[3970506:3970506:0402/193603.199198:WARNING:chrome/browser/signin/account_consistency_mode_manager.cc:74] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured. [3970565:3970565:0402/193605.173193:ERROR:media/gpu/vaapi/vaapi_wrapper.cc:1680] Installed VAAPI version is too old. min supported version: 1.17 installed version: 1.14 [3970565:3970565:0402/193605.236984:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. ================================================================= ==3970565==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c066affe200 at pc 0x7b065306c636 bp 0x7b0642c783f0 sp 0x7b0642c783e8 READ of size 4 at 0x7c066affe200 thread T11 #0 0x7b065306c635 in get_output_as_const_value /home/users/mesa-asan/build/../src/gallium/drivers/radeonsi/si_nir_optim.c:100:64 #1 0x7b065306c635 in si_nir_is_output_const_if_tex_is_const /home/users/mesa-asan/build/../src/gallium/drivers/radeonsi/si_nir_optim.c:192:11 #2 0x7b0652e9e1d0 in si_check_blend_dst_sampler_noop /home/users/mesa-asan/build/../src/gallium/drivers/radeonsi/si_state.c:587:14 #3 0x7b0652e9ddb5 in si_draw_blend_dst_sampler_noop /home/users/mesa-asan/build/../src/gallium/drivers/radeonsi/si_state.c:625:9 #4 0x7b0652b6c664 in tc_call_draw_single /home/users/mesa-asan/build/../src/gallium/auxiliary/util/u_threaded_context.c:3855:4 #5 0x7b0652b6c664 in batch_execute /home/users/mesa-asan/build/../src/gallium/auxiliary/util/u_threaded_context_calls.h:11:1 #6 0x7b0652b6c664 in tc_batch_execute /home/users/mesa-asan/build/../src/gallium/auxiliary/util/u_threaded_context.c:5376:7 #7 0x7b06524c3b12 in util_queue_thread_func /home/users/mesa-asan/build/../src/util/u_queue.c:294:10 #8 0x7b065254088c in impl_thrd_routine /home/users/mesa-asan/build/../src/c11/impl/threads_posix.c:43:29 #9 0x555a370ded46 in asan_thread_start(void*) asan_interceptors.cpp 0x7c066affe200 is located 0 bytes after 128-byte region [0x7c066affe180,0x7c066affe200) allocated by thread T11 here: #0 0x555a370e1424 in malloc (/home/users/chromium/src/out/asan-release/chrome+0x66eb424) (BuildId: 6d04d036f54ba904) #1 0x7b06524aac07 in ralloc_size /home/users/mesa-asan/build/../src/util/ralloc.c:118:18 #2 0x7b06524aac07 in gc_alloc_size /home/users/mesa-asan/build/../src/util/ralloc.c:870:16 #3 0x7b06524ab28e in gc_zalloc_size /home/users/mesa-asan/build/../src/util/ralloc.c:893:16 #4 0x7b06525516e9 in nir_instr_create /home/users/mesa-asan/build/../src/compiler/nir/nir.c:803:15 #5 0x7b06525516e9 in nir_load_const_instr_create /home/users/mesa-asan/build/../src/compiler/nir/nir.c:872:7 #6 0x7b065265cca0 in nir_build_imm /home/users/mesa-asan/build/../src/compiler/nir/nir_builder.h:349:7 #7 0x7b065265cca0 in nir_try_constant_fold_alu /home/users/mesa-asan/build/../src/compiler/nir/nir_opt_constant_folding.c:84:11 #8 0x7b065265d24f in try_fold_instr /home/users/mesa-asan/build/../src/compiler/nir/nir_opt_constant_folding.c:509:14 #9 0x7b065255e608 in nir_function_impl_lower_instructions /home/users/mesa-asan/build/../src/compiler/nir/nir.c:2332:26 #10 0x7b065255ec8a in nir_shader_lower_instructions /home/users/mesa-asan/build/../src/compiler/nir/nir.c:2378:11 #11 0x7b065265cfd2 in nir_opt_constant_folding /home/users/mesa-asan/build/../src/compiler/nir/nir_opt_constant_folding.c:527:20 #12 0x7b065306bb77 in si_nir_is_output_const_if_tex_is_const /home/users/mesa-asan/build/../src/gallium/drivers/radeonsi/si_nir_optim.c:188:37 #13 0x7b0652e9e1d0 in si_check_blend_dst_sampler_noop /home/users/mesa-asan/build/../src/gallium/drivers/radeonsi/si_state.c:587:14 #14 0x7b0652e9ddb5 in si_draw_blend_dst_sampler_noop /home/users/mesa-asan/build/../src/gallium/drivers/radeonsi/si_state.c:625:9 #15 0x7b0652b6c664 in tc_call_draw_single /home/users/mesa-asan/build/../src/gallium/auxiliary/util/u_threaded_context.c:3855:4 #16 0x7b0652b6c664 in batch_execute /home/users/mesa-asan/build/../src/gallium/auxiliary/util/u_threaded_context_calls.h:11:1 #17 0x7b0652b6c664 in tc_batch_execute /home/users/mesa-asan/build/../src/gallium/auxiliary/util/u_threaded_context.c:5376:7 #18 0x7b06524c3b12 in util_queue_thread_func /home/users/mesa-asan/build/../src/util/u_queue.c:294:10 #19 0x7b065254088c in impl_thrd_routine /home/users/mesa-asan/build/../src/c11/impl/threads_posix.c:43:29 #20 0x555a370ded46 in asan_thread_start(void*) asan_interceptors.cpp Thread T11 created by T0 (chrome) here: #0 0x555a370c4b71 in pthread_create (/home/users/chromium/src/out/asan-release/chrome+0x66ceb71) (BuildId: 6d04d036f54ba904) #1 0x7b0652540817 in thrd_create /home/users/mesa-asan/build/../src/c11/impl/threads_posix.c:255:9 #2 0x7b06524c51f9 in u_thread_create /home/users/mesa-asan/build/../src/util/u_thread.c:62:10 #3 0x7b06524c205e in util_queue_create_thread /home/users/mesa-asan/build/../src/util/u_queue.c:328:24 #4 0x7b06524c205e in util_queue_init /home/users/mesa-asan/build/../src/util/u_queue.c:454:12 #5 0x7b0652b44bab in threaded_context_create /home/users/mesa-asan/build/../src/gallium/auxiliary/util/u_threaded_context.c:5551:9 #6 0x7b0652e37d34 in si_pipe_create_context /home/users/mesa-asan/build/../src/gallium/drivers/radeonsi/si_pipe.c:1001:7 #7 0x7b065158ad17 in st_api_create_context /home/users/mesa-asan/build/../src/mesa/state_tracker/st_manager.c:974:11 #8 0x7b065142a756 in dri_create_context /home/users/mesa-asan/build/../src/gallium/frontends/dri/dri_context.c:180:14 #9 0x7b0651437de3 in driCreateContextAttribs /home/users/mesa-asan/build/../src/gallium/frontends/dri/dri_util.c:596:31 #10 0x7b0660179126 in dri_create_context_attribs /home/users/mesa-asan/build/../src/glx/dri_common.c:884:7 #11 0x7b0660175ff0 in glXCreateContextAttribsARB /home/users/mesa-asan/build/../src/glx/create_context.c:131:12 #12 0x7b0665537a83 (/lib/x86_64-linux-gnu/libGLX.so.0+0x1ba83) (BuildId: ac8b68a74f1ead77477f89bc98998ecb064e3ae5) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/users/mesa-asan/build/../src/gallium/drivers/radeonsi/si_nir_optim.c:100:64 in get_output_as_const_value Shadow bytes around the buggy address: 0x7c066affdf80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c066affe000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x7c066affe080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c066affe100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x7c066affe180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x7c066affe200:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c066affe280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c066affe300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c066affe380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c066affe400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c066affe480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3970565==ADDITIONAL INFO ==3970565==Note: Please include this section with the ASan report. Task trace: Command line: `/proc/self/exe --type=gpu-process --disable-gpu-sandbox --no-sandbox --ozone-platform=x11 --crashpad-handler-pid=3970527 --enable-crash-reporter=, --user-data-dir=/tmp/poc-mesa004-final-1775129759 --change-stack-guard-on-fork=enable --gpu-preferences=UAAAAAAAAAAgAQAEAAAAAAAAAAAAAMAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAYAAAAAAAAABgAAAAAAAAAAQAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --shared-files --metrics-shmem-handle=4,i,8575178038125073993,15980960316371392458,262144 --field-trial-handle=3,i,13955772617453897034,199358431328383033,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,18235672311759765448,12085563717324738996,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=stderr` ==3970565==END OF ADDITIONAL INFO ==3970565==ABORTING [3970506:3970506:0402/193606.416524:ERROR:content/browser/gpu/gpu_process_host.cc:999] GPU process exited unexpectedly: exit_code=256 [3970506:3970506:0402/193606.416639:WARNING:content/browser/gpu/gpu_process_host.cc:1441] The GPU process has crashed 1 time(s) [3970506:3970506:0402/193606.449549:INFO:CONSOLE:0] "WebGL: CONTEXT_LOST_WEBGL: loseContext: context lost", source: file:///home/users/chromium/src/issue_mesa_noop_blend_oob/poc.html (0) [3970696:3970696:0402/193608.618228:ERROR:media/gpu/vaapi/vaapi_wrapper.cc:1680] Installed VAAPI version is too old. min supported version: 1.17 installed version: 1.14 [3970696:3970696:0402/193608.680568:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [3970506:3970506:0402/193608.698373:WARNING:content/browser/gpu/gpu_process_host.cc:1021] Reinitialized the GPU process after a crash. The reported initialization time was 652 ms