==321==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7a1526797814 at pc 0x7a156518a032 bp 0x7fff0461f7a0 sp 0x7fff0461f798
READ of size 4 at 0x7a1526797814 thread T0 (chrome)
    #0 0x7a156518a031 in sh::TConstantUnion::cast(sh::TBasicType, sh::TConstantUnion const&) third_party/angle/src/compiler/translator/ConstantUnion.cpp:140:30
    #1 0x7a156519e30e in sh::TIntermAggregate::getConstantValue() const third_party/angle/src/compiler/translator/IntermNode.cpp:938:45
    #2 0x7a15651b4625 in sh::TIntermAggregate::fold(sh::TDiagnostics*) third_party/angle/src/compiler/translator/IntermNode.cpp:2434:26
    #3 0x7a1565209fc0 in sh::TParseContext::addConstructor(sh::TFunctionLookup*, sh::TSourceLoc const&) third_party/angle/src/compiler/translator/ParseContext.cpp:6339:29
    #4 0x7a156522391b in sh::TParseContext::addFunctionCallOrMethod(sh::TFunctionLookup*, sh::TSourceLoc const&) third_party/angle/src/compiler/translator/ParseContext.cpp:9632:16
    #5 0x7a15652a263c in yyparse(sh::TParseContext*, void*) third_party/angle/src/compiler/translator/glslang_tab_autogen.cpp:2444:26
    #6 0x7a156522c9da in sh::PaParseStrings(angle::Span<char const* const, 18446744073709551615ul, char const* const*>, int const*, sh::TParseContext*) third_party/angle/src/compiler/translator/ParseContext.cpp:10497:17
    #7 0x7a1565179cf2 in sh::TCompiler::compileTreeImpl(angle::Span<char const* const, 18446744073709551615ul, char const* const*>, ShCompileOptions const&) third_party/angle/src/compiler/translator/Compiler.cpp:482:9
    #8 0x7a156517dcb5 in sh::TCompiler::compile(angle::Span<char const* const, 18446744073709551615ul, char const* const*>, ShCompileOptions const&) third_party/angle/src/compiler/translator/Compiler.cpp:1296:26
    #9 0x7a1563d45c5e in rx::ShaderTranslateTask::translate(void*, ShCompileOptions const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) third_party/angle/src/libANGLE/renderer/ShaderImpl.cpp:22:12
    #10 0x7a1563c161b4 in gl::(anonymous namespace)::CompileTask::operator()() third_party/angle/src/libANGLE/Shader.cpp:204:39
    #11 0x7a1563ac1c85 in void std::__Cr::__function::__policy_func<void (void*)>::__call_func<gl::Context::postCompileLinkTask(std::__Cr::shared_ptr<angle::Closure> const&, angle::JobThreadSafety, angle::JobResultExpectancy) const::$_0>(std::__Cr::__function::__policy_storage const*, void*) third_party/angle/src/libANGLE/Context.cpp:9464:13
    #12 0x7a1563c9a782 in angle::UnlockedTailCall::runImpl(void*) gen/third_party/libc++/src/include/__functional/function.h:502:12
    #13 0x5f2534d5977e in gpu::gles2::GLES2DecoderPassthroughImpl::DoCompileShader(unsigned int) gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc:738:10
    #14 0x5f2534d0f7d5 in gpu::error::Error gpu::gles2::GLES2DecoderPassthroughImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:899:20
    #15 0x5f251e353774 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35
    #16 0x5f2535336e59 in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&) gpu/ipc/service/command_buffer_stub.cc:504:22
    #17 0x5f25353360d3 in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7
    #18 0x5f253534b5bc in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:854:13
    #19 0x5f253535a0c7 in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12
    #20 0x5f2535359ea9 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5
    #21 0x5f251e3980b1 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) base/functional/callback.h:155:12
    #22 0x5f251e36b81f in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>) base/functional/callback.h:155:12
    #23 0x5f251e369198 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:628:3
    #24 0x5f251e36d6d1 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(), gpu::Scheduler*>, base::internal::BindState<true, true, false, void (gpu::Scheduler::*)(), base::internal::UnretainedWrapper<gpu::Scheduler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #25 0x5f252b3f84c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #26 0x5f252b4674ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #27 0x5f252b46638a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40
    #28 0x5f252b2b96e2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #29 0x5f252b468bd4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:640:12
    #30 0x5f252b373b70 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #31 0x5f2537283843 in content::GpuMain(content::MainFunctionParams) content/gpu/gpu_main.cc:484:14
    #32 0x5f2527bf4d29 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14
    #33 0x5f2527bf5fdb in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12
    #34 0x5f2527bf8e55 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10
    #35 0x5f2527bf2788 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #36 0x5f2527bf2d8c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #37 0x5f2513269266 in ChromeMain chrome/app/chrome_main.cc:194:12
    #38 0x7e156fe2b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7a1526797814 is located 4 bytes after 17179869200-byte region [0x7a1126797800,0x7a1526797810)
allocated by thread T0 (chrome) here:
    #0 0x5f25132678ad in operator new[](unsigned long, std::nothrow_t const&) (/chromium/chromium/src/out/asan/chrome+0x10e2e8ad) (BuildId: 42c52701e3eebdcb)
    #1 0x7a15650d82e0 in angle::PoolAllocator::allocate(unsigned long) third_party/angle/src/common/PoolAlloc.cpp:320:27
    #2 0x7a156519d7f7 in sh::TIntermAggregate::getConstantValue() const third_party/angle/src/compiler/translator/ConstantUnion.h:21:5
    #3 0x7a15651acdb6 in sh::TIntermBinary::getConstantValue() const third_party/angle/src/compiler/translator/IntermNode.cpp:2322:56
    #4 0x7a15651a9514 in sh::TIntermBinary::fold(sh::TDiagnostics*) third_party/angle/src/compiler/translator/IntermNode.cpp:2248:55
    #5 0x7a15652117e6 in sh::TParseContext::expressionOrFoldedResult(sh::TIntermTyped*) third_party/angle/src/compiler/translator/ParseContext.cpp:8604:40
    #6 0x7a156521221e in sh::TParseContext::addFieldSelectionExpression(sh::TIntermTyped*, sh::TSourceLoc const&, sh::ImmutableString const&, sh::TSourceLoc const&) third_party/angle/src/compiler/translator/ParseContext.cpp:7309:24
    #7 0x7a15652a7a7b in yyparse(sh::TParseContext*, void*) third_party/angle/src/compiler/translator/glslang_tab_autogen.cpp:2414:55
    #8 0x7a156522c9da in sh::PaParseStrings(angle::Span<char const* const, 18446744073709551615ul, char const* const*>, int const*, sh::TParseContext*) third_party/angle/src/compiler/translator/ParseContext.cpp:10497:17
    #9 0x7a1565179cf2 in sh::TCompiler::compileTreeImpl(angle::Span<char const* const, 18446744073709551615ul, char const* const*>, ShCompileOptions const&) third_party/angle/src/compiler/translator/Compiler.cpp:482:9
    #10 0x7a156517dcb5 in sh::TCompiler::compile(angle::Span<char const* const, 18446744073709551615ul, char const* const*>, ShCompileOptions const&) third_party/angle/src/compiler/translator/Compiler.cpp:1296:26
    #11 0x7a1563d45c5e in rx::ShaderTranslateTask::translate(void*, ShCompileOptions const&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) third_party/angle/src/libANGLE/renderer/ShaderImpl.cpp:22:12
    #12 0x7a1563c161b4 in gl::(anonymous namespace)::CompileTask::operator()() third_party/angle/src/libANGLE/Shader.cpp:204:39
    #13 0x7a1563ac1c85 in void std::__Cr::__function::__policy_func<void (void*)>::__call_func<gl::Context::postCompileLinkTask(std::__Cr::shared_ptr<angle::Closure> const&, angle::JobThreadSafety, angle::JobResultExpectancy) const::$_0>(std::__Cr::__function::__policy_storage const*, void*) third_party/angle/src/libANGLE/Context.cpp:9464:13
    #14 0x7a1563c9a782 in angle::UnlockedTailCall::runImpl(void*) gen/third_party/libc++/src/include/__functional/function.h:502:12
    #15 0x5f2534d5977e in gpu::gles2::GLES2DecoderPassthroughImpl::DoCompileShader(unsigned int) gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc:738:10
    #16 0x5f2534d0f7d5 in gpu::error::Error gpu::gles2::GLES2DecoderPassthroughImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:899:20
    #17 0x5f251e353774 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35
    #18 0x5f2535336e59 in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&) gpu/ipc/service/command_buffer_stub.cc:504:22
    #19 0x5f25353360d3 in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7
    #20 0x5f253534b5bc in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:854:13
    #21 0x5f253535a0c7 in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12
    #22 0x5f2535359ea9 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5
    #23 0x5f251e3980b1 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) base/functional/callback.h:155:12
    #24 0x5f251e36b81f in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>) base/functional/callback.h:155:12
    #25 0x5f251e369198 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:628:3
    #26 0x5f251e36d6d1 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(), gpu::Scheduler*>, base::internal::BindState<true, true, false, void (gpu::Scheduler::*)(), base::internal::UnretainedWrapper<gpu::Scheduler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #27 0x5f252b3f84c3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #28 0x5f252b4674ec in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #29 0x5f252b46638a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40

SUMMARY: AddressSanitizer: heap-buffer-overflow third_party/angle/src/compiler/translator/ConstantUnion.cpp:140:30 in sh::TConstantUnion::cast(sh::TBasicType, sh::TConstantUnion const&)
Shadow bytes around the buggy address:
  0x7a1526797580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7a1526797600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7a1526797680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7a1526797700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7a1526797780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7a1526797800: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7a1526797880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7a1526797900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7a1526797980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7a1526797a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7a1526797a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==321==ADDITIONAL INFO

==321==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5f251e369672 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:650:27
    #1 0x5f251e369672 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:650:27
    #2 0x5f251e369672 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:650:27
    #3 0x5f251e369672 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:650:27


Command line: `/proc/self/exe --type=gpu-process --no-sandbox --headless=new --ozone-platform=headless --use-angle=swiftshader --enable-unsafe-swiftshader --crashpad-handler-pid=290 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --disable-breakpad --change-stack-guard-on-fork=enable --gpu-preferences=UAAAAAAAAAAgAAAMAAAAAAAAAAAAAMAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAYAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --shared-files --field-trial-handle=3,i,5389393294677102025,16973445428451268814,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,296042509649073322,3517340991321857379,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=stderr --v=0`


==321==END OF ADDITIONAL INFO

==321==ABORTING