[773:773:0407/235004.629624:INFO:CONSOLE:8] "GL error before draw: 0x0", source: http://127.0.0.1:8080/poc.html (8) ================================================================= ==806==ERROR: AddressSanitizer: use-after-poison on address 0x7b9c283d5b00 at pc 0x564b6725f00b bp 0x7ffe3e6f7eb0 sp 0x7ffe3e6f7670 READ of size 16 at 0x7b9c283d5b00 thread T0 (chrome) #0 0x564b6725f00a in __asan_memcpy (/chromium/chromium/src/out/asan/chrome+0x10dcd00a) (BuildId: e093a1bbcc0dcd26) #1 0x7b9c4ddeeb7b in void rx::CopyNativeVertexData(unsigned char const*, unsigned long, unsigned long, unsigned char*) third_party/angle/src/libANGLE/renderer/copyvertex.inc.h:69:9 #2 0x7b9c4dd285c9 in rx::VertexArrayVk::updateStreamedAttribs(gl::Context const*, int, int, int, gl::DrawElementsType, void const*, angle::BitSetT<16ul, unsigned long, unsigned long>*) third_party/angle/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp:285:9 #3 0x7b9c4dbbbeeb in rx::ContextVk::setupDraw(gl::Context const*, gl::PrimitiveMode, int, int, int, gl::DrawElementsType, void const*, angle::BitSetT<43ul, unsigned long, unsigned long>) third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp:1536:34 #4 0x7b9c4dbc76a5 in rx::ContextVk::drawArraysInstanced(gl::Context const*, gl::PrimitiveMode, int, int, int) third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp:3874:15 #5 0x7b9c4e07a187 in gl::Context::drawArraysInstanced(gl::PrimitiveMode, int, int, int) third_party/angle/src/libANGLE/Context.cpp:2961:26 #6 0x564b88cca8b1 in gpu::gles2::GLES2DecoderPassthroughImpl::DoDrawArraysInstancedANGLE(unsigned int, int, int, int) gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc:4509:10 #7 0x564b88c536e5 in gpu::error::Error gpu::gles2::GLES2DecoderPassthroughImpl::DoCommandsImpl(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:745:20 #8 0x564b723bb814 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35 #9 0x564b8872008b in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector> const&) gpu/ipc/service/command_buffer_stub.cc:504:22 #10 0x564b8871f2f1 in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7 #11 0x564b887423dc in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:833:13 #12 0x564b887503c7 in void base::internal::DecayedFunctorTraits, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>::Invoke, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12 #13 0x564b887501a9 in base::internal::Invoker, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>, base::internal::BindState, gpu::FenceSyncReleaseDelegate*), base::WeakPtr, mojo::StructPtr>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5 #14 0x564b723fe211 in void base::internal::Invoker&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState, base::internal::UnretainedWrapper>, void ()>::RunImpl, std::__Cr::tuple>, 0ul>(base::OnceCallback&&, std::__Cr::tuple>&&, std::__Cr::integer_sequence) base/functional/callback.h:155:12 #15 0x564b723d2957 in gpu::Scheduler::ExecuteSequence(base::IdType) base/functional/callback.h:155:12 #16 0x564b723d0988 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:625:3 #17 0x564b723d4571 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #18 0x564b7f250326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #19 0x564b7f2c79c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #20 0x564b7f2c683a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #21 0x564b7f10e927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #22 0x564b7f2c90d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #23 0x564b7f1caca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #24 0x564b8aaba247 in content::GpuMain(content::MainFunctionParams) content/gpu/gpu_main.cc:484:14 #25 0x564b7ad69875 in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:762:14 #26 0x564b7ad6c728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10 #27 0x564b7ad66101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #28 0x564b7ad666fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 #29 0x564b6729bb39 in ChromeMain chrome/app/chrome_main.cc:191:12 #30 0x7f9c5882b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7b9c283d5b00 is located 768 bytes inside of 1048855-byte region [0x7b9c283d5800,0x7b9c284d5917) allocated by thread T0 (chrome) here: #0 0x564b67261324 in malloc (/chromium/chromium/src/out/asan/chrome+0x10dcf324) (BuildId: e093a1bbcc0dcd26) #1 0x7b9c4b96bf1d in sw::allocateZeroOrPoison(unsigned long, unsigned long) third_party/swiftshader/src/System/Memory.cpp:81:42 #2 0x7b9c4b47f3c4 in vk::DeviceMemory::allocateBuffer() third_party/swiftshader/src/Vulkan/VkDeviceMemory.cpp:342:11 #3 0x7b9c4b47e024 in vk::DeviceMemory::Allocate(VkAllocationCallbacks const*, VkMemoryAllocateInfo const*, VkNonDispatchableHandle*, vk::Device*) third_party/swiftshader/src/Vulkan/VkDeviceMemory.cpp:275:12 #4 0x7b9c4b4d36a7 in vkAllocateMemory third_party/swiftshader/src/Vulkan/libVulkan.cpp:1421:20 #5 0x7b9c4df13623 in rx::(anonymous namespace)::FindAndAllocateCompatibleMemory(rx::vk::ErrorContext*, rx::vk::MemoryAllocationType, rx::vk::MemoryProperties const&, unsigned int, unsigned int*, VkMemoryRequirements const&, void const*, unsigned int*, rx::vk::DeviceMemory*) third_party/angle/src/libANGLE/renderer/vulkan/vk_wrapper.h:1712:12 #6 0x7b9c4df0ea41 in rx::vk::AllocateBufferMemory(rx::vk::ErrorContext*, rx::vk::MemoryAllocationType, unsigned int, unsigned int*, void const*, rx::vk::Buffer*, unsigned int*, rx::vk::DeviceMemory*, unsigned long*) third_party/angle/src/libANGLE/renderer/vulkan/vk_utils.cpp:177:19 #7 0x7b9c4de1d47b in rx::vk::BufferPool::allocateNewBuffer(rx::vk::ErrorContext*, unsigned long) third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.cpp:3260:19 #8 0x7b9c4de1e2e8 in rx::vk::BufferPool::allocateBuffer(rx::vk::ErrorContext*, unsigned long, unsigned long, rx::vk::BufferSuballocation*) third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.cpp:3388:19 #9 0x7b9c4de2f1b7 in rx::vk::BufferHelper::initSuballocation(rx::vk::Context*, unsigned int, unsigned long, unsigned long, rx::BufferUsageType, rx::vk::BufferPool*) third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.cpp:4866:25 #10 0x7b9c4dbe3c1f in rx::ContextVk::initBufferAllocation(rx::vk::BufferHelper*, unsigned int, unsigned long, unsigned long, rx::BufferUsageType) third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp:6943:42 #11 0x7b9c4db77c96 in rx::BufferVk::setDataWithMemoryType(gl::Context const*, gl::BufferBinding, void const*, unsigned long, unsigned int, gl::BufferUsage, rx::BufferFeedback*) third_party/angle/src/libANGLE/renderer/vulkan/BufferVk.cpp:1347:20 #12 0x7b9c4db770d5 in rx::BufferVk::setDataWithUsageFlags(gl::Context const*, gl::BufferBinding, void*, void const*, unsigned long, gl::BufferUsage, unsigned int, gl::BufferStorage, rx::BufferFeedback*) third_party/angle/src/libANGLE/renderer/vulkan/BufferVk.cpp:487:12 #13 0x7b9c4e029e8e in gl::Buffer::setDataWithUsageFlags(gl::Context const*, gl::BufferBinding, void*, void const*, unsigned long, gl::BufferUsage, unsigned int, gl::BufferStorage) third_party/angle/src/libANGLE/Buffer.cpp:186:35 #14 0x7b9c4e0297fe in gl::Buffer::bufferDataImpl(gl::Context*, gl::BufferBinding, void const*, long, gl::BufferUsage, unsigned int, gl::BufferStorage) third_party/angle/src/libANGLE/Buffer.cpp:237:15 #15 0x7b9c4e029d45 in gl::Buffer::bufferData(gl::Context*, gl::BufferBinding, void const*, long, gl::BufferUsage) third_party/angle/src/libANGLE/Buffer.cpp:173:12 #16 0x564b88c9ba00 in gpu::gles2::GLES2DecoderPassthroughImpl::DoBufferData(unsigned int, long, void const*, unsigned int) gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc:618:10 #17 0x564b88c536e5 in gpu::error::Error gpu::gles2::GLES2DecoderPassthroughImpl::DoCommandsImpl(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:745:20 #18 0x564b723bb814 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35 #19 0x564b8872008b in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector> const&) gpu/ipc/service/command_buffer_stub.cc:504:22 #20 0x564b8871f2f1 in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7 #21 0x564b887423dc in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:833:13 #22 0x564b887503c7 in void base::internal::DecayedFunctorTraits, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>::Invoke, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12 #23 0x564b887501a9 in base::internal::Invoker, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>, base::internal::BindState, gpu::FenceSyncReleaseDelegate*), base::WeakPtr, mojo::StructPtr>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5 #24 0x564b723fe211 in void base::internal::Invoker&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState, base::internal::UnretainedWrapper>, void ()>::RunImpl, std::__Cr::tuple>, 0ul>(base::OnceCallback&&, std::__Cr::tuple>&&, std::__Cr::integer_sequence) base/functional/callback.h:155:12 #25 0x564b723d2957 in gpu::Scheduler::ExecuteSequence(base::IdType) base/functional/callback.h:155:12 #26 0x564b723d0988 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:625:3 #27 0x564b723d4571 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #28 0x564b7f250326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #29 0x564b7f2c79c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 SUMMARY: AddressSanitizer: use-after-poison (/chromium/chromium/src/out/asan/chrome+0x10dcd00a) (BuildId: e093a1bbcc0dcd26) in __asan_memcpy Shadow bytes around the buggy address: 0x7b9c283d5880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7b9c283d5900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7b9c283d5980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7b9c283d5a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7b9c283d5a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x7b9c283d5b00:[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x7b9c283d5b80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x7b9c283d5c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7b9c283d5c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7b9c283d5d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7b9c283d5d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb NOTE: the stack trace above identifies the code that *accessed* the poisoned memory. To identify the code that *poisoned* the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=. ==806==ADDITIONAL INFO ==806==Note: Please include this section with the ASan report. Task trace: #0 0x564b723cbbb6 in gpu::Scheduler::TryScheduleSequence(gpu::Scheduler::Sequence*) gpu/command_buffer/service/scheduler.cc:432:29 Command line: `/proc/self/exe --type=gpu-process --disable-gpu-sandbox --no-sandbox --headless=new --ozone-platform=headless --use-angle=swiftshader --enable-unsafe-swiftshader --crashpad-handler-pid=775 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --gpu-preferences=UAAAAAAAAAAoAAAEAAAAAAAAAAAAAMAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAYAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --shared-files --field-trial-handle=3,i,2496900577545009638,666529947968689181,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,14875111021868573627,6913563280663495109,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=stderr --v=0 --no-first-run --ozone-platform=headless --ozone-override-screen-size=800,600` ==806==END OF ADDITIONAL INFO ==806==ABORTING [851:851:0407/235009.043802:ERROR:gpu/ipc/client/command_buffer_proxy_impl.cc:488] GPU state invalid after WaitForGetOffsetInRange. [773:773:0407/235009.047953:ERROR:content/browser/gpu/gpu_process_host.cc:999] GPU process exited unexpectedly: exit_code=256 [773:773:0407/235009.048125:WARNING:content/browser/gpu/gpu_process_host.cc:1441] The GPU process has crashed 1 time(s) [773:773:0407/235009.108681:INFO:CONSOLE:8] "GL error after draw: 0x0", source: http://127.0.0.1:8080/poc.html (8) [773:773:0407/235009.111004:INFO:CONSOLE:8] "draw issued; if instrumented, ASAN should report heap-buffer-overflow in StreamVertexDataWithDivisor", source: http://127.0.0.1:8080/poc.html (8) [773:773:0407/235009.291913:INFO:CONSOLE:77] "WebGL: CONTEXT_LOST_WEBGL: loseContext: context lost", source: http://127.0.0.1:8080/poc.html (77) [898:898:0407/235009.726290:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. [773:773:0407/235009.753177:WARNING:content/browser/gpu/gpu_process_host.cc:1021] Reinitialized the GPU process after a crash. The reported initialization time was 152 ms [773:788:0407/235013.160604:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT [773:788:0407/235038.894417:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT