Note: Google Test filter = GraphiteBufferManagerStaleTransferTest.* [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from GraphiteBufferManagerStaleTransferTest [ RUN ] GraphiteBufferManagerStaleTransferTest.StaleTransferBufferAfterFailedSnap [POC] requesting uniform buffer; if the bug is present, the stale allocator with dangling fTransferBuffer/fMappedPtr is reused [POC] writing through stale fMappedPtr [POC] inserting recording with CopyBufferToBufferTask carrying freed Buffer* ================================================================= ==2496==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c4057bf02f8 at pc 0x61fd3b0e0f8e bp 0x7ffe6bb84d50 sp 0x7ffe6bb84d48 READ of size 8 at 0x7c4057bf02f8 thread T0 #0 0x61fd3b0e0f8d in skgpu::graphite::DawnCommandBuffer::onCopyBufferToBuffer(skgpu::graphite::Buffer const*, unsigned long, skgpu::graphite::Buffer const*, unsigned long, unsigned long) gen/third_party/dawn/include/dawn/webgpu_cpp.h:1230:16 #1 0x61fd3aeff54d in skgpu::graphite::CommandBuffer::copyBufferToBuffer(skgpu::graphite::Buffer const*, unsigned long, sk_sp, unsigned long, unsigned long) third_party/skia/src/gpu/graphite/CommandBuffer.cpp:209:16 #2 0x61fd3b090e74 in skgpu::graphite::CopyBufferToBufferTask::addCommands(skgpu::graphite::Context*, skgpu::graphite::CommandBuffer*, skgpu::graphite::Task::ReplayTargetData) third_party/skia/src/gpu/graphite/task/CopyTask.cpp:60:24 #3 0x61fd3b096c40 in skgpu::graphite::TaskList::addCommands(skgpu::graphite::Context*, skgpu::graphite::CommandBuffer*, skgpu::graphite::Task::ReplayTargetData) third_party/skia/src/gpu/graphite/task/TaskList.cpp:57:22 #4 0x61fd3afdf373 in skgpu::graphite::RecordingPriv::addCommands(skgpu::graphite::Context*, skgpu::graphite::CommandBuffer*, skgpu::graphite::Texture const*, SkIPoint, SkIRect) third_party/skia/src/gpu/graphite/Recording.cpp:235:36 #5 0x61fd3afc4310 in skgpu::graphite::QueueManager::addRecording(skgpu::graphite::InsertRecordingInfo const&, skgpu::graphite::Context*) third_party/skia/src/gpu/graphite/QueueManager.cpp:191:34 #6 0x61fd3af040d1 in skgpu::graphite::Context::insertRecording(skgpu::graphite::InsertRecordingInfo const&) third_party/skia/src/gpu/graphite/Context.cpp:245:27 #7 0x61fd39dd6298 in gpu::(anonymous namespace)::GraphiteBufferManagerStaleTransferTest_StaleTransferBufferAfterFailedSnap_Test::TestBody() gpu/command_buffer/service/graphite_buffer_manager_uaf_unittest.cc:206:14 #8 0x61fd3ca45e7b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #9 0x61fd3ca48ad7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #10 0x61fd3ca4abd3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #11 0x61fd3ca7a01a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #12 0x61fd3ca78aee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #13 0x61fd3f4667cc in base::TestSuite::Run() base/test/test_suite.cc:440:16 #14 0x61fd3937adf1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #15 0x61fd3f47227b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #16 0x61fd3f471b9b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #17 0x61fd3937aae7 in main gpu/command_buffer/common/unittest_main.cc:38:10 #18 0x7f2059245249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7c4057bf02f8 is located 184 bytes inside of 312-byte region [0x7c4057bf0240,0x7c4057bf0378) freed by thread T0 here: #0 0x61fd38e46a56 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/gpu_unittests+0x4e23a56) (BuildId: ab90258733907caf) #1 0x61fd3aff1917 in skgpu::graphite::ResourceCache::purgeResource(skgpu::graphite::Resource*) third_party/skia/src/gpu/graphite/Resource.h:600:30 #2 0x61fd3aff2ef6 in skgpu::graphite::ResourceCache::setMaxBudget(unsigned long) third_party/skia/src/gpu/graphite/ResourceCache.cpp:605:15 #3 0x61fd39dd5d1d in gpu::(anonymous namespace)::GraphiteBufferManagerStaleTransferTest_StaleTransferBufferAfterFailedSnap_Test::TestBody() third_party/skia/src/gpu/graphite/ResourceProvider.h:98:71 #4 0x61fd3ca45e7b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #5 0x61fd3ca48ad7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #6 0x61fd3ca4abd3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #7 0x61fd3ca7a01a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #8 0x61fd3ca78aee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #9 0x61fd3f4667cc in base::TestSuite::Run() base/test/test_suite.cc:440:16 #10 0x61fd3937adf1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #11 0x61fd3f47227b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #12 0x61fd3f471b9b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #13 0x61fd3937aae7 in main gpu/command_buffer/common/unittest_main.cc:38:10 #14 0x7f2059245249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x61fd38e45e51 in operator new(unsigned long) (/chromium/chromium/src/out/asan/gpu_unittests+0x4e22e51) (BuildId: ab90258733907caf) #1 0x61fd3b0cde25 in skgpu::graphite::DawnBuffer::Make(skgpu::graphite::DawnSharedContext const*, unsigned long, skgpu::graphite::BufferType, skgpu::graphite::AccessPattern, std::__Cr::basic_string_view>) third_party/skia/src/gpu/graphite/dawn/DawnBuffer.cpp:176:13 #2 0x61fd3aff8a3a in skgpu::graphite::ResourceProvider::findOrCreateBuffer(unsigned long, skgpu::graphite::BufferType, skgpu::graphite::AccessPattern, std::__Cr::basic_string_view>, skgpu::graphite::Shareable, skia_private::THashSet const*) third_party/skia/src/gpu/graphite/ResourceProvider.cpp:248:29 #3 0x61fd3aff8812 in skgpu::graphite::ResourceProvider::findOrCreateNonShareableBuffer(unsigned long, skgpu::graphite::BufferType, skgpu::graphite::AccessPattern, std::__Cr::basic_string_view>) third_party/skia/src/gpu/graphite/ResourceProvider.cpp:192:18 #4 0x61fd3b0404fe in skgpu::graphite::UploadBufferManager::makeBindInfo(unsigned long, unsigned long, std::__Cr::basic_string_view>) third_party/skia/src/gpu/graphite/UploadBufferManager.cpp:83:44 #5 0x61fd3aed7e1b in skgpu::graphite::DrawBufferManager::getBuffer(int, unsigned long, unsigned long, unsigned long, unsigned long, skgpu::graphite::ClearBuffer, skgpu::graphite::Shareable) third_party/skia/src/gpu/graphite/BufferManager.cpp:522:67 #6 0x61fd39dd65ef in skgpu::graphite::DrawBufferManager::getMappedUniformBuffer(unsigned long, unsigned long) third_party/skia/src/gpu/graphite/BufferManager.h:295:43 #7 0x61fd39dd4c2b in gpu::(anonymous namespace)::GraphiteBufferManagerStaleTransferTest_StaleTransferBufferAfterFailedSnap_Test::TestBody() gpu/command_buffer/service/graphite_buffer_manager_uaf_unittest.cc:121:14 #8 0x61fd3ca45e7b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #9 0x61fd3ca48ad7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #10 0x61fd3ca4abd3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #11 0x61fd3ca7a01a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #12 0x61fd3ca78aee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #13 0x61fd3f4667cc in base::TestSuite::Run() base/test/test_suite.cc:440:16 #14 0x61fd3937adf1 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #15 0x61fd3f47227b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #16 0x61fd3f471b9b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #17 0x61fd3937aae7 in main gpu/command_buffer/common/unittest_main.cc:38:10 #18 0x7f2059245249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/dawn/include/dawn/webgpu_cpp.h:1230:16 in skgpu::graphite::DawnCommandBuffer::onCopyBufferToBuffer(skgpu::graphite::Buffer const*, unsigned long, skgpu::graphite::Buffer const*, unsigned long, unsigned long) Shadow bytes around the buggy address: 0x7c4057bf0000: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa 0x7c4057bf0080: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x7c4057bf0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7c4057bf0180: f7 f7 f7 f7 f7 f7 f7 f7 00 00 00 00 00 00 00 fa 0x7c4057bf0200: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x7c4057bf0280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd] 0x7c4057bf0300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x7c4057bf0380: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x7c4057bf0400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c4057bf0480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7c4057bf0500: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2496==ADDITIONAL INFO ==2496==Note: Please include this section with the ASan report. Task trace: ==2496==END OF ADDITIONAL INFO ==2496==ABORTING