=================================================================
==345063==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x778695bbb000 at pc 0x5ce65edb700b bp 0x7ffcce9e7d10 sp 0x7ffcce9e74d0
READ of size 25165824 at 0x778695bbb000 thread T0 (chrome)
    #0 0x5ce65edb700a in __asan_memcpy (/home/test/Desktop/chromium/src/out/asan/chrome+0x10d2400a) (BuildId: e191f33f940a09e4)
    #1 0x77875f943833 in void angle::LoadToNative<unsigned char, 4ul>(angle::ImageLoadContext const&, unsigned long, unsigned long, unsigned long, unsigned char const*, unsigned long, unsigned long, unsigned char*, unsigned long, unsigned long) third_party/angle/src/image_util/loadimage.inc
    #2 0x77875f43484e in rx::vk::ImageHelper::stageSubresourceUpdateImpl(rx::ContextVk*, gl::ImageIndex const&, angle::Extents<int> const&, angle::Offset<int> const&, gl::InternalFormat const&, gl::PixelUnpackState const&, unsigned int, unsigned char const*, rx::vk::Format const&, rx::vk::ImageFormatSupport, unsigned int, unsigned int, unsigned int, rx::vk::ApplyImageUpdate, bool*) third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.cpp:8538:5
    #3 0x77875f2a8c34 in rx::TextureVk::setSubImageImpl(gl::Context const*, gl::ImageIndex const&, gl::Box const&, gl::InternalFormat const&, unsigned int, gl::PixelUnpackState const&, gl::Buffer*, unsigned char const*, rx::vk::Format const&) third_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cpp:1310:31
    #4 0x77875f2a7b2f in rx::TextureVk::setSubImage(gl::Context const*, gl::ImageIndex const&, gl::Box const&, unsigned int, unsigned int, gl::PixelUnpackState const&, gl::Buffer*, unsigned char const*) third_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cpp:616:12
    #5 0x77875f84b246 in gl::Texture::setSubImage(gl::Context*, gl::PixelUnpackState const&, gl::Buffer*, gl::TextureTarget, int, gl::Box const&, unsigned int, unsigned int, unsigned char const*) third_party/angle/src/libANGLE/Texture.cpp:1441:25
    #6 0x77875f679213 in gl::Context::texSubImage3D(gl::TextureTarget, int, int, int, int, int, int, int, unsigned int, unsigned int, void const*) third_party/angle/src/libANGLE/Context.cpp:5696:32
    #7 0x77875f679334 in gl::Context::texSubImage3DRobust(gl::TextureTarget, int, int, int, int, int, int, int, unsigned int, unsigned int, int, void const*) third_party/angle/src/libANGLE/Context.cpp:5714:5
    #8 0x77875f13f0a2 in GL_TexSubImage3DRobustANGLE third_party/angle/src/libGLESv2/entry_points_gles_ext_autogen.cpp:3569:22
    #9 0x5ce67a62e444 in gl::GLApiBase::glTexSubImage3DRobustANGLEFn(unsigned int, int, int, int, int, int, int, int, unsigned int, unsigned int, int, void const*) ui/gl/gl_bindings_autogen_gl.cc:4286:3
    #10 0x5ce68035027a in gpu::gles2::GLES2DecoderPassthroughImpl::DoTexSubImage3D(unsigned int, int, int, int, int, int, int, int, unsigned int, unsigned int, int, void const*) gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc:3058:10
    #11 0x5ce6804f3ae6 in gpu::gles2::GLES2DecoderPassthroughImpl::HandleTexSubImage3D(unsigned int, void const volatile*) gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc:1174:10
    #12 0x5ce6802e9a25 in gpu::error::Error gpu::gles2::GLES2DecoderPassthroughImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:742:20
    #13 0x5ce669b07814 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35
    #14 0x5ce67fdb4eeb in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&) gpu/ipc/service/command_buffer_stub.cc:504:22
    #15 0x5ce67fdb4151 in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7
    #16 0x5ce67fdd723c in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:833:13
    #17 0x5ce67fde5227 in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12
    #18 0x5ce67fde5009 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5
    #19 0x5ce669b4a211 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) base/functional/callback.h:155:12
    #20 0x5ce669b1e957 in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>) base/functional/callback.h:155:12
    #21 0x5ce669b1c988 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:625:3
    #22 0x5ce669b20571 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(), gpu::Scheduler*>, base::internal::BindState<true, true, false, void (gpu::Scheduler::*)(), base::internal::UnretainedWrapper<gpu::Scheduler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #23 0x5ce676826826 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #24 0x5ce67689e039 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #25 0x5ce67689ceaa in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40
    #26 0x5ce676a4b3d8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #27 0x5ce676a4e998 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #28 0x7b876cb21d3a in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) (BuildId: 6b4f160dbc5397c2f502dc4f08a8cff259917926)

0x778695bbb000 is located 6144 bytes before 4194307-byte region [0x778695bbc800,0x778695fbc803)
allocated by thread T0 (chrome) here:
    #0 0x5ce65edb9324 in malloc (/home/test/Desktop/chromium/src/out/asan/chrome+0x10d26324) (BuildId: e191f33f940a09e4)
    #1 0x778760c3131e in angle::ScratchBuffer::getImpl(unsigned long, angle::MemoryBuffer**, Optional<unsigned char>) third_party/angle/src/common/MemoryBuffer.cpp:56:49
    #2 0x778760c3167d in angle::ScratchBuffer::getInitialized(unsigned long, angle::MemoryBuffer**, unsigned char) third_party/angle/src/common/MemoryBuffer.cpp:146:12
    #3 0x77875f67f626 in gl::Context::getZeroFilledBuffer(unsigned long, angle::MemoryBuffer**) const third_party/angle/src/libANGLE/Context.cpp:6675:38
    #4 0x77875f61460f in gl::Buffer::bufferDataImpl(gl::Context*, gl::BufferBinding, void const*, long, gl::BufferUsage, unsigned int, gl::BufferStorage) third_party/angle/src/libANGLE/Buffer.cpp:233:31
    #5 0x77875f614be5 in gl::Buffer::bufferData(gl::Context*, gl::BufferBinding, void const*, long, gl::BufferUsage) third_party/angle/src/libANGLE/Buffer.cpp:173:12
    #6 0x5ce680331d40 in gpu::gles2::GLES2DecoderPassthroughImpl::DoBufferData(unsigned int, long, void const*, unsigned int) gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc:616:10
    #7 0x5ce6802e9a25 in gpu::error::Error gpu::gles2::GLES2DecoderPassthroughImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:742:20
    #8 0x5ce669b07814 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35
    #9 0x5ce67fdb4eeb in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&) gpu/ipc/service/command_buffer_stub.cc:504:22
    #10 0x5ce67fdb4151 in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7
    #11 0x5ce67fdd723c in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:833:13
    #12 0x5ce67fde5227 in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12
    #13 0x5ce67fde5009 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5
    #14 0x5ce669b4a211 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) base/functional/callback.h:155:12
    #15 0x5ce669b1e957 in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>) base/functional/callback.h:155:12
    #16 0x5ce669b1c988 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:625:3
    #17 0x5ce669b20571 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(), gpu::Scheduler*>, base::internal::BindState<true, true, false, void (gpu::Scheduler::*)(), base::internal::UnretainedWrapper<gpu::Scheduler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #18 0x5ce676826826 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #19 0x5ce67689e039 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #20 0x5ce67689ceaa in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40
    #21 0x5ce676a4b3d8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46
    #22 0x5ce676a4e998 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43
    #23 0x7b876cb21d3a in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) (BuildId: 6b4f160dbc5397c2f502dc4f08a8cff259917926)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/test/Desktop/chromium/src/out/asan/chrome+0x10d2400a) (BuildId: e191f33f940a09e4) in __asan_memcpy
Shadow bytes around the buggy address:
  0x778695bbad80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x778695bbae00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x778695bbae80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x778695bbaf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x778695bbaf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x778695bbb000:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x778695bbb080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x778695bbb100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x778695bbb180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x778695bbb200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x778695bbb280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==345063==ADDITIONAL INFO

==345063==Note: Please include this section with the ASan report.
Task trace:
    #0 0x5ce669b1ce62 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:647:27
    #1 0x5ce669b17bb6 in gpu::Scheduler::TryScheduleSequence(gpu::Scheduler::Sequence*) gpu/command_buffer/service/scheduler.cc:432:29

==345063==END OF ADDITIONAL INFO

==345063==ABORTING
[345017:345017:0322/231519.345781:ERROR:gpu/ipc/client/command_buffer_proxy_impl.cc:488] GPU state invalid after WaitForGetOffsetInRange.
[345017:345017:0322/231519.346662:ERROR:gpu/ipc/client/command_buffer_proxy_impl.cc:488] GPU state invalid after WaitForGetOffsetInRange.
[345017:345017:0322/231519.367928:ERROR:content/browser/gpu/gpu_process_host.cc:999] GPU process exited unexpectedly: exit_code=256