Chrome · GPU › GL
CVE-2026-95357
OOB in GPU (GL)
Critical
watch
CVSS 9.6
chrome
OOB
📄 Reporter bug report
🔧 Commit mapped
🧬 Trusting GPU driver quirks, clear state, or layout math
Overview
Critical
Severity
9.6
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- `glTexImage3D`
- GL entry point that (re)allocates storage for a level of a 3D texture, taking width/height/depth
sizeextents. - Mutable texture
- a texture without an immutable format (
mState.getImmutableFormat()is false), whose per-level storage can be reallocated by repeatedglTexImage*calls. - `copyImageSubData`
- GL function that copies pixel data between texture images without a round-trip through the CPU, used here to migrate existing levels to the fresh texture.
- `recreateTextureOnTexImage3dDepthIncrease`
- new ANGLE feature flag (enabled on PowerVR/Qualcomm) gating the workaround in
TextureGL.cpp.
Root Cause Analysis
On affected Qualcomm drivers, calling glTexImage3D to grow the depth of an already-allocated mutable TEXTURE_3D texture mishandles the internal storage reallocation. The driver appears to size or bound the new allocation against stale (previous) depth metadata while writing the larger extent, so the texel upload runs past the end of the reallocated buffer, producing an out-of-bounds write. Because ANGLE passed the glTexImage3D call straight through to the native driver, any content-controllable increase in the 3D texture’s depth reached the buggy driver path. The condition is specific to mutable 3D textures — immutable-format textures cannot be reallocated this way and are excluded — and only manifests when the new size.depth exceeds the level’s currentDesc.size.depth.
The fix detects this exact growth condition in ANGLE and avoids the in-place driver reallocation entirely.
Key insight
The out-of-bounds write lives in the vendor driver’s in-place depth-reallocation path, so ANGLE cannot patch the driver; instead it must never trigger that path — it recreates the texture from scratch and copies old levels, sidestepping the buggy resize.
Attack Path
- Create mutable 3D texture
Web content (WebGL2/WebGPU) creates a
TEXTURE_3Dtexture without an immutable format and allocates an initial level withglTexImage3D. - Grow the depth
The content calls
glTexImage3Dagain on the same level with a largerdepthextent than the currentImageDesc. - Reach the driver bug On an unpatched Qualcomm/PowerVR device, ANGLE forwards the call and the driver reallocates in place, writing texels past the end of the resized allocation.
- Corrupt adjacent GPU memory The out-of-bounds write clobbers neighboring allocations, giving an attacker a controllable memory-corruption primitive in the GPU process.
Impact Assessment
An out-of-bounds write in the GPU process is reachable from untrusted web content that can drive WebGL/WebGPU on affected Qualcomm/PowerVR hardware. Corrupting adjacent GPU-process memory can lead to sandboxed remote code execution or be chained toward a broader compromise. Impact is limited to devices whose drivers exhibit the bug, matching the
recreateTextureOnTexImage3dDepthIncrease feature’s PowerVR/Qualcomm gating.Changed Functions
| Function | Change | Notes |
|---|---|---|
Texture3DIncreaseDepthTestES3src/tests/gl_tests/TextureTest.cpp |
modified |
Files Changed
src/tests/gl_tests/TextureTest.cppsrc/libANGLE/renderer/gl/TextureGL.hutil/autogen/angle_features_autogen.hsrc/libANGLE/renderer/gl/renderergl_utils.cppinclude/platform/autogen/FeaturesGL_autogen.hutil/autogen/angle_features_autogen.cppsrc/tests/angle_end2end_tests_expectations.txtsrc/libANGLE/renderer/gl/TextureGL.cppinclude/platform/gl_features.json
Audit Directions
- In-place driver reallocation on resizeAudit other
glTexImage*/glTexStorage*/glCopyTexImage*paths where ANGLE forwards a size change straight to the vendor driver; a growing extent on a mutable texture may hit analogous OOB reallocation bugs. - Stale `ImageDesc` vs. new extentsLook for paths that compare or trust
mState.getImageDesc(...).sizeagainst a caller-suppliedgl::Extentsbefore allocation; mismatches (any dimension increase, not justdepth) are candidate triggers. - Feature-gated workaroundsVerify the guard conditions (
getType(),getImmutableFormat(),copyImageSubDataavailability) are complete so the OOB path is never reachable on gated hardware, e.g. via cube/array 3D types or other levels.
Patch
From 8983f40bc8efc36cc64e1d30b2c2fb4c30c42aa1 Mon Sep 17 00:00:00 2001
From: Zhenyao Mo <zmo@chromium.org>
Date: Thu, 20 Aug 2026 11:31:42 -0700
Subject: [PATCH] GL: Recreate texture on glTexImage3D with increased depth
Recreate texture and copy existing levels when glTexImage3D is called
on a mutable TEXTURE_3D texture with an increased depth to work around
Qualcomm driver bug.
Bug: chromium:530045332
Bug: chromium:549910689
Bug: chromium:549916890
Change-Id: I81697b57d1370620d00ca115edad15f94a8ba56d
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8128217
Commit-Queue: Zhenyao Mo <zmo@chromium.org>
Commit-Queue: Geoff Lang <geofflang@chromium.org>
Auto-Submit: Zhenyao Mo <zmo@chromium.org>
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Reviewed-by: Geoff Lang <geofflang@chromium.org>
---
diff --git a/include/platform/gl_features.json b/include/platform/gl_features.json
index a9ab1f9..18a3244 100644
--- a/include/platform/gl_features.json
+++ b/include/platform/gl_features.json
@@ -336,6 +336,15 @@
"issue": "https://crbug.com/534923522"
},
{
+ "name": "recreate_texture_on_tex_image_3d_depth_increase",
+ "category": "Workarounds",
+ "description": [
+ "Recreate texture and copy existing levels when glTexImage3D is called on a mutable ",
+ "TEXTURE_3D texture with an increased depth to work around Qualcomm driver bug."
+ ],
+ "issue": "http://anglebug.com/530045332"
+ },
+ {
"name": "limit_max_3d_array_texture_size_to_1024",
"category": "Workarounds",
"description": [
diff --git a/src/libANGLE/renderer/gl/TextureGL.cpp b/src/libANGLE/renderer/gl/TextureGL.cpp
index 45ea907..63fc458 100644
--- a/src/libANGLE/renderer/gl/TextureGL.cpp
+++ b/src/libANGLE/renderer/gl/TextureGL.cpp
@@ -311,6 +311,13 @@
stateManager->bindTexture(getType(), mTextureID);
+ if (features.recreateTextureOnTexImage3dDepthIncrease.enabled &&
+ getType() == gl::TextureType::_3D && !mState.getImmutableFormat() &&
+ functions->copyImageSubData)
+ {
+ ANGLE_TRY(recreateTextureOnTexImage3DDepthIncreaseWorkaround(context, target, level, size));
+ }
+
if (features.resetTexImage2DBaseLevel.enabled)
{
// setBaseLevel doesn't ever generate errors.
@@ -2955,4 +2962,86 @@
return result;
}
+angle::Result TextureGL::recreateTextureOnTexImage3DDepthIncreaseWorkaround(
+ const gl::Context *context,
+ gl::TextureTarget target,
+ size_t level,
+ const gl::Extents &size)
+{
+ const FunctionsGL *functions = GetFunctionsGL(context);
+ const angle::FeaturesGL &features = GetFeaturesGL(context);
+ StateManagerGL *stateManager = GetStateManagerGL(context);
+
+ const gl::ImageDesc ¤tDesc = mState.getImageDesc(target, level);
+ if (currentDesc.size.empty() || size.depth <= currentDesc.size.depth)
+ {
+ return angle::Result::Continue;
+ }
+
+ GLuint oldTextureID = mTextureID;
+
+ stateManager->bindTexture(getType(), oldTextureID);
+ functions->texParameteri(ToGLenum(getType()), GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+ functions->texParameteri(ToGLenum(getType()), GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+
+ functions->genTextures(1, &mTextureID);
+ stateManager->bindTexture(getType(), mTextureID);
+ functions->texParameteri(ToGLenum(getType()), GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+ functions->texParameteri(ToGLenum(getType()), GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+
+ mAppliedSwizzle = gl::SwizzleState();
+ mAppliedSampler = gl::SamplerState::CreateDefaultForTarget(getType());
+ mAppliedSampler.setMinFilter(GL_NEAREST);
+ mAppliedSampler.setMagFilter(GL_NEAREST);
+ mAppliedBaseLevel = 0;
+ mAppliedMaxLevel = gl::kInitialMaxLevel;
+
+ for (size_t l = 0; l < mState.getImageDescs().size(); ++l)
+ {
+ if (l == level)
+ {
+ continue;
+ }
+
+ const gl::ImageDesc &desc = mState.getImageDesc(target, l);
+ if (desc.size.empty())
+ {
+ continue;
+ }
+
+ nativegl::TexImageFormat levelTexImageFormat =
+ nativegl::GetTexImageFormat(functions, features, desc.format.info->sizedInternalFormat,
+ desc.format.info->format, desc.format.info->type);
+ ANGLE_GL_TRY_ALWAYS_CHECK(
+ context,
+ functions->texImage3D(ToGLenum(target), static_cast<GLint>(l),
+ levelTexImageFormat.internalFormat, desc.size.width,
+ desc.size.height, desc.size.depth, 0, levelTexImageFormat.format,
+ levelTexImageFormat.type, nullptr));
+
+ stateManager->bindTexture(getType(), oldTextureID);
+ functions->texParameteri(ToGLenum(getType()), GL_TEXTURE_MAX_LEVEL, static_cast<GLint>(l));
+ functions->texParameteri(ToGLenum(getType()), GL_TEXTURE_BASE_LEVEL, static_cast<GLint>(l));
+
+ stateManager->bindTexture(getType(), mTextureID);
+ functions->texParameteri(ToGLenum(getType()), GL_TEXTURE_MAX_LEVEL, static_cast<GLint>(l));
+ functions->texParameteri(ToGLenum(getType()), GL_TEXTURE_BASE_LEVEL, static_cast<GLint>(l));
+ mAppliedMaxLevel = static_cast<GLuint>(l);
+ mAppliedBaseLevel = static_cast<GLuint>(l);
+
+ ANGLE_GL_TRY_ALWAYS_CHECK(
+ context,
+ functions->copyImageSubData(oldTextureID, ToGLenum(target), static_cast<GLint>(l), 0, 0,
+ 0, mTextureID, ToGLenum(target), static_cast<GLint>(l), 0,
+ 0, 0, desc.size.width, desc.size.height, desc.size.depth));
+ }
+
+ stateManager->deleteTexture(oldTextureID);
+
+ mLocalDirtyBits = mAllModifiedDirtyBits;
+ onStateChange(angle::SubjectMessage::SubjectChanged);
+
+ return angle::Result::Continue;
+}
+
} // namespace rx
diff --git a/src/libANGLE/renderer/gl/TextureGL.h b/src/libANGLE/renderer/gl/TextureGL.h
index b590c62..1162f4c 100644
--- a/src/libANGLE/renderer/gl/TextureGL.h
+++ b/src/libANGLE/renderer/gl/TextureGL.h
@@ -231,6 +231,11 @@
angle::Result recreateNativeStoragePreservingLevels(const gl::Context *context);
angle::Result useTempForNonZeroBaseLevelGenmipmap(const gl::Context *context);
+ angle::Result recreateTextureOnTexImage3DDepthIncreaseWorkaround(const gl::Context *context,
+ gl::TextureTarget target,
+ size_t level,
+ const gl::Extents &size);
+
angle::Result setImageHelper(const gl::Context *context,
gl::TextureTarget target,
size_t level,
diff --git a/src/libANGLE/renderer/gl/renderergl_utils.cpp b/src/libANGLE/renderer/gl/renderergl_utils.cpp
index 511fb2f..daded80 100644
--- a/src/libANGLE/renderer/gl/renderergl_utils.cpp
+++ b/src/libANGLE/renderer/gl/renderergl_utils.cpp
@@ -2402,6 +2402,8 @@
ANGLE_FEATURE_CONDITION(features, resetBaseLevelForASTCSubImage, IsPowerVR(vendor));
ANGLE_FEATURE_CONDITION(features, recreateImmutableTextureOnBaseLevelIncrease,
IsPowerVR(vendor));
+ ANGLE_FEATURE_CONDITION(features, recreateTextureOnTexImage3dDepthIncrease,
+ isQualcomm && IsAndroid());
ANGLE_FEATURE_CONDITION(features, useTempForNonZeroBaseLevelGenMipmapUsingCopyImageSubData,
IsPowerVR(vendor));
diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt
index d45ae91..afe53ae 100644
--- a/src/tests/angle_end2end_tests_expectations.txt
+++ b/src/tests/angle_end2end_tests_expectations.txt
@@ -385,6 +385,19 @@
546627192 NVIDIA OPENGL : GLSLTest_ES3.VaryingAnonymousStructTernary/* = SKIP
546627192 NVIDIA GLES : GLSLTest_ES3.VaryingAnonymousStructTernary/* = SKIP
+// Failing on NVidia OpenGL
+549916890 NVIDIA OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByDraw/* = SKIP
+549916890 NVIDIA OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByReadPixels/* = SKIP
+549916890 NVIDIA OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByDraw/* = SKIP
+549916890 NVIDIA OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByReadPixels/* = SKIP
+
+// Failing on NVidia GLES
+549916890 NVIDIA GLES : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByDraw/* = SKIP
+549916890 NVIDIA GLES : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByReadPixels/* = SKIP
+549916890 NVIDIA GLES : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByDraw/* = SKIP
+549916890 NVIDIA GLES : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByReadPixels/* = SKIP
+
+
// Although this test passes on its own, it may cause other tests to fail.
546627188 NVIDIA OPENGL : AdvancedBlendTest.NonZeroDrawBufferDisallowed/* = SKIP
546627188 NVIDIA GLES : AdvancedBlendTest.NonZeroDrawBufferDisallowed/* = SKIP
@@ -2892,6 +2905,16 @@
500127519 MAC METAL INTEL : GLSLUBTest.AbsIntOverflow/* = SKIP
+// Failing on Windows Intel OpenGL
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseInsideRangeDrawnVerifyByDraw/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseInsideRangeDrawnVerifyByReadPixels/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseInsideRangeStagedVerifyByDraw/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseInsideRangeStagedVerifyByReadPixels/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByDraw/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByReadPixels/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByDraw/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByReadPixels/* = SKIP
+
// !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
// Slow tests, should appear last in this file
// !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
diff --git a/src/tests/gl_tests/TextureTest.cpp b/src/tests/gl_tests/TextureTest.cpp
index f391bdd..7de29e3 100644
--- a/src/tests/gl_tests/TextureTest.cpp
+++ b/src/tests/gl_tests/TextureTest.cpp
@@ -1403,7 +1403,11 @@
"out vec4 fragColor;\n"
"void main()\n"
"{\n"
- " fragColor = texture(tex3D, vec3(texcoord, 0.0));\n"
+ " fragColor = (texture(tex3D, vec3(texcoord, 0.0)) +\n"
+ " texture(tex3D, vec3(texcoord, 0.25)) +\n"
+ " texture(tex3D, vec3(texcoord, 0.5)) +\n"
+ " texture(tex3D, vec3(texcoord, 0.75)) +\n"
+ " texture(tex3D, vec3(texcoord, 1.0))) / 5.0;\n"
"}\n";
}
};
@@ -9546,6 +9550,274 @@
EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::green);
}
+class Texture3DIncreaseDepthTestES3 : public Texture3DTestES3
+{
+ protected:
+ GLuint setUp7Level3DTexture(bool drawBeforeIncrease);
+ void increaseLevelDepth(int levelToIncrease, GLColor newColor);
+ void verifyByReadPixels(GLuint texture3D, int levelToIncrease, GLColor newColor);
+ void verifyByDraw(GLuint texture3D, int levelToIncrease, GLColor newColor);
+ void cleanUp(GLuint texture3D);
+ void runTest(bool drawBeforeIncrease, bool doVerifyByDraw, int levelToIncrease);
+};
+
+GLuint Texture3DIncreaseDepthTestES3::setUp7Level3DTexture(bool drawBeforeIncrease)
+{
+ EXPECT_NE(0u, mProgram);
+ EXPECT_NE(-1, mTexture3DUniformLocation);
+
+ GLuint texture3D = 0;
+ glGenTextures(1, &texture3D);
+
+ glUseProgram(mProgram);
+ glUniform1i(mTexture3DUniformLocation, 0);
+ glActiveTexture(GL_TEXTURE0);
+ glBindTexture(GL_TEXTURE_3D, texture3D);
+ glPixelStorei(GL_UNPACK_ALIGNMENT, 1);
+ glPixelStorei(GL_PACK_ALIGNMENT, 1);
+ EXPECT_GL_NO_ERROR();
+
+ // Create a 7-level 3D texture (64x64x64 down to 1x1x2).
+ std::vector<GLubyte> data0(64 * 64 * 64, 255);
+ glTexImage3D(GL_TEXTURE_3D, 0, GL_R8, 64, 64, 64, 0, GL_RED, GL_UNSIGNED_BYTE, data0.data());
+
+ std::vector<GLubyte> data1(32 * 32 * 32 * 2, 0);
+ for (size_t i = 1; i < data1.size(); i += 2)
+ {
+ data1[i] = 255;
+ }
+ glTexImage3D(GL_TEXTURE_3D, 1, GL_RG8, 32, 32, 32, 0, GL_RG, GL_UNSIGNED_BYTE, data1.data());
+
+ std::vector<GLubyte> data2(16 * 16 * 16 * 3, 0);
+ for (size_t i = 2; i < data2.size(); i += 3)
+ {
+ data2[i] = 255;
+ }
+ glTexImage3D(GL_TEXTURE_3D, 2, GL_RGB8, 16, 16, 16, 0, GL_RGB, GL_UNSIGNED_BYTE, data2.data());
+
+ std::vector<GLColor> data3(8 * 8 * 8, GLColor::yellow);
+ glTexImage3D(GL_TEXTURE_3D, 3, GL_RGBA8, 8, 8, 8, 0, GL_RGBA, GL_UNSIGNED_BYTE, data3.data());
+
+ std::vector<GLColor> data4(4 * 4 * 4, GLColor::cyan);
+ glTexImage3D(GL_TEXTURE_3D, 4, GL_RGBA8, 4, 4, 4, 0, GL_RGBA, GL_UNSIGNED_BYTE, data4.data());
+
+ std::vector<GLushort> data5(2 * 2 * 1, 0xFFFF);
+ glTexImage3D(GL_TEXTURE_3D, 5, GL_RGB565, 2, 2, 1, 0, GL_RGB, GL_UNSIGNED_SHORT_5_6_5,
+ data5.data());
+
+ std::vector<GLColor> data6(1 * 1 * 2, GLColor::magenta);
+ glTexImage3D(GL_TEXTURE_3D, 6, GL_RGBA8, 1, 1, 2, 0, GL_RGBA, GL_UNSIGNED_BYTE, data6.data());
+
+ EXPECT_GL_NO_ERROR();
+
+ // Set BASE_LEVEL to 3, MAX_LEVEL to 4.
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, 3);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, 4);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_WRAP_R, GL_CLAMP_TO_EDGE);
+
+ glBindFramebuffer(GL_FRAMEBUFFER, mFramebuffer);
+ glViewport(0, 0, getWindowWidth(), getWindowHeight());
+
+ if (drawBeforeIncrease)
+ {
+ // Draw to backbuffer, sampling level 3 from texture
+ drawQuad(mProgram, "position", 0.5f);
+ EXPECT_GL_NO_ERROR();
+ EXPECT_PIXEL_RECT_EQ(0, 0, getWindowWidth(), getWindowHeight(), GLColor::yellow);
+ }
+
+ return texture3D;
+}
+
+void Texture3DIncreaseDepthTestES3::increaseLevelDepth(int levelToIncrease, GLColor newColor)
+{
+ // Increase depth of specified level and upload new data.
+ if (levelToIncrease == 6)
+ {
+ std::vector<GLColor> newLevel6Data(1 * 1 * 4, newColor);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, 6);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, 6);
+ glTexImage3D(GL_TEXTURE_3D, 6, GL_RGBA8, 1, 1, 4, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ newLevel6Data.data());
+ }
+ else if (levelToIncrease == 3)
+ {
+ std::vector<GLColor> newLevel3Data(8 * 8 * 16, newColor);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, 3);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, 3);
+ glTexImage3D(GL_TEXTURE_3D, 3, GL_RGBA8, 8, 8, 16, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ newLevel3Data.data());
+ }
+ else if (levelToIncrease == 4)
+ {
+ std::vector<GLColor> newLevel4Data(4 * 4 * 8, newColor);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, 4);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, 4);
+ glTexImage3D(GL_TEXTURE_3D, 4, GL_RGBA8, 4, 4, 8, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ newLevel4Data.data());
+ }
+
+ ASSERT_GL_NO_ERROR();
+}
+
+void Texture3DIncreaseDepthTestES3::verifyByReadPixels(GLuint texture3D,
+ int levelToIncrease,
+ GLColor newColor)
+{
+ struct LevelExpectation
+ {
+ GLint level;
+ GLint width;
+ GLint height;
+ GLint depth;
+ GLColor expectedColor;
+ };
+
+ LevelExpectation expectedLevels[] = {
+ {3, 8, 8, (levelToIncrease == 3) ? 16 : 8,
+ (levelToIncrease == 3) ? newColor : GLColor::yellow},
+ {4, 4, 4, (levelToIncrease == 4) ? 8 : 4,
+ (levelToIncrease == 4) ? newColor : GLColor::cyan},
+ {6, 1, 1, (levelToIncrease == 6) ? 4 : 2,
+ (levelToIncrease == 6) ? newColor : GLColor::magenta},
+ };
+
+ glBindFramebuffer(GL_FRAMEBUFFER, mFramebuffer);
+
+ for (const auto &expected : expectedLevels)
+ {
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, expected.level);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, expected.level);
+
+ for (GLint slice = 0; slice < expected.depth; ++slice)
+ {
+ // Read back the texture through framebuffer
+ glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, texture3D,
+ expected.level, slice);
+ EXPECT_GL_NO_ERROR();
+ ASSERT_GLENUM_EQ(GL_FRAMEBUFFER_COMPLETE, glCheckFramebufferStatus(GL_FRAMEBUFFER));
+ EXPECT_PIXEL_RECT_EQ(0, 0, expected.width, expected.height, expected.expectedColor);
+ }
+ }
+ ASSERT_GL_NO_ERROR();
+}
+
+void Texture3DIncreaseDepthTestES3::verifyByDraw(GLuint texture3D,
+ int levelToIncrease,
+ GLColor newColor)
+{
+ struct LevelExpectation
+ {
+ GLint level;
+ GLColor expectedColor;
... (file diff truncated)
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt
index d45ae91..afe53ae 100644
--- a/src/tests/angle_end2end_tests_expectations.txt
+++ b/src/tests/angle_end2end_tests_expectations.txt
@@ -385,6 +385,19 @@
546627192 NVIDIA OPENGL : GLSLTest_ES3.VaryingAnonymousStructTernary/* = SKIP
546627192 NVIDIA GLES : GLSLTest_ES3.VaryingAnonymousStructTernary/* = SKIP
+// Failing on NVidia OpenGL
+549916890 NVIDIA OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByDraw/* = SKIP
+549916890 NVIDIA OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByReadPixels/* = SKIP
+549916890 NVIDIA OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByDraw/* = SKIP
+549916890 NVIDIA OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByReadPixels/* = SKIP
+
+// Failing on NVidia GLES
+549916890 NVIDIA GLES : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByDraw/* = SKIP
+549916890 NVIDIA GLES : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByReadPixels/* = SKIP
+549916890 NVIDIA GLES : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByDraw/* = SKIP
+549916890 NVIDIA GLES : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByReadPixels/* = SKIP
+
+
// Although this test passes on its own, it may cause other tests to fail.
546627188 NVIDIA OPENGL : AdvancedBlendTest.NonZeroDrawBufferDisallowed/* = SKIP
546627188 NVIDIA GLES : AdvancedBlendTest.NonZeroDrawBufferDisallowed/* = SKIP
@@ -2892,6 +2905,16 @@
500127519 MAC METAL INTEL : GLSLUBTest.AbsIntOverflow/* = SKIP
+// Failing on Windows Intel OpenGL
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseInsideRangeDrawnVerifyByDraw/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseInsideRangeDrawnVerifyByReadPixels/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseInsideRangeStagedVerifyByDraw/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseInsideRangeStagedVerifyByReadPixels/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByDraw/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByReadPixels/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByDraw/* = SKIP
+549916890 WIN INTEL OPENGL : Texture3DIncreaseDepthTestES3.TexImage3DDepthIncreaseOutsideRangeStagedVerifyByReadPixels/* = SKIP
+
// !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
// Slow tests, should appear last in this file
// !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
diff --git a/src/tests/gl_tests/TextureTest.cpp b/src/tests/gl_tests/TextureTest.cpp
index f391bdd..7de29e3 100644
--- a/src/tests/gl_tests/TextureTest.cpp
+++ b/src/tests/gl_tests/TextureTest.cpp
@@ -1403,7 +1403,11 @@
"out vec4 fragColor;\n"
"void main()\n"
"{\n"
- " fragColor = texture(tex3D, vec3(texcoord, 0.0));\n"
+ " fragColor = (texture(tex3D, vec3(texcoord, 0.0)) +\n"
+ " texture(tex3D, vec3(texcoord, 0.25)) +\n"
+ " texture(tex3D, vec3(texcoord, 0.5)) +\n"
+ " texture(tex3D, vec3(texcoord, 0.75)) +\n"
+ " texture(tex3D, vec3(texcoord, 1.0))) / 5.0;\n"
"}\n";
}
};
@@ -9546,6 +9550,274 @@
EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::green);
}
+class Texture3DIncreaseDepthTestES3 : public Texture3DTestES3
+{
+ protected:
+ GLuint setUp7Level3DTexture(bool drawBeforeIncrease);
+ void increaseLevelDepth(int levelToIncrease, GLColor newColor);
+ void verifyByReadPixels(GLuint texture3D, int levelToIncrease, GLColor newColor);
+ void verifyByDraw(GLuint texture3D, int levelToIncrease, GLColor newColor);
+ void cleanUp(GLuint texture3D);
+ void runTest(bool drawBeforeIncrease, bool doVerifyByDraw, int levelToIncrease);
+};
+
+GLuint Texture3DIncreaseDepthTestES3::setUp7Level3DTexture(bool drawBeforeIncrease)
+{
+ EXPECT_NE(0u, mProgram);
+ EXPECT_NE(-1, mTexture3DUniformLocation);
+
+ GLuint texture3D = 0;
+ glGenTextures(1, &texture3D);
+
+ glUseProgram(mProgram);
+ glUniform1i(mTexture3DUniformLocation, 0);
+ glActiveTexture(GL_TEXTURE0);
+ glBindTexture(GL_TEXTURE_3D, texture3D);
+ glPixelStorei(GL_UNPACK_ALIGNMENT, 1);
+ glPixelStorei(GL_PACK_ALIGNMENT, 1);
+ EXPECT_GL_NO_ERROR();
+
+ // Create a 7-level 3D texture (64x64x64 down to 1x1x2).
+ std::vector<GLubyte> data0(64 * 64 * 64, 255);
+ glTexImage3D(GL_TEXTURE_3D, 0, GL_R8, 64, 64, 64, 0, GL_RED, GL_UNSIGNED_BYTE, data0.data());
+
+ std::vector<GLubyte> data1(32 * 32 * 32 * 2, 0);
+ for (size_t i = 1; i < data1.size(); i += 2)
+ {
+ data1[i] = 255;
+ }
+ glTexImage3D(GL_TEXTURE_3D, 1, GL_RG8, 32, 32, 32, 0, GL_RG, GL_UNSIGNED_BYTE, data1.data());
+
+ std::vector<GLubyte> data2(16 * 16 * 16 * 3, 0);
+ for (size_t i = 2; i < data2.size(); i += 3)
+ {
+ data2[i] = 255;
+ }
+ glTexImage3D(GL_TEXTURE_3D, 2, GL_RGB8, 16, 16, 16, 0, GL_RGB, GL_UNSIGNED_BYTE, data2.data());
+
+ std::vector<GLColor> data3(8 * 8 * 8, GLColor::yellow);
+ glTexImage3D(GL_TEXTURE_3D, 3, GL_RGBA8, 8, 8, 8, 0, GL_RGBA, GL_UNSIGNED_BYTE, data3.data());
+
+ std::vector<GLColor> data4(4 * 4 * 4, GLColor::cyan);
+ glTexImage3D(GL_TEXTURE_3D, 4, GL_RGBA8, 4, 4, 4, 0, GL_RGBA, GL_UNSIGNED_BYTE, data4.data());
+
+ std::vector<GLushort> data5(2 * 2 * 1, 0xFFFF);
+ glTexImage3D(GL_TEXTURE_3D, 5, GL_RGB565, 2, 2, 1, 0, GL_RGB, GL_UNSIGNED_SHORT_5_6_5,
+ data5.data());
+
+ std::vector<GLColor> data6(1 * 1 * 2, GLColor::magenta);
+ glTexImage3D(GL_TEXTURE_3D, 6, GL_RGBA8, 1, 1, 2, 0, GL_RGBA, GL_UNSIGNED_BYTE, data6.data());
+
+ EXPECT_GL_NO_ERROR();
+
+ // Set BASE_LEVEL to 3, MAX_LEVEL to 4.
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, 3);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, 4);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_WRAP_R, GL_CLAMP_TO_EDGE);
+
+ glBindFramebuffer(GL_FRAMEBUFFER, mFramebuffer);
+ glViewport(0, 0, getWindowWidth(), getWindowHeight());
+
+ if (drawBeforeIncrease)
+ {
+ // Draw to backbuffer, sampling level 3 from texture
+ drawQuad(mProgram, "position", 0.5f);
+ EXPECT_GL_NO_ERROR();
+ EXPECT_PIXEL_RECT_EQ(0, 0, getWindowWidth(), getWindowHeight(), GLColor::yellow);
+ }
+
+ return texture3D;
+}
+
+void Texture3DIncreaseDepthTestES3::increaseLevelDepth(int levelToIncrease, GLColor newColor)
+{
+ // Increase depth of specified level and upload new data.
+ if (levelToIncrease == 6)
+ {
+ std::vector<GLColor> newLevel6Data(1 * 1 * 4, newColor);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, 6);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, 6);
+ glTexImage3D(GL_TEXTURE_3D, 6, GL_RGBA8, 1, 1, 4, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ newLevel6Data.data());
+ }
+ else if (levelToIncrease == 3)
+ {
+ std::vector<GLColor> newLevel3Data(8 * 8 * 16, newColor);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, 3);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, 3);
+ glTexImage3D(GL_TEXTURE_3D, 3, GL_RGBA8, 8, 8, 16, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ newLevel3Data.data());
+ }
+ else if (levelToIncrease == 4)
+ {
+ std::vector<GLColor> newLevel4Data(4 * 4 * 8, newColor);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, 4);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, 4);
+ glTexImage3D(GL_TEXTURE_3D, 4, GL_RGBA8, 4, 4, 8, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ newLevel4Data.data());
+ }
+
+ ASSERT_GL_NO_ERROR();
+}
+
+void Texture3DIncreaseDepthTestES3::verifyByReadPixels(GLuint texture3D,
+ int levelToIncrease,
+ GLColor newColor)
+{
+ struct LevelExpectation
+ {
+ GLint level;
+ GLint width;
+ GLint height;
+ GLint depth;
+ GLColor expectedColor;
+ };
+
+ LevelExpectation expectedLevels[] = {
+ {3, 8, 8, (levelToIncrease == 3) ? 16 : 8,
+ (levelToIncrease == 3) ? newColor : GLColor::yellow},
+ {4, 4, 4, (levelToIncrease == 4) ? 8 : 4,
+ (levelToIncrease == 4) ? newColor : GLColor::cyan},
+ {6, 1, 1, (levelToIncrease == 6) ? 4 : 2,
+ (levelToIncrease == 6) ? newColor : GLColor::magenta},
+ };
+
+ glBindFramebuffer(GL_FRAMEBUFFER, mFramebuffer);
+
+ for (const auto &expected : expectedLevels)
+ {
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, expected.level);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, expected.level);
+
+ for (GLint slice = 0; slice < expected.depth; ++slice)
+ {
+ // Read back the texture through framebuffer
+ glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, texture3D,
+ expected.level, slice);
+ EXPECT_GL_NO_ERROR();
+ ASSERT_GLENUM_EQ(GL_FRAMEBUFFER_COMPLETE, glCheckFramebufferStatus(GL_FRAMEBUFFER));
+ EXPECT_PIXEL_RECT_EQ(0, 0, expected.width, expected.height, expected.expectedColor);
+ }
+ }
+ ASSERT_GL_NO_ERROR();
+}
+
+void Texture3DIncreaseDepthTestES3::verifyByDraw(GLuint texture3D,
+ int levelToIncrease,
+ GLColor newColor)
+{
+ struct LevelExpectation
+ {
+ GLint level;
+ GLColor expectedColor;
+ };
+
+ LevelExpectation expectedLevels[] = {
+ {3, (levelToIncrease == 3) ? newColor : GLColor::yellow},
+ {4, (levelToIncrease == 4) ? newColor : GLColor::cyan},
+ {6, (levelToIncrease == 6) ? newColor : GLColor::magenta},
+ };
+
+ glBindFramebuffer(GL_FRAMEBUFFER, mFramebuffer);
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D,
+ mFramebufferColorTexture, 0);
+
+ for (const auto &expected : expectedLevels)
+ {
+ // Draw to backbuffer, sampling level from texture
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, expected.level);
+ glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, expected.level);
+
+ glViewport(0, 0, getWindowWidth(), getWindowHeight());
+ drawQuad(mProgram, "position", 0.5f);
+ ASSERT_GL_NO_ERROR();
+ EXPECT_PIXEL_RECT_EQ(0, 0, getWindowWidth(), getWindowHeight(), expected.expectedColor);
+ }
+ ASSERT_GL_NO_ERROR();
+}
+
+void Texture3DIncreaseDepthTestES3::cleanUp(GLuint texture3D)
+{
+ // Clean up mFramebuffer attachment so it is not left with texture3D attached to
+ // GL_COLOR_ATTACHMENT0. Restore mFramebufferColorTexture.
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D,
+ mFramebufferColorTexture, 0);
+
+ glDeleteTextures(1, &texture3D);
+}
+
+void Texture3DIncreaseDepthTestES3::runTest(bool drawBeforeIncrease,
+ bool doVerifyByDraw,
+ int levelToIncrease)
+{
+ GLuint texture3D = setUp7Level3DTexture(drawBeforeIncrease);
+ GLColor newColor(255, 128, 0, 255);
+ increaseLevelDepth(levelToIncrease, newColor);
+
+ if (doVerifyByDraw)
+ {
+ verifyByDraw(texture3D, levelToIncrease, newColor);
+ }
+ else
+ {
+ verifyByReadPixels(texture3D, levelToIncrease, newColor);
+ }
+
+ cleanUp(texture3D);
+}
+
+// Test increasing depth of level 6 (outside base/max range) after drawing (updates flushed).
+TEST_P(Texture3DIncreaseDepthTestES3, TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByDraw)
+{
+ runTest(/*drawBeforeIncrease=*/true, /*doVerifyByDraw=*/true, 6);
+}
+
+// Test increasing depth of level 6 (outside base/max range) after drawing (updates flushed).
+TEST_P(Texture3DIncreaseDepthTestES3, TexImage3DDepthIncreaseOutsideRangeDrawnVerifyByReadPixels)
+{
+ runTest(/*drawBeforeIncrease=*/true, /*doVerifyByDraw=*/false, 6);
+}
+
+// Test increasing depth of level 6 (outside base/max range) without drawing (updates staged).
+TEST_P(Texture3DIncreaseDepthTestES3, TexImage3DDepthIncreaseOutsideRangeStagedVerifyByDraw)
+{
+ runTest(/*drawBeforeIncrease=*/false, /*doVerifyByDraw=*/true, 6);
+}
+
... (truncated)
Loading diff…
Original Bug Report
reported by ha...@gmail.com
OOB write in qualcomm gpu #2
Security Bug
Important: Please do not change the component of this bug manually.
Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/faq.md
Please see the following link for instructions on filing security bugs: https://www.chromium.org/Home/chromium-security/reporting-security-bugs
Reports may be eligible for reward payments under the Chrome VRP: https://g.co/chrome/vrp
NOTE: Security bugs are normally made public once a fix has been widely deployed.
VULNERABILITY DETAILS .
VERSION
Chrome Version: [149.0.7827.199] + [stable, beta, or dev]
Operating System: SM-S9420
REPRODUCTION CASE
1.open chrome with s25_oob2.html.use valid decoder
2.logcat | grep DEBUG
Please attach files directly, not in zip or other archive formats, and if you’ve created a demonstration site please also attach the files needed to reproduce the demonstration locally.
FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [gpu]
Crash State:
Symbolizing stack using ABI=arm64
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x78c6c27cac in tid 1314 (CrGpuMain), pid 1004 (ileged_process0)
Build fingerprint: 'samsung/m1qzcx/m1q:16/BP4A.251205.006/S9420ZCS3AZF1_CHC3AZF1:user/release-keys'
Revision: '20'
pid: 1004, tid: 1314, name: CrGpuMain >>> org.chromium.chrome:privileged_process0 <<<
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x00000078c6c27cac (write)
Stack Trace:
RELADDR FUNCTION FILE:LINE
000000000017df60 !!!0000!ede93666e4f032b9f70c12586cf138!87ff20b216!+9600) (BuildId: 3790729b6e3d9d197e73b2d663c8e472 /vendor/lib64/egl/libGLESv2_adreno.so
000000000017af88 !!!0000!772d3ff0f6cde99496b2b99c9bec39!87ff20b216!+440) (BuildId: 3790729b6e3d9d197e73b2d663c8e472 /vendor/lib64/egl/libGLESv2_adreno.so
00000000001581b0 !!!0000!d0051afa8fb0bb02a68e169738355f!87ff20b216!+240) (BuildId: 3790729b6e3d9d197e73b2d663c8e472 /vendor/lib64/egl/libGLESv2_adreno.so
0000000000158010 !!!0000!4c55ad62eeadde03d2e8ada46b4156!87ff20b216!+48) (BuildId: 3790729b6e3d9d197e73b2d663c8e472 /vendor/lib64/egl/libGLESv2_adreno.so
v------> gpu::gles2::GLES2DecoderImpl::DoFlush() ../../gpu/command_buffer/service/gles2_cmd_decoder.cc:4978:10
00000000097523bc gpu::gles2::GLES2DecoderImpl::HandleFlush(unsigned int, void const volatile*) ../../gpu/command_buffer/service/gles2_cmd_decoder_autogen.h:996:3
0000000009770d7c gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) ../../gpu/command_buffer/service/gles2_cmd_decoder.cc:4910:18
0000000004082ac4 gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) ../../gpu/command_buffer/service/command_buffer_service.cc:267:35
0000000009853cdc gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&) ../../gpu/ipc/service/command_buffer_stub.cc:504:22
00000000098539e0 gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) ../../gpu/ipc/service/command_buffer_stub.cc:173:7
00000000098594c0 gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*) ../../gpu/ipc/service/gpu_channel.cc:854:13
v------> void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&) ../../base/functional/bind_internal.h:740:12
v------> void base::internal::InvokeHelper<true, base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, void, 0ul, 1ul>::MakeItSo<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), std::__Cr::tuple<base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), std::__Cr::tuple<base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>&&, gpu::FenceSyncReleaseDelegate*&&) ../../base/functional/bind_internal.h:956:5
v------> void base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunImpl<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), std::__Cr::tuple<base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, 0ul, 1ul>(void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), std::__Cr::tuple<base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>&&, std::__Cr::integer_sequence<unsigned long, 0ul, 1ul>, gpu::FenceSyncReleaseDelegate*&&) ../../base/functional/bind_internal.h:1069:14
000000000985c1ac base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) ../../base/functional/bind_internal.h:982:12
v------> base::OnceCallback<void (media::DemuxerStream*)>::Run(media::DemuxerStream*) && ../../base/functional/callback.h:155:12
v------> void base::internal::DecayedFunctorTraits<base::OnceCallback<void (media::DemuxerStream*)>, media::DemuxerStream*&&>::Invoke<base::OnceCallback<void (media::DemuxerStream*)>, media::DemuxerStream*>(base::OnceCallback<void (media::DemuxerStream*)>&&, media::DemuxerStream*&&) ../../base/functional/bind_internal.h:815:49
v------> void base::internal::InvokeHelper<false, base::internal::FunctorTraits<base::OnceCallback<void (media::DemuxerStream*)>&&, media::DemuxerStream*&&>, void, 0ul>::MakeItSo<base::OnceCallback<void (media::DemuxerStream*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<media::DemuxerStream, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>>(base::OnceCallback<void (media::DemuxerStream*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<media::DemuxerStream, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&) ../../base/functional/bind_internal.h:932:12
v------> void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (media::DemuxerStream*)>&&, media::DemuxerStream*&&>, base::internal::BindState<false, true, true, base::OnceCallback<void (media::DemuxerStream*)>, base::internal::UnretainedWrapper<media::DemuxerStream, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (media::DemuxerStream*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<media::DemuxerStream, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (media::DemuxerStream*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<media::DemuxerStream, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) ../../base/functional/bind_internal.h:1069:14
000000000398f2d0 base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (void const*)>&&, collaboration::CollaborationController*&&>, base::internal::BindState<false, true, true, base::OnceCallback<void (void const*)>, base::internal::UnretainedWrapper<collaboration::CollaborationController, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) ../../base/functional/bind_internal.h:982:12
v------> base::OnceCallback<void ()>::Run() && ../../base/functional/callback.h:155:12
0000000004088ed8 gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>) ../../gpu/command_buffer/service/scheduler.cc:743:29
0000000004088440 gpu::Scheduler::RunNextTask() ../../gpu/command_buffer/service/scheduler.cc:632:3
v------> base::OnceCallback<void ()>::Run() && ../../base/functional/callback.h:155:12
000000000710e168 base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ../../base/task/common/task_annotator.cc:229:34
v------> void base::TaskAnnotator::RunTask<base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_3>(perfetto::StaticString, base::PendingTask&, base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::$_3&&) ../../base/task/common/task_annotator.h:112:5
0000000007126854 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:482:23
00000000071263c4 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:345:40
00000000070c363c base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ../../base/message_loop/message_pump_default.cc:66:55
0000000007126ed0 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:660:12
00000000070ef314 base::RunLoop::Run(base::Location const&) ../../base/run_loop.cc:135:14
000000000ca06874 content::GpuMain(content::MainFunctionParams) ../../content/gpu/gpu_main.cc:490:14
000000000709b7dc content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) ../../content/app/content_main_runner_impl.cc:764:14
000000000709c61c content::ContentMainRunnerImpl::Run() ../../content/app/content_main_runner_impl.cc:1165:10
0000000007097ef0 content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) ../../content/app/content_main.cc:356:36
0000000007098e5c content::StartContentMain(bool) ../../content/app/android/content_main_android.cc:54:10
00000000002c2100 art_quick_generic_jni_trampoline+144) (BuildId: 7087b2f2160bfbf3335d54ba9779e325 /apex/com.android.art/lib64/libart.so
0000000000668468 nterp_helper+152) (BuildId: 7087b2f2160bfbf3335d54ba9779e325 /apex/com.android.art/lib64/libart.so
00000000002baf42 offset 0x20cf000) (w52.run+574 /data/app/~~s0PtTN4Zrizjo2F4uSoRjw==/org.chromium.chrome-FUL7k8IhjTKs_vyyNus-Rw==/base.apk/libmonochrome.so
00000000000a95e0 java.lang.Thread.run+64) (BuildId: d6f0847619f0122787c5b74ee59c378621d24e03 /system/framework/arm64/boot.oat
00000000002aad94 art_quick_invoke_stub+612) (BuildId: 7087b2f2160bfbf3335d54ba9779e325 /apex/com.android.art/lib64/libart.so
00000000002707ac art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+220) (BuildId: 7087b2f2160bfbf3335d54ba9779e325 /apex/com.android.art/lib64/libart.so
00000000004bdc28 art::Thread::CreateCallback(void*)+1184) (BuildId: 7087b2f2160bfbf3335d54ba9779e325 /apex/com.android.art/lib64/libart.so
00000000004bd778 art::Thread::CreateCallbackWithUffdGc(void*)+8) (BuildId: 7087b2f2160bfbf3335d54ba9779e325 /apex/com.android.art/lib64/libart.so
00000000000866ec __pthread_start(void*) (.__uniq.67847048707805468364044055584648682506)+184) (BuildId: e28deee9fc7ad1daecee81acb7c02e5b /apex/com.android.runtime/lib64/bionic/libc.so
000000000007900c __start_thread+68) (BuildId: e28deee9fc7ad1daecee81acb7c02e5b /apex/com.android.runtime/lib64/bionic/libc.so
Reporter credit: Anymous
References
On This Page