Warning: Unused argument: --single-process-tests Note: Google Test filter = WriteBufferOOMDesync.* [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from WriteBufferOOMDesync [ RUN ] WriteBufferOOMDesync.FreeCommandsTypeConfusion [POC] CommandAllocator stream is missing the kAdditionalData marker for [POC] the size=0 WriteBuffer. Calling FreeCommands(); expect type [POC] confusion → Ref::Release() on forged pointer 0x797c503f09c0 ... ================================================================= ==1397==ERROR: AddressSanitizer: heap-use-after-free on address 0x797c503f09c8 at pc 0x59bc1abf4bc0 bp 0x7ffd13acea20 sp 0x7ffd13acea18 WRITE of size 8 at 0x797c503f09c8 thread T0 #0 0x59bc1abf4bbf in dawn::RefCounted::Release() third_party/libc++/src/include/__atomic/support/c11.h:207:10 #1 0x59bc1926796e in dawn::native::FreeCommands(dawn::native::CommandIterator*) third_party/dawn/src/dawn/common/Ref.h:50:44 #2 0x59bc188138bf in dawn::native::(anonymous namespace)::WriteBufferOOMDesync_FreeCommandsTypeConfusion_Test::TestBody() third_party/dawn/src/dawn/tests/unittests/native/WriteBufferOOMDesyncTests.cpp:207:5 #3 0x59bc1a076ebb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #4 0x59bc1a079b17 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #5 0x59bc1a07bc13 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #6 0x59bc1a0ab05a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #7 0x59bc1a0a9b2e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x59bc1b17dbbc in base::TestSuite::Run() base/test/test_suite.cc:440:16 #9 0x59bc198cd326 in (anonymous namespace)::RunHelper(base::TestSuite*) gpu/dawn_unittests_main.cc:17:22 #10 0x59bc198cd53e in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #11 0x59bc1b3f849b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #12 0x59bc1b3f8df4 in base::LaunchUnitTestsSerially(int, char**, base::OnceCallback) base/test/launcher/unit_test_launcher.cc:347:10 #13 0x59bc198cd15a in main gpu/dawn_unittests_main.cc:31:12 #14 0x7cbc51393249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x797c503f09c8 is located 8 bytes inside of 128-byte region [0x797c503f09c0,0x797c503f0a40) freed by thread T0 here: #0 0x59bc17b0154a in free (/chromium/chromium/src/out/asan/dawn_unittests+0x1fe054a) (BuildId: aa7efb3aeee5e843) #1 0x59bc18811cfd in dawn::native::(anonymous namespace)::WriteBufferOOMDesync_FreeCommandsTypeConfusion_Test::TestBody() third_party/dawn/src/dawn/tests/unittests/native/WriteBufferOOMDesyncTests.cpp:65:5 #2 0x59bc1a076ebb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x59bc1a079b17 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x59bc1a07bc13 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x59bc1a0ab05a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x59bc1a0a9b2e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x59bc1b17dbbc in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x59bc198cd326 in (anonymous namespace)::RunHelper(base::TestSuite*) gpu/dawn_unittests_main.cc:17:22 #9 0x59bc198cd53e in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #10 0x59bc1b3f849b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #11 0x59bc1b3f8df4 in base::LaunchUnitTestsSerially(int, char**, base::OnceCallback) base/test/launcher/unit_test_launcher.cc:347:10 #12 0x59bc198cd15a in main gpu/dawn_unittests_main.cc:31:12 #13 0x7cbc51393249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x59bc17b01b18 in malloc (/chromium/chromium/src/out/asan/dawn_unittests+0x1fe0b18) (BuildId: aa7efb3aeee5e843) #1 0x59bc18811b0b in dawn::native::(anonymous namespace)::WriteBufferOOMDesync_FreeCommandsTypeConfusion_Test::TestBody() third_party/dawn/src/dawn/tests/unittests/native/WriteBufferOOMDesyncTests.cpp:49:15 #2 0x59bc1a076ebb in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x59bc1a079b17 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x59bc1a07bc13 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x59bc1a0ab05a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x59bc1a0a9b2e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x59bc1b17dbbc in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x59bc198cd326 in (anonymous namespace)::RunHelper(base::TestSuite*) gpu/dawn_unittests_main.cc:17:22 #9 0x59bc198cd53e in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #10 0x59bc1b3f849b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #11 0x59bc1b3f8df4 in base::LaunchUnitTestsSerially(int, char**, base::OnceCallback) base/test/launcher/unit_test_launcher.cc:347:10 #12 0x59bc198cd15a in main gpu/dawn_unittests_main.cc:31:12 #13 0x7cbc51393249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free third_party/libc++/src/include/__atomic/support/c11.h:207:10 in dawn::RefCounted::Release() Shadow bytes around the buggy address: 0x797c503f0700: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x797c503f0780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x797c503f0800: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x797c503f0880: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa 0x797c503f0900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x797c503f0980: fa fa fa fa fa fa fa fa fd[fd]fd fd fd fd fd fd 0x797c503f0a00: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x797c503f0a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x797c503f0b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x797c503f0b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x797c503f0c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1397==ADDITIONAL INFO ==1397==Note: Please include this section with the ASan report. Task trace: ==1397==END OF ADDITIONAL INFO ==1397==ABORTING