==========================================================================
Test 1: Direct GetSharedMemoryPixmaps() type confusion
==========================================================================
Note: Google Test filter = CompoundImageBackingTest.TypeConfusion_WrapExternalBacking_GetSharedMemoryPixmaps
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from CompoundImageBackingTest
[ RUN      ] CompoundImageBackingTest.TypeConfusion_WrapExternalBacking_GetSharedMemoryPixmaps
=================================================================
==4143==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c70613ee018 at pc 0x5649d1dc20cf bp 0x7ffd37ccd8b0 sp 0x7ffd37ccd8a8
READ of size 8 at 0x7c70613ee018 thread T0
    #0 0x5649d1dc20ce in gpu::CompoundImageBackingTest_TypeConfusion_WrapExternalBacking_GetSharedMemoryPixmaps_Test::TestBody() gen/third_party/libc++/src/include/__vector/vector.h:393:41
    #1 0x5649d4de677b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #2 0x5649d4de9427 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #3 0x5649d4deb533 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #4 0x5649d4e1b38a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #5 0x5649d4e19dee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #6 0x5649d76b6a3c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #7 0x5649d1833cb1 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), (anonymous namespace)::GpuTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<(anonymous namespace)::GpuTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #8 0x5649d76c260b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #9 0x5649d76c1f2b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #10 0x5649d18339a7 in main gpu/command_buffer/common/unittest_main.cc:38:10
    #11 0x7f5062a45249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7c70613ee018 is located 208 bytes after 264-byte region [0x7c70613ede40,0x7c70613edf48)
allocated by thread T0 here:
    #0 0x5649d12db93d in operator new(unsigned long) (/chromium/chromium/src/out/asan/gpu_unittests+0x4bac93d) (BuildId: f4884e5ad113aa57)
    #1 0x5649d1dc1f46 in gpu::CompoundImageBackingTest_TypeConfusion_WrapExternalBacking_GetSharedMemoryPixmaps_Test::TestBody() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x5649d4de677b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x5649d4de9427 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x5649d4deb533 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x5649d4e1b38a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x5649d4e19dee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x5649d76b6a3c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x5649d1833cb1 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), (anonymous namespace)::GpuTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<(anonymous namespace)::GpuTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x5649d76c260b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x5649d76c1f2b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x5649d18339a7 in main gpu/command_buffer/common/unittest_main.cc:38:10
    #12 0x7f5062a45249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-buffer-overflow gen/third_party/libc++/src/include/__vector/vector.h:393:41 in gpu::CompoundImageBackingTest_TypeConfusion_WrapExternalBacking_GetSharedMemoryPixmaps_Test::TestBody()
Shadow bytes around the buggy address:
  0x7c70613edd80: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x7c70613ede00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x7c70613ede80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c70613edf00: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
  0x7c70613edf80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x7c70613ee000: fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c70613ee080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c70613ee100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c70613ee180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c70613ee200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c70613ee280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==4143==ADDITIONAL INFO

==4143==Note: Please include this section with the ASan report.
Task trace:


==4143==END OF ADDITIONAL INFO

==4143==ABORTING

==========================================================================
Test 2: CopyToGpuMemoryBufferAsync IPC path (Windows-reachable from renderer)
==========================================================================
Note: Google Test filter = CompoundImageBackingTest.TypeConfusion_WrapExternalBacking_CopyToGpuMemoryBufferAsync
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from CompoundImageBackingTest
[ RUN      ] CompoundImageBackingTest.TypeConfusion_WrapExternalBacking_CopyToGpuMemoryBufferAsync
=================================================================
==4145==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c5612dee318 at pc 0x555cda20e3b0 bp 0x7fffb8b71a10 sp 0x7fffb8b71a08
READ of size 8 at 0x7c5612dee318 thread T0
    #0 0x555cda20e3af in gpu::(anonymous namespace)::DereferencingGpuBacking::ReadbackToMemory(std::__Cr::vector<SkPixmap, std::__Cr::allocator<SkPixmap>> const&) gen/third_party/libc++/src/include/__vector/vector.h:393:41
    #1 0x555ce45824c3 in gpu::SharedImageBacking::ReadbackToMemoryAsync(std::__Cr::vector<SkPixmap, std::__Cr::allocator<SkPixmap>> const&, base::OnceCallback<void (bool)>) gpu/command_buffer/service/shared_image/shared_image_backing.cc:144:27
    #2 0x555ce4574e4d in gpu::CompoundImageBacking::CopyToGpuMemoryBufferAsync(base::OnceCallback<void (bool)>) gpu/command_buffer/service/shared_image/compound_image_backing.cc:1225:16
    #3 0x555cda20834e in gpu::CompoundImageBackingTest_TypeConfusion_WrapExternalBacking_CopyToGpuMemoryBufferAsync_Test::TestBody() gpu/command_buffer/service/shared_image/compound_image_backing_unittest.cc:695:13
    #4 0x555cdd22b77b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #5 0x555cdd22e427 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #6 0x555cdd230533 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #7 0x555cdd26038a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #8 0x555cdd25edee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #9 0x555cdfafba3c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #10 0x555cd9c78cb1 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), (anonymous namespace)::GpuTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<(anonymous namespace)::GpuTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #11 0x555cdfb0760b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #12 0x555cdfb06f2b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #13 0x555cd9c789a7 in main gpu/command_buffer/common/unittest_main.cc:38:10
    #14 0x7f3614445249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7c5612dee318 is located 208 bytes after 264-byte region [0x7c5612dee140,0x7c5612dee248)
allocated by thread T0 here:
    #0 0x555cd972093d in operator new(unsigned long) (/chromium/chromium/src/out/asan/gpu_unittests+0x4bac93d) (BuildId: f4884e5ad113aa57)
    #1 0x555cda20817f in gpu::CompoundImageBackingTest_TypeConfusion_WrapExternalBacking_CopyToGpuMemoryBufferAsync_Test::TestBody() gen/third_party/libc++/src/include/__memory/unique_ptr.h:756:26
    #2 0x555cdd22b77b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #3 0x555cdd22e427 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #4 0x555cdd230533 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #5 0x555cdd26038a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #6 0x555cdd25edee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #7 0x555cdfafba3c in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #8 0x555cd9c78cb1 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), (anonymous namespace)::GpuTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<(anonymous namespace)::GpuTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #9 0x555cdfb0760b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #10 0x555cdfb06f2b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #11 0x555cd9c789a7 in main gpu/command_buffer/common/unittest_main.cc:38:10
    #12 0x7f3614445249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-buffer-overflow gen/third_party/libc++/src/include/__vector/vector.h:393:41 in gpu::(anonymous namespace)::DereferencingGpuBacking::ReadbackToMemory(std::__Cr::vector<SkPixmap, std::__Cr::allocator<SkPixmap>> const&)
Shadow bytes around the buggy address:
  0x7c5612dee080: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
  0x7c5612dee100: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x7c5612dee180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c5612dee200: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
  0x7c5612dee280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x7c5612dee300: fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c5612dee380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c5612dee400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c5612dee480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c5612dee500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c5612dee580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==4145==ADDITIONAL INFO

==4145==Note: Please include this section with the ASan report.
Task trace:


==4145==END OF ADDITIONAL INFO

==4145==ABORTING