Note: Google Test filter = GraphiteDawnBindGroupUafTest.* [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from GraphiteDawnBindGroupUafTest [ RUN ] GraphiteDawnBindGroupUafTest.StaleBindGroupOnUniqueIDWrap [5468:5468:ERROR:gpu/command_buffer/service/graphite_dawn_bindgroup_uaf_unittest.cc:248] [POC] Cached BindGroup 0x7d451c48f128 for T1 (uniqueID=59, view=0x7c451c4b1280) [5468:5468:ERROR:gpu/command_buffer/service/graphite_dawn_bindgroup_uaf_unittest.cc:281] [POC] Created T2 (uniqueID=59, view=0x7c451c4b1500) -- collides with T1's ID [5468:5468:ERROR:gpu/command_buffer/service/graphite_dawn_bindgroup_uaf_unittest.cc:296] [POC] Lookup for T2 returned BindGroup 0x7d451c48f1d0 (T1's was 0x7d451c48f128) ../../gpu/command_buffer/service/graphite_dawn_bindgroup_uaf_unittest.cc:303: Failure Expected equality of these values: bg1.Get() Which is: 0x7d451c48f128 bg2.Get() Which is: 0x7d451c48f1d0 If these differ the cache was correctly invalidated; the vulnerability is that they are equal. Stack trace: #0 0x55a945012dc7 (/chromium/chromium/src/out/asan/gpu_unittests+0x5b90dc6) [5468:5468:ERROR:gpu/command_buffer/service/graphite_dawn_bindgroup_uaf_unittest.cc:319] [POC] Drawing with stale BindGroup (samples freed VkImageView)... [5468:5468:ERROR:gpu/command_buffer/service/graphite_dawn_bindgroup_uaf_unittest.cc:323] [POC] Draw with stale BindGroup completed without ASAN/SEGV (on hardware: GPU memory disclosed via readback) [ FAILED ] GraphiteDawnBindGroupUafTest.StaleBindGroupOnUniqueIDWrap (108 ms) [----------] 1 test from GraphiteDawnBindGroupUafTest (108 ms total) [----------] Global test environment tear-down [==========] 1 test from 1 test suite ran. (109 ms total) [ PASSED ] 0 tests. [ FAILED ] 1 test, listed below: [ FAILED ] GraphiteDawnBindGroupUafTest.StaleBindGroupOnUniqueIDWrap 1 FAILED TEST