebGPU commands into a command buffer, and the GPU process deserializes and executes them via Server::HandleCommands. When the spontaneous callback feature is enabled, asynchronous callbacks from the GPU backend (such as Metal’s command buffer completion handlers) fire on arbitrary threads and are routed through ForwardToServerHelper::Callback, which acquires the server’s mMutex via GetGuard() before invoking the callback handler. However, the main command processing path through Server::HandleCommands intentionally does not acquire this same mutex. This asymmetric locking design was chosen to avoid potential deadlocks with Device::Destroy, but it means the mutex provides zero mutual exclusion between the two threads.

The relevant callback dispatch code in Server.h shows the locking on the callback side:

// third_party/dawn/src/dawn/wire/server/Server.h
static void Callback(Args... args, void* userdata, void*) {
    std::unique_ptr<Userdata> data(static_cast<Userdata*>(userdata));
    auto server = data->server.lock();
    if (!server) { return; }
    {
        auto serverGuard = server.get()->GetGuard();  // Acquires mMutex
        (server.get()->*F)(data.get(), std::forward<Args>(args)...);
    }
    server.get()->Flush();
}

The PreHandleBufferDestroy function runs on the scheduler thread without any lock and directly resets the readHandle and writeHandle unique pointers, destroying the underlying ReadHandleImpl and WriteHandleImpl objects:

// third_party/dawn/src/dawn/wire/server/ServerBuffer.cpp
WireResult Server::PreHandleBufferDestroy(const BufferDestroyCmd& cmd) {
    Known<WGPUBuffer> buffer;
    WIRE_TRY(Get(cmd.selfId, &buffer));

    // The buffer was destroyed. Clear the Read/WriteHandle.
    buffer->readHandle = nullptr;   // Frees ReadHandle -- NO LOCK HELD
    buffer->writeHandle = nullptr;
    buffer->mapWriteState = BufferMapWriteState::Unmapped;

    return WireResult::Success;
}

Concurrently, OnBufferMapAsyncCallback runs on the Metal completion handler thread (holding mMutex) and dereferences the same readHandle unique pointer to access the ReadHandleImpl object:

// third_party/dawn/src/dawn/wire/server/ServerBuffer.cpp
void Server::OnBufferMapAsyncCallback(MapUserdata* data,
                                      WGPUMapAsyncStatus status,
                                      WGPUStringView message) {
    Known<WGPUBuffer> buffer;
    if (Get(data->buffer.id, &buffer) != WireResult::Success ||
        buffer->generation != data->buffer.generation) {
        return;
    }

    bool isRead = (data->mode & WGPUMapMode_Read) != 0u;
    bool isSuccess = status == WGPUMapAsyncStatus_Success;

    if (isSuccess && isRead) {
        readDataUpdateInfoLength =
            buffer->readHandle->SizeOfSerializeDataUpdate(data->offset, data->size);
            // Dereferences readHandle -- holds mMutex but main thread doesn't use it
    }
}

The ReadHandleImpl object is allocated in DawnServiceMemoryTransferService::DeserializeReadHandle during buffer creation and stored as a std::unique_ptr in the buffer’s ObjectData. When the scheduler thread processes a BufferDestroy command, the unique pointer reset destroys the ReadHandleImpl. If the callback thread has already loaded the raw pointer from the unique pointer (via operator->()) but has not yet completed its method call, the this pointer inside the ReadHandleImpl method becomes dangling, and any subsequent member access constitutes a use-after-free.

After OnBufferMapAsyncCallback calls SizeOfSerializeDataUpdate, it proceeds to invoke SerializeCommand with a CommandExtension callback that calls SerializeDataUpdate. The ReadHandleImpl::SerializeDataUpdate in Chromium’s dawn_service_memory_transfer_service.cc accesses freed memory through this->buffer_data_view_:

// gpu/command_buffer/service/dawn_service_memory_transfer_service.cc
void SerializeDataUpdate(const void* data, size_t offset, size_t size,
                         void* serializePointer) override {
    CHECK_LE(offset, buffer_data_view_.size());            // UAF: accesses freed this->buffer_data_view_
    CHECK_LE(size, buffer_data_view_.size() - offset);     // UAF: accesses freed this->buffer_data_view_
    memcpy(buffer_data_view_.data() + offset, data, size); // UAF: accesses freed this->buffer_data_view_
}

This is the concrete use-after-free point: when the ReadHandleImpl has been freed by PreHandleBufferDestroy on the scheduler thread, the buffer_data_view_ member access in SerializeDataUpdate dereferences a dangling this pointer. If an attacker can reclaim the freed 32-byte ReadHandleImpl region with controlled data, the buffer_data_view_ fields (a pointer at offset 16 and a size at offset 24) become attacker-controlled, and the memcpy in SerializeDataUpdate writes attacker-controlled content (the GPU buffer data, filled via queue.writeBuffer) to an attacker-controlled destination address. This yields an arbitrary write primitive in the GPU process.

The spontaneous callback mode is enabled by default in Chromium. The feature flag kWebGPUSpontaneousWireServer in gpu/config/gpu_finch_features.cc has a default value of true:

// gpu/config/gpu_finch_features.cc
const base::FeatureParam<bool> kWebGPUSpontaneousWireServer{
    &kWebGPUService, "DawnSpontaneousWireServer", true};

The race is only triggerable on the Metal backend (macOS and iOS). Metal’s Queue::SubmitPendingCommandBuffer registers a completion handler via [MTLCommandBuffer addCompletedHandler:], which the OS invokes on a Metal-owned background thread when GPU work finishes. This background thread calls UpdateCompletedSerialToInternal, which in turn calls EventManager::SetFutureReady, completing the map async event and invoking the wire server callback — all from the Metal thread. Other backends (Vulkan, D3D12, D3D11, OpenGL) check completion by polling fence values on the calling thread (vkGetFenceStatus, ID3D12Fence::GetCompletedValue, eglClientWaitSync), so the callback is never invoked spontaneously from a background thread and the race does not exist on those platforms.

Reproduce

Tested on macOS (Apple Silicon) with Chromium commit 3633b670e86af329be8ecfe3d73ba9f927f48bb3 (2026-03-01, version 147.0.7710.0). WebGPU is enabled by default on macOS, so no special flags are needed. A source code modification is used to widen the race window for reliable reproduction: adding a 500ms sleep at the beginning of ReadHandleImpl::SerializeDataUpdate causes the callback thread to hold the this pointer long enough for the scheduler thread to process the destroy command and free the object. The sleep is not strictly necessary for the vulnerability to exist; without it the race can still be triggered naturally, though it requires more iterations due to the narrow window.

To reproduce:

git apply patch.diff
ninja -C out/asan/ chrome
./out/asan/Chromium.app/Contents/MacOS/Chromium --user-data-dir=./userdata poc.html

ASAN output:

=================================================================
==7848==ERROR: AddressSanitizer: heap-use-after-free on address 0x6030001fe208 at pc 0x000361dbeda0 bp 0x00016e5294d0 sp 0x00016e5294c8
READ of size 8 at 0x6030001fe208 thread T3
==7848==WARNING: invalid path to external symbolizer!
==7848==WARNING: Failed to use and restart external symbolizer!
    #0 0x000361dbed9c in gpu::webgpu::(anonymous namespace)::ReadHandleImpl::SerializeDataUpdate(void const*, unsigned long, unsigned long, void*)+0x350 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x185aed9c)
    #1 0x000361d80d78 in void dawn::wire::ChunkedCommandSerializer::SerializeCommandImpl<dawn::wire::ReturnBufferMapAsyncCallbackCmd, void dawn::wire::ChunkedCommandSerializer::SerializeCommand<dawn::wire::ReturnBufferMapAsyncCallbackCmd>(dawn::wire::ReturnBufferMapAsyncCallbackCmd const&, dawn::wire::CommandExtension&&)::'lambda'(dawn::wire::ReturnBufferMapAsyncCallbackCmd const&, unsigned long, dawn::wire::SerializeBuffer*), dawn::wire::CommandExtension>(dawn::wire::ReturnBufferMapAsyncCallbackCmd const&, void dawn::wire::ChunkedCommandSerializer::SerializeCommand<dawn::wire::ReturnBufferMapAsyncCallbackCmd>(dawn::wire::ReturnBufferMapAsyncCallbackCmd const&, dawn::wire::CommandExtension&&)::'lambda'(dawn::wire::ReturnBufferMapAsyncCallbackCmd const&, unsigned long, dawn::wire::SerializeBuffer*)&&, dawn::wire::CommandExtension&&)+0x3a8 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x18570d78)
    #2 0x000361d80404 in void dawn::wire::server::Server::SerializeCommand<dawn::wire::ReturnBufferMapAsyncCallbackCmd, dawn::wire::CommandExtension>(dawn::wire::ReturnBufferMapAsyncCallbackCmd const&, dawn::wire::CommandExtension&&)+0x130 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x18570404)
    #3 0x000361d7f458 in dawn::wire::server::Server::OnBufferMapAsyncCallback(dawn::wire::server::MapUserdata*, WGPUMapAsyncStatus, WGPUStringView)+0x624 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x1856f458)
    #4 0x000361d80584 in dawn::wire::server::ForwardToServerHelper<&dawn::wire::server::Server::OnBufferMapAsyncCallback(dawn::wire::server::MapUserdata*, WGPUMapAsyncStatus, WGPUStringView), void (dawn::wire::server::Server::*)(dawn::wire::server::MapUserdata*, WGPUMapAsyncStatus, WGPUStringView)>::Callback(WGPUMapAsyncStatus, WGPUStringView, void*, void*)+0x94 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x18570584)
    #5 0x00034b967068 in dawn::native::BufferBase::MapAsyncEvent::RunCallback(WGPUMapAsyncStatus, std::__Cr::basic_string_view<char, std::__Cr::char_traits<char>>)+0x25c (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x2157068)
    #6 0x00034b966a24 in dawn::native::BufferBase::MapAsyncEvent::Complete(dawn::EventCompletionType)+0x47c (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x2156a24)
    #7 0x0003714f991c in std::__Cr::__call_once(unsigned long volatile&, void*, void (*)(void*))+0x16c (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x27ce991c)
    #8 0x00034ba20b18 in dawn::native::EventManager::SetFutureReady(dawn::native::EventManager::TrackedEvent*)+0x1b4 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x2210b18)
    #9 0x00034ba35040 in dawn::native::ExecutionQueueBase::UpdateCompletedSerialToInternal(unsigned long long, bool)+0x400 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x2225040)
    #10 0x00034bbf1b78 in invocation function for block in dawn::native::metal::Queue::SubmitPendingCommandBuffer()+0xf4 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x23e1b78)
    #11 0x0001a75fbe9c in MTLDispatchListApply+0x30 (/System/Library/Frameworks/Metal.framework/Versions/A/Metal:arm64e+0x15e9c)
    #12 0x0001a77b2744 in -[_MTLCommandBuffer didCompleteWithStartTime:endTime:error:]+0x260 (/System/Library/Frameworks/Metal.framework/Versions/A/Metal:arm64e+0x1cc744)
    #13 0x0001bfa75224 in -[IOGPUMetalCommandBuffer didCompleteWithStartTime:endTime:error:]+0xd8 (/System/Library/PrivateFrameworks/IOGPU.framework/Versions/A/IOGPU:arm64e+0x3224)
    #14 0x0001a77b5fa8 in -[_MTLCommandQueue commandBufferDidComplete:startTime:completionTime:error:]+0x68 (/System/Library/Frameworks/Metal.framework/Versions/A/Metal:arm64e+0x1cffa8)
    #15 0x0001bfa81668 in IOGPUNotificationQueueDispatchAvailableCompletionNotifications+0x84 (/System/Library/PrivateFrameworks/IOGPU.framework/Versions/A/IOGPU:arm64e+0xf668)
    #16 0x0001bfa81778 in __IOGPUNotificationQueueSetDispatchQueue_block_invoke+0x3c (/System/Library/PrivateFrameworks/IOGPU.framework/Versions/A/IOGPU:arm64e+0xf778)
    #17 0x000102544780 in __asan_memmove+0x2790 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Helpers/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x54780)
    #18 0x00019b112b18 in _dispatch_client_callout4+0xc (/usr/lib/system/libdispatch.dylib:arm64e+0x1bb18)
    #19 0x00019b115398 in _dispatch_mach_msg_invoke+0x1cc (/usr/lib/system/libdispatch.dylib:arm64e+0x1e398)
    #20 0x00019b10134c in _dispatch_lane_serial_drain+0x148 (/usr/lib/system/libdispatch.dylib:arm64e+0xa34c)
    #21 0x00019b116100 in _dispatch_mach_invoke+0x1d4 (/usr/lib/system/libdispatch.dylib:arm64e+0x1f100)
    #22 0x00019b10134c in _dispatch_lane_serial_drain+0x148 (/usr/lib/system/libdispatch.dylib:arm64e+0xa34c)
    #23 0x00019b101ff4 in _dispatch_lane_invoke+0x1b4 (/usr/lib/system/libdispatch.dylib:arm64e+0xaff4)
    #24 0x00019b10134c in _dispatch_lane_serial_drain+0x148 (/usr/lib/system/libdispatch.dylib:arm64e+0xa34c)
    #25 0x00019b101fc0 in _dispatch_lane_invoke+0x180 (/usr/lib/system/libdispatch.dylib:arm64e+0xafc0)
    #26 0x00019b10c470 in _dispatch_root_queue_drain_deferred_wlh+0x120 (/usr/lib/system/libdispatch.dylib:arm64e+0x15470)
    #27 0x00019b10bd68 in _dispatch_workloop_worker_thread+0x2b0 (/usr/lib/system/libdispatch.dylib:arm64e+0x14d68)
    #28 0x00019b2b1e48 in _pthread_wqthread+0x120 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x2e48)
    #29 0x00019b2b0b98 in start_wqthread+0x4 (/usr/lib/system/libsystem_pthread.dylib:arm64e+0x1b98)

0x6030001fe208 is located 24 bytes inside of 32-byte region [0x6030001fe1f0,0x6030001fe210)
freed by thread T0 here:
    #0 0x0001025450ac in __asan_memmove+0x30bc (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Helpers/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x550ac)
    #1 0x000361d7e7b0 in dawn::wire::server::Server::PreHandleBufferDestroy(dawn::wire::BufferDestroyCmd const&)+0x178 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x1856e7b0)
    #2 0x000361d97b64 in dawn::wire::server::Server::HandleCommands(char const volatile*, unsigned long)+0x2154 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x18587b64)
    #3 0x000361dcb758 in gpu::webgpu::(anonymous namespace)::DawnWireServer::HandleCommands(char const volatile*, unsigned long)+0x154 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x185bb758)
    #4 0x000361dcbb5c in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::HandleDawnCommands(unsigned int, void const volatile*)+0x2e8 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x185bbb5c)
    #5 0x000361dc1af0 in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::DoCommands(unsigned int, void const volatile*, int, int*)+0x200 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x185b1af0)
    #6 0x0003515a7340 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*)+0x4bc (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x7d97340)
    #7 0x000361cd5f9c in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&)+0x450 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x184c5f9c)
    #8 0x000361cd511c in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*)+0x468 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x184c511c)
    #9 0x000361cf3934 in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*)+0x290 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x184e3934)
    #10 0x000361cff5ec in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&)+0x144 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x184ef5ec)
    #11 0x000361cff404 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*)+0x118 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x184ef404)
    #12 0x0003515e0160 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>)+0x1c8 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x7dd0160)
    #13 0x0003515bac40 in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>)+0x634 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x7daac40)
    #14 0x0003515b92d8 in gpu::Scheduler::RunNextTask()+0x27c (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x7da92d8)
    #15 0x0003515bc674 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(), gpu::Scheduler*>, base::internal::BindState<true, true, false, void (gpu::Scheduler::*)(), base::internal::UnretainedWrapper<gpu::Scheduler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x184 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x7dac674)
    #16 0x00035bb2bfb0 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x1231bfb0)
    #17 0x00035bb9449c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x88c (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x1238449c)
    #18 0x00035bb93848 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x12383848)
    #19 0x00035bcb4fc8 in base::MessagePumpCFRunLoopBase::RunWork()+0x1c8 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x124a4fc8)
    #20 0x00035bca6678 in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x12496678)
    #21 0x00035bcb3400 in base::MessagePumpCFRunLoopBase::RunWorkSource(void*)+0xec (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x124a3400)
    #22 0x00019b3549f4 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__+0x18 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5f9f4)
    #23 0x00019b354988 in __CFRunLoopDoSource0+0xa8 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5f988)
    #24 0x00019b3546f4 in __CFRunLoopDoSources0+0xe4 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5f6f4)
    #25 0x00019b353384 in __CFRunLoopRun+0x330 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5e384)
    #26 0x00019b40de30 in _CFRunLoopRunSpecificWithOptions+0x210 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x118e30)
    #27 0x00019d5a2960 in -[NSRunLoop(NSRunLoop) runMode:beforeDate:]+0xd0 (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation:arm64e+0xa5b960)
    #28 0x00035bcb6118 in base::MessagePumpNSRunLoop::DoRun(base::MessagePump::Delegate*)+0xc8 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x124a6118)
    #29 0x00035bcb2158 in base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)+0x290 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x124a2158)

previously allocated by thread T0 here:
    #0 0x000102544fc0 in __asan_memmove+0x2fd0 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Helpers/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib:arm64+0x54fc0)
    #1 0x0003720b7d0c in operator new(unsigned long)+0x18 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x288a7d0c)
    #2 0x000361dbd870 in gpu::webgpu::DawnServiceMemoryTransferService::DeserializeReadHandle(void const*, unsigned long, dawn::wire::server::MemoryTransferService::ReadHandle**)+0x164 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x185ad870)
    #3 0x000361d7fc90 in dawn::wire::server::Server::DoDeviceCreateBuffer(dawn::wire::server::Known<WGPUDeviceImpl*>, WGPUBufferDescriptor const*, dawn::wire::ObjectHandle, unsigned long long, unsigned char const*, unsigned long long, unsigned char const*)+0x588 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x1856fc90)
    #4 0x000361d8f730 in dawn::wire::server::Server::HandleDeviceCreateBuffer(dawn::wire::DeserializeBuffer*)+0x22c (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x1857f730)
    #5 0x000361d963a8 in dawn::wire::server::Server::HandleCommands(char const volatile*, unsigned long)+0x998 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x185863a8)
    #6 0x000361dcb758 in gpu::webgpu::(anonymous namespace)::DawnWireServer::HandleCommands(char const volatile*, unsigned long)+0x154 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x185bb758)
    #7 0x000361dcbb5c in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::HandleDawnCommands(unsigned int, void const volatile*)+0x2e8 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x185bbb5c)
    #8 0x000361dc1af0 in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::DoCommands(unsigned int, void const volatile*, int, int*)+0x200 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x185b1af0)
    #9 0x0003515a7340 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*)+0x4bc (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x7d97340)
    #10 0x000361cd5f9c in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&)+0x450 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x184c5f9c)
    #11 0x000361cd511c in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*)+0x468 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x184c511c)
    #12 0x000361cf3934 in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*)+0x290 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x184e3934)
    #13 0x000361cff5ec in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&)+0x144 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x184ef5ec)
    #14 0x000361cff404 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*)+0x118 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x184ef404)
    #15 0x0003515e0160 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>)+0x1c8 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x7dd0160)
    #16 0x0003515bac40 in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>)+0x634 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x7daac40)
    #17 0x0003515b92d8 in gpu::Scheduler::RunNextTask()+0x27c (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x7da92d8)
    #18 0x0003515bc674 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(), gpu::Scheduler*>, base::internal::BindState<true, true, false, void (gpu::Scheduler::*)(), base::internal::UnretainedWrapper<gpu::Scheduler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*)+0x184 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x7dac674)
    #19 0x00035bb2bfb0 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&)+0x348 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x1231bfb0)
    #20 0x00035bb9449c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)+0x88c (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x1238449c)
    #21 0x00035bb93848 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()+0x138 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x12383848)
    #22 0x00035bcb4fc8 in base::MessagePumpCFRunLoopBase::RunWork()+0x1c8 (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x124a4fc8)
    #23 0x00035bca6678 in base::apple::CallWithEHFrame(void () block_pointer)+0xc (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x12496678)
    #24 0x00035bcb3400 in base::MessagePumpCFRunLoopBase::RunWorkSource(void*)+0xec (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x124a3400)
    #25 0x00019b3549f4 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__+0x18 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5f9f4)
    #26 0x00019b354988 in __CFRunLoopDoSource0+0xa8 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5f988)
    #27 0x00019b3546f4 in __CFRunLoopDoSources0+0xe4 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5f6f4)
    #28 0x00019b353384 in __CFRunLoopRun+0x330 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x5e384)
    #29 0x00019b40de30 in _CFRunLoopRunSpecificWithOptions+0x210 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:arm64e+0x118e30)

Thread T3 created by T0 here:
    <empty stack>

SUMMARY: AddressSanitizer: heap-use-after-free (/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Chromium Framework:arm64+0x185aed9c) in gpu::webgpu::(anonymous namespace)::ReadHandleImpl::SerializeDataUpdate(void const*, unsigned long, unsigned long, void*)+0x350
Shadow bytes around the buggy address:
  0x6030001fdf80: fd fd fd fa f7 fa fd fd fd fd f7 fa 00 00 00 fa
  0x6030001fe000: f7 fa fd fd fd fa f7 fa fd fd fd fa f7 fa fd fd
  0x6030001fe080: fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa
  0x6030001fe100: fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd fd fa
  0x6030001fe180: f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd
=>0x6030001fe200: fd[fd]f7 fa fd fd fd fd f7 fa 00 00 00 00 f7 fa
  0x6030001fe280: 00 00 00 00 f7 fa fd fd fd fd f7 fa 00 00 00 00
  0x6030001fe300: f7 fa 00 00 00 00 f7 fa 00 00 00 00 f7 fa 00 00
  0x6030001fe380: 00 00 f7 fa 00 00 00 00 f7 fa fd fd fd fa f7 fa
  0x6030001fe400: fd fd fd fd f7 fa fd fd fd fd f7 fa fd fd fd fd
  0x6030001fe480: f7 fa fd fd fd fd f7 fa fd fd fd fa f7 fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==7848==ADDITIONAL INFO

==7848==Note: Please include this section with the ASan report.
Task trace:


Command line: `/Users/test/Desktop/src/chromium/src/out/asan/Chromium.app/Contents/Frameworks/Chromium Framework.framework/Versions/147.0.7710.0/Helpers/Chromium Helper.app/Contents/MacOS/Chromium Helper --type=gpu-process --user-data-dir=./userdata --start-stack-profiler --gpu-preferences=SAAAAAAAAAAgAQAEAAAAAAAAAAAAAMAAAwAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --shared-files --metrics-shmem-handle=1752395122,r,8357134903701969152,10452187502410134878,262144 --field-trial-handle=1718379636,r,17980659783760999744,16137671430171451269,262144 --variations-seed-version --pseudonymization-salt-handle=1935764596,r,14948782399246895129,18320638700896022104,4 --trace-process-track-uuid=3190708988185955192 --seatbelt-client=25 --user-data-dir=/Users/test/Library/Application Support/Chromium`


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==7848==END OF ADDITIONAL INFO

==7848==ABORTING

Credit

86ac1f1587b71893ed2ad792cd7dde32

View on issue tracker

Links in the report

References

Vendor advisory Fix commit Bug tracker NVD

On This Page