================================================================= ==233==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x76f4aeffe814 at pc 0x57af45516fe2 bp 0x7fffa5f831a0 sp 0x7fffa5f83198 READ of size 4 at 0x76f4aeffe814 thread T0 #0 0x57af45516fe1 in sh::TConstantUnion::cast(sh::TBasicType, sh::TConstantUnion const&) third_party/angle/src/compiler/translator/ConstantUnion.cpp:140:30 #1 0x57af454e783e in sh::TIntermAggregate::getConstantValue() const third_party/angle/src/compiler/translator/IntermNode.cpp:938:45 #2 0x57af454fdb55 in sh::TIntermAggregate::fold(sh::TDiagnostics*) third_party/angle/src/compiler/translator/IntermNode.cpp:2434:26 #3 0x57af454a6e40 in sh::TParseContext::addConstructor(sh::TFunctionLookup*, sh::TSourceLoc const&) third_party/angle/src/compiler/translator/ParseContext.cpp:6339:29 #4 0x57af454c082b in sh::TParseContext::addFunctionCallOrMethod(sh::TFunctionLookup*, sh::TSourceLoc const&) third_party/angle/src/compiler/translator/ParseContext.cpp:9632:16 #5 0x57af455844dc in yyparse(sh::TParseContext*, void*) third_party/angle/src/compiler/translator/glslang_tab_autogen.cpp:2444:26 #6 0x57af454c98ea in sh::PaParseStrings(angle::Span, int const*, sh::TParseContext*) third_party/angle/src/compiler/translator/ParseContext.cpp:10497:17 #7 0x57af4545cad2 in sh::TCompiler::compileTreeImpl(angle::Span, ShCompileOptions const&) third_party/angle/src/compiler/translator/Compiler.cpp:482:9 #8 0x57af45461265 in sh::TCompiler::compile(angle::Span, ShCompileOptions const&) third_party/angle/src/compiler/translator/Compiler.cpp:1296:26 #9 0x57af45360cb6 in CompileFile third_party/angle/samples/shader_translator/shader_translator.cpp:524:15 #10 0x57af45360cb6 in main third_party/angle/samples/shader_translator/shader_translator.cpp:350:33 #11 0x7af4b1d09249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x76f4aeffe814 is located 4 bytes after 17179869200-byte region [0x76f0aeffe800,0x76f4aeffe810) allocated by thread T0 here: #0 0x57af4535f46d in operator new[](unsigned long, std::nothrow_t const&) (/chromium/chromium/src/out/asan/angle_shader_translator+0x53a46d) (BuildId: e71a26508d949dc5) #1 0x57af45723cf0 in angle::PoolAllocator::allocate(unsigned long) third_party/angle/src/common/PoolAlloc.cpp:320:27 #2 0x57af454e6d27 in operator new[] third_party/angle/src/compiler/translator/ConstantUnion.h:21:5 #3 0x57af454e6d27 in sh::TIntermAggregate::getConstantValue() const third_party/angle/src/compiler/translator/IntermNode.cpp:900:28 #4 0x57af454f62e6 in sh::TIntermBinary::getConstantValue() const third_party/angle/src/compiler/translator/IntermNode.cpp:2322:56 #5 0x57af454f2a44 in sh::TIntermBinary::fold(sh::TDiagnostics*) third_party/angle/src/compiler/translator/IntermNode.cpp:2248:55 #6 0x57af454ae6f6 in sh::TParseContext::expressionOrFoldedResult(sh::TIntermTyped*) third_party/angle/src/compiler/translator/ParseContext.cpp:8604:40 #7 0x57af454af12e in sh::TParseContext::addFieldSelectionExpression(sh::TIntermTyped*, sh::TSourceLoc const&, sh::ImmutableString const&, sh::TSourceLoc const&) third_party/angle/src/compiler/translator/ParseContext.cpp:7309:24 #8 0x57af4558991b in yyparse(sh::TParseContext*, void*) third_party/angle/src/compiler/translator/glslang_tab_autogen.cpp:2414:55 #9 0x57af454c98ea in sh::PaParseStrings(angle::Span, int const*, sh::TParseContext*) third_party/angle/src/compiler/translator/ParseContext.cpp:10497:17 #10 0x57af4545cad2 in sh::TCompiler::compileTreeImpl(angle::Span, ShCompileOptions const&) third_party/angle/src/compiler/translator/Compiler.cpp:482:9 #11 0x57af45461265 in sh::TCompiler::compile(angle::Span, ShCompileOptions const&) third_party/angle/src/compiler/translator/Compiler.cpp:1296:26 #12 0x57af45360cb6 in CompileFile third_party/angle/samples/shader_translator/shader_translator.cpp:524:15 #13 0x57af45360cb6 in main third_party/angle/samples/shader_translator/shader_translator.cpp:350:33 #14 0x7af4b1d09249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-buffer-overflow third_party/angle/src/compiler/translator/ConstantUnion.cpp:140:30 in sh::TConstantUnion::cast(sh::TBasicType, sh::TConstantUnion const&) Shadow bytes around the buggy address: 0x76f4aeffe580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x76f4aeffe600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x76f4aeffe680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x76f4aeffe700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x76f4aeffe780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x76f4aeffe800: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa 0x76f4aeffe880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x76f4aeffe900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x76f4aeffe980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x76f4aeffea00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x76f4aeffea80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==233==ABORTING