=================================================================
==4583==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7a7a98638420 at pc 0x6120cddd080a bp 0x7ffeff574d70 sp 0x7ffeff574d68
WRITE of size 4 at 0x7a7a98638420 thread T0 (chrome)
    #0 0x6120cddd0809 in skgpu::ganesh::GlyphData::fillVertexData(sktext::gpu::VertexFiller const&, SkSpan<skgpu::ganesh::Glyph const>, int, int, SkRGBA4f<(SkAlphaType)2> const&, SkMatrix const&, SkIRect, void*) third_party/skia/src/gpu/ganesh/text/GlyphData.cpp:162:17
    #1 0x6120cdc4708d in skgpu::ganesh::AtlasTextOp::onPrepareDraws(GrMeshDrawTarget*) third_party/skia/src/gpu/ganesh/ops/AtlasTextOp.cpp:384:15
    #2 0x6120cdca20c2 in GrOp::prepare(GrOpFlushState*) third_party/skia/src/gpu/ganesh/ops/GrOp.cpp:59:11
    #3 0x6120cdce100a in skgpu::ganesh::OpsTask::onPrepare(GrOpFlushState*) third_party/skia/src/gpu/ganesh/ops/OpsTask.cpp:548:27
    #4 0x6120cdac695a in GrRenderTask::prepare(GrOpFlushState*) third_party/skia/src/gpu/ganesh/GrRenderTask.cpp:111:11
    #5 0x6120cda5f7eb in GrDrawingManager::executeRenderTasks(GrOpFlushState*) third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:266:21
    #6 0x6120cda5dc93 in GrDrawingManager::flush(SkSpan<GrSurfaceProxy*>, SkSurfaces::BackendSurfaceAccess, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:209:34
    #7 0x6120cda60c50 in GrDrawingManager::flushSurfaces(SkSpan<GrSurfaceProxy*>, SkSurfaces::BackendSurfaceAccess, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:540:27
    #8 0x6120cda59329 in GrDirectContextPriv::flushSurfaces(SkSpan<GrSurfaceProxy*>, SkSurfaces::BackendSurfaceAccess, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDirectContextPriv.cpp:91:47
    #9 0x6120cd9fc0cb in GrDirectContext::flush(SkSurface*, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDirectContextPriv.h:106:22
    #10 0x6120d53d532f in gpu::SharedContextState::FlushWriteAccess(gpu::SkiaImageRepresentation::ScopedWriteAccess*) gpu/command_buffer/service/shared_context_state.cc:860:9
    #11 0x6120d5702017 in gpu::raster::RasterDecoderImpl::DoEndRasterCHROMIUM() gpu/command_buffer/service/raster_decoder.cc:3127:30
    #12 0x6120d56fc43e in gpu::raster::RasterDecoderImpl::HandleEndRasterCHROMIUM(unsigned int, void const volatile*) gpu/command_buffer/service/raster_decoder_autogen.h:146:3
    #13 0x6120d570722b in gpu::error::Error gpu::raster::RasterDecoderImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/raster_decoder.cc:1534:18
    #14 0x6120bddf5754 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35
    #15 0x6120d567344b in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&) gpu/ipc/service/command_buffer_stub.cc:504:22
    #16 0x6120d56726bc in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7
    #17 0x6120d56880cc in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:854:13
    #18 0x6120d5696b77 in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12
    #19 0x6120d5696959 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5
    #20 0x6120bde3cbf1 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) base/functional/callback.h:155:12
    #21 0x6120bde102de in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>) base/functional/callback.h:155:12
    #22 0x6120bde0dcc8 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:628:3
    #23 0x6120bde12151 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(), gpu::Scheduler*>, base::internal::BindState<true, true, false, void (gpu::Scheduler::*)(), base::internal::UnretainedWrapper<gpu::Scheduler, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #24 0x6120cb524283 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12
    #25 0x6120cb593ae3 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5
    #26 0x6120cb59287a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:345:40
    #27 0x6120cb3e3f52 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:65:55
    #28 0x6120cb595214 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:657:12
    #29 0x6120cb49fd00 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14
    #30 0x6120d76badce in content::GpuMain(content::MainFunctionParams) content/gpu/gpu_main.cc:486:14
    #31 0x6120c7c3a333 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:666:14
    #32 0x6120c7c3b63b in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:773:12
    #33 0x6120c7c3e541 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1165:10
    #34 0x6120c7c37d4b in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36
    #35 0x6120c7c3833c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10
    #36 0x6120b203302b in ChromeMain chrome/app/chrome_main.cc:221:12
    #37 0x7baa9a42b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x7a7a98638420 is located 0 bytes after 32800-byte region [0x7a7a98630400,0x7a7a98638420)
allocated by thread T0 (chrome) here:
    #0 0x6120b2031251 in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x117dd251) (BuildId: 6ea95fab0dab7577)
    #1 0x6120cda6b6a9 in GrBufferAllocPool::CpuBufferCache::makeBuffer(unsigned long, bool) third_party/skia/src/gpu/ganesh/GrCpuBuffer.h:29:20
    #2 0x6120cda6c82d in GrBufferAllocPool::resetCpuData(unsigned long) third_party/skia/src/gpu/ganesh/GrBufferAllocPool.cpp:389:60
    #3 0x6120cda6e394 in GrBufferAllocPool::createBlock(unsigned long) third_party/skia/src/gpu/ganesh/GrBufferAllocPool.cpp:362:15
    #4 0x6120cda6e801 in GrBufferAllocPool::makeSpaceAtLeast(unsigned long, unsigned long, unsigned long, sk_sp<GrBuffer const>*, unsigned long*, unsigned long*) third_party/skia/src/gpu/ganesh/GrBufferAllocPool.cpp:261:20
    #5 0x6120cda6fc5f in GrVertexBufferAllocPool::makeSpaceAtLeast(unsigned long, int, int, sk_sp<GrBuffer const>*, int*, int*) third_party/skia/src/gpu/ganesh/GrBufferAllocPool.cpp:467:28
    #6 0x6120cdc08f34 in GrMeshDrawTarget::makeVertexWriterAtLeast(unsigned long, int, int, sk_sp<GrBuffer const>*, int*, int*) third_party/skia/src/gpu/ganesh/GrMeshDrawTarget.cpp:33:21
    #7 0x6120cddaa6d6 in GrVertexChunkBuilder::allocChunk(int) third_party/skia/src/gpu/ganesh/GrVertexChunkArray.cpp:30:39
    #8 0x6120cdd93660 in skgpu::ganesh::PathWedgeTessellator::prepare(GrMeshDrawTarget*, SkMatrix const&, skgpu::ganesh::PathTessellator::PathDrawList const&, int) third_party/skia/src/gpu/ganesh/GrVertexChunkArray.h:66:80
    #9 0x6120cdcedead in skgpu::ganesh::PathStencilCoverOp::onPrepare(GrOpFlushState*) third_party/skia/src/gpu/ganesh/ops/PathStencilCoverOp.cpp:307:19
    #10 0x6120cdca20c2 in GrOp::prepare(GrOpFlushState*) third_party/skia/src/gpu/ganesh/ops/GrOp.cpp:59:11
    #11 0x6120cdce100a in skgpu::ganesh::OpsTask::onPrepare(GrOpFlushState*) third_party/skia/src/gpu/ganesh/ops/OpsTask.cpp:548:27
    #12 0x6120cdac695a in GrRenderTask::prepare(GrOpFlushState*) third_party/skia/src/gpu/ganesh/GrRenderTask.cpp:111:11
    #13 0x6120cda5f7eb in GrDrawingManager::executeRenderTasks(GrOpFlushState*) third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:266:21
    #14 0x6120cda5dc93 in GrDrawingManager::flush(SkSpan<GrSurfaceProxy*>, SkSurfaces::BackendSurfaceAccess, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:209:34
    #15 0x6120cda60c50 in GrDrawingManager::flushSurfaces(SkSpan<GrSurfaceProxy*>, SkSurfaces::BackendSurfaceAccess, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:540:27
    #16 0x6120cda59329 in GrDirectContextPriv::flushSurfaces(SkSpan<GrSurfaceProxy*>, SkSurfaces::BackendSurfaceAccess, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDirectContextPriv.cpp:91:47
    #17 0x6120cd9fc0cb in GrDirectContext::flush(SkSurface*, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDirectContextPriv.h:106:22
    #18 0x6120d53d532f in gpu::SharedContextState::FlushWriteAccess(gpu::SkiaImageRepresentation::ScopedWriteAccess*) gpu/command_buffer/service/shared_context_state.cc:860:9
    #19 0x6120d5702017 in gpu::raster::RasterDecoderImpl::DoEndRasterCHROMIUM() gpu/command_buffer/service/raster_decoder.cc:3127:30
    #20 0x6120d56fc43e in gpu::raster::RasterDecoderImpl::HandleEndRasterCHROMIUM(unsigned int, void const volatile*) gpu/command_buffer/service/raster_decoder_autogen.h:146:3
    #21 0x6120d570722b in gpu::error::Error gpu::raster::RasterDecoderImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/raster_decoder.cc:1534:18
    #22 0x6120bddf5754 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35
    #23 0x6120d567344b in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector<gpu::SyncToken, std::__Cr::allocator<gpu::SyncToken>> const&) gpu/ipc/service/command_buffer_stub.cc:504:22
    #24 0x6120d56726bc in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7
    #25 0x6120d56880cc in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:854:13
    #26 0x6120d5696b77 in void base::internal::DecayedFunctorTraits<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>::Invoke<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel> const&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12
    #27 0x6120d5696959 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>&&, mojo::StructPtr<gpu::mojom::DeferredRequestParams>&&>, base::internal::BindState<true, true, false, void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate*), base::WeakPtr<gpu::GpuChannel>, mojo::StructPtr<gpu::mojom::DeferredRequestParams>>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5
    #28 0x6120bde3cbf1 in void base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState<false, true, true, base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, 0ul>(base::OnceCallback<void (gpu::FenceSyncReleaseDelegate*)>&&, std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>&&, std::__Cr::integer_sequence<unsigned long, 0ul>) base/functional/callback.h:155:12
    #29 0x6120bde102de in gpu::Scheduler::ExecuteSequence(base::IdType<gpu::SyncPointOrderData, unsigned int, 0u, 1u>) base/functional/callback.h:155:12