[2268:2268:0606/015159.531801:WARNING:media/gpu/vaapi/vaapi_wrapper.cc:1655] drmGetDevices2() has not found any devices [2268:2268:0606/015159.540083:WARNING:sandbox/policy/linux/sandbox_linux.cc:405] InitializeSandbox() called with multiple threads in process gpu-process. [2268:2268:0606/015159.547875:WARNING:ui/gfx/linux/gbm_support_x11.cc:48] dri3 extension not supported. (chrome:2235): dbind-WARNING **: 01:51:59.576: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory [2235:2235:0606/015159.962511:WARNING:ui/base/idle/idle_linux.cc:111] None of the known D-Bus ScreenSaver services could be used. [2391:2391:0606/015159.981921:INFO:third_party/skia/src/text/gpu/SubRunContainer.cpp:998] POC[renderer pid=2391]: forging SDFTSubRun maskFormat=kARGB (12 glyphs) [2391:2391:0606/015159.982074:INFO:third_party/skia/src/text/gpu/SubRunContainer.cpp:998] POC[renderer pid=2391]: forging SDFTSubRun maskFormat=kARGB (12 glyphs) [2268:2268:0606/015159.995145:INFO:third_party/skia/src/gpu/ganesh/ops/AtlasTextOp.cpp:645] POC[gpu pid=2268]: SDF VERTEX UNDERWRITE GP vertexStride = 16 B/vertex (DistanceField GeoProc) fill vertexStride = 12 B/vertex (vf.maskFormat=2 ARGB) glyphs = 12 bytes allocated = 768 bytes written by fill = 576 UNINITIALIZED bytes = 192 (sentinel-verified=192) unwritten tail [0..64] = cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc -> these 192 bytes of stale GrVertexBufferAllocPool memory are uploaded to the GPU and read by the SDF shader as inPosition/inColor/inTextureCoords -> poisoning region 0x743de4c62660..0x743de4c62720; ASAN will fault when the upload path reads it [2268:2268:0606/015159.995306:INFO:third_party/skia/src/gpu/ganesh/ops/AtlasTextOp.cpp:645] POC[gpu pid=2268]: SDF VERTEX UNDERWRITE GP vertexStride = 16 B/vertex (DistanceField GeoProc) fill vertexStride = 12 B/vertex (vf.maskFormat=2 ARGB) glyphs = 12 bytes allocated = 768 bytes written by fill = 576 UNINITIALIZED bytes = 192 (sentinel-verified=192) unwritten tail [0..64] = cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc -> these 192 bytes of stale GrVertexBufferAllocPool memory are uploaded to the GPU and read by the SDF shader as inPosition/inColor/inTextureCoords -> poisoning region 0x743de4c62960..0x743de4c62a20; ASAN will fault when the upload path reads it [2268:2268:0606/015159.995369:INFO:third_party/skia/src/gpu/ganesh/ops/AtlasTextOp.cpp:645] POC[gpu pid=2268]: SDF VERTEX UNDERWRITE GP vertexStride = 16 B/vertex (DistanceField GeoProc) fill vertexStride = 12 B/vertex (vf.maskFormat=2 ARGB) glyphs = 12 bytes allocated = 768 bytes written by fill = 576 UNINITIALIZED bytes = 192 (sentinel-verified=192) unwritten tail [0..64] = cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc -> these 192 bytes of stale GrVertexBufferAllocPool memory are uploaded to the GPU and read by the SDF shader as inPosition/inColor/inTextureCoords -> poisoning region 0x743de4c62c60..0x743de4c62d20; ASAN will fault when the upload path reads it ================================================================= ==2268==ERROR: AddressSanitizer: use-after-poison on address 0x743de4c62660 at pc 0x5e76f120b148 bp 0x7ffe0e9a56b0 sp 0x7ffe0e9a4e68 READ of size 2304 at 0x743de4c62660 thread T0 (chrome) #0 0x5e76f120b147 in memcpy (/chromium/chromium/src/out/asan/chrome+0x1148c147) (BuildId: b5162dedf0dca1f8) #1 0x716dd618c726 (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0xbdc726) (BuildId: c0d9016bc0542e3e94f66cc6a322c19657b54611) 0x743de4c62660 is located 608 bytes inside of 32800-byte region [0x743de4c62400,0x743de4c6a420) allocated by thread T0 (chrome) here: #0 0x5e76f1246251 in operator new(unsigned long) (/chromium/chromium/src/out/asan/chrome+0x114c7251) (BuildId: b5162dedf0dca1f8) #1 0x5e770c28d709 in GrBufferAllocPool::CpuBufferCache::makeBuffer(unsigned long, bool) third_party/skia/src/gpu/ganesh/GrCpuBuffer.h:29:20 #2 0x5e770c28e88d in GrBufferAllocPool::resetCpuData(unsigned long) third_party/skia/src/gpu/ganesh/GrBufferAllocPool.cpp:389:60 #3 0x5e770c2903f4 in GrBufferAllocPool::createBlock(unsigned long) third_party/skia/src/gpu/ganesh/GrBufferAllocPool.cpp:362:15 #4 0x5e770c290861 in GrBufferAllocPool::makeSpaceAtLeast(unsigned long, unsigned long, unsigned long, sk_sp*, unsigned long*, unsigned long*) third_party/skia/src/gpu/ganesh/GrBufferAllocPool.cpp:261:20 #5 0x5e770c291cbf in GrVertexBufferAllocPool::makeSpaceAtLeast(unsigned long, int, int, sk_sp*, int*, int*) third_party/skia/src/gpu/ganesh/GrBufferAllocPool.cpp:467:28 #6 0x5e770c42afa4 in GrMeshDrawTarget::makeVertexWriterAtLeast(unsigned long, int, int, sk_sp*, int*, int*) third_party/skia/src/gpu/ganesh/GrMeshDrawTarget.cpp:33:21 #7 0x5e770c5cce16 in GrVertexChunkBuilder::allocChunk(int) third_party/skia/src/gpu/ganesh/GrVertexChunkArray.cpp:30:39 #8 0x5e770c5b5da0 in skgpu::ganesh::PathWedgeTessellator::prepare(GrMeshDrawTarget*, SkMatrix const&, skgpu::ganesh::PathTessellator::PathDrawList const&, int) third_party/skia/src/gpu/ganesh/GrVertexChunkArray.h:66:80 #9 0x5e770c5105ed in skgpu::ganesh::PathStencilCoverOp::onPrepare(GrOpFlushState*) third_party/skia/src/gpu/ganesh/ops/PathStencilCoverOp.cpp:307:19 #10 0x5e770c4c4802 in GrOp::prepare(GrOpFlushState*) third_party/skia/src/gpu/ganesh/ops/GrOp.cpp:59:11 #11 0x5e770c50374a in skgpu::ganesh::OpsTask::onPrepare(GrOpFlushState*) third_party/skia/src/gpu/ganesh/ops/OpsTask.cpp:548:27 #12 0x5e770c2e89ba in GrRenderTask::prepare(GrOpFlushState*) third_party/skia/src/gpu/ganesh/GrRenderTask.cpp:111:11 #13 0x5e770c28184b in GrDrawingManager::executeRenderTasks(GrOpFlushState*) third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:266:21 #14 0x5e770c27fcf3 in GrDrawingManager::flush(SkSpan, SkSurfaces::BackendSurfaceAccess, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:209:34 #15 0x5e770c282cb0 in GrDrawingManager::flushSurfaces(SkSpan, SkSurfaces::BackendSurfaceAccess, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:540:27 #16 0x5e770c27b389 in GrDirectContextPriv::flushSurfaces(SkSpan, SkSurfaces::BackendSurfaceAccess, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDirectContextPriv.cpp:91:47 #17 0x5e770c21e12b in GrDirectContext::flush(SkSurface*, GrFlushInfo const&, skgpu::MutableTextureState const*) third_party/skia/src/gpu/ganesh/GrDirectContextPriv.h:106:22 #18 0x5e771382de1f in gpu::SharedContextState::FlushWriteAccess(gpu::SkiaImageRepresentation::ScopedWriteAccess*) gpu/command_buffer/service/shared_context_state.cc:860:9 #19 0x5e7713e59887 in gpu::raster::RasterDecoderImpl::DoEndRasterCHROMIUM() gpu/command_buffer/service/raster_decoder.cc:3127:30 #20 0x5e7713e53cae in gpu::raster::RasterDecoderImpl::HandleEndRasterCHROMIUM(unsigned int, void const volatile*) gpu/command_buffer/service/raster_decoder_autogen.h:146:3 #21 0x5e7713e5ea9b in gpu::error::Error gpu::raster::RasterDecoderImpl::DoCommandsImpl(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/raster_decoder.cc:1534:18 #22 0x5e76fc5b9754 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35 #23 0x5e7713dc91eb in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector> const&) gpu/ipc/service/command_buffer_stub.cc:504:22 #24 0x5e7713dc845c in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7 #25 0x5e7713ddde6c in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:854:13 #26 0x5e7713dec917 in void base::internal::DecayedFunctorTraits, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>::Invoke, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12 #27 0x5e7713dec6f9 in base::internal::Invoker, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>, base::internal::BindState, gpu::FenceSyncReleaseDelegate*), base::WeakPtr, mojo::StructPtr>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5 #28 0x5e76fc600bf1 in void base::internal::Invoker&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState, base::internal::UnretainedWrapper>, void ()>::RunImpl, std::__Cr::tuple>, 0ul>(base::OnceCallback&&, std::__Cr::tuple>&&, std::__Cr::integer_sequence) base/functional/callback.h:155:12 #29 0x5e76fc5d42de in gpu::Scheduler::ExecuteSequence(base::IdType) base/functional/callback.h:155:12 SUMMARY: AddressSanitizer: use-after-poison (/chromium/chromium/src/out/asan/chrome+0x1148c147) (BuildId: b5162dedf0dca1f8) in memcpy Shadow bytes around the buggy address: 0x743de4c62380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x743de4c62400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x743de4c62480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x743de4c62500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x743de4c62580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x743de4c62600: 00 00 00 00 00 00 00 00 00 00 00 00[f7]f7 f7 f7 0x743de4c62680: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x743de4c62700: f7 f7 f7 f7 00 00 00 00 00 00 00 00 00 00 00 00 0x743de4c62780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x743de4c62800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x743de4c62880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb NOTE: the stack trace above identifies the code that *accessed* the poisoned memory. To identify the code that *poisoned* the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=. ==2268==ADDITIONAL INFO ==2268==Note: Please include this section with the ASan report. Task trace: #0 0x5e76fc5d21a2 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:650:27 #1 0x5e76fc5d21a2 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:650:27 #2 0x5e76fc5ccec6 in gpu::Scheduler::TryScheduleSequence(gpu::Scheduler::Sequence*) gpu/command_buffer/service/scheduler.cc:435:29 Command line: `/proc/self/exe --type=gpu-process --no-sandbox --ozone-platform=x11 --crashpad-handler-pid=2237 --enable-crash-reporter=, --user-data-dir=/tmp/chrome-poc-profile --disable-breakpad --change-stack-guard-on-fork=enable --gpu-preferences=WAAAAAAAAAAgAQAMAAAAAAAAAAAAAMAAQAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --shared-files --metrics-shmem-handle=4,i,6861049866784236813,11059342075551414982,262144 --field-trial-handle=3,i,17169223998053430625,736350452423238689,262144 --disable-features=SkiaGraphite --variations-seed-version --pseudonymization-salt-handle=7,i,1891865055930916694,8651468521339662378,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=stderr --v=0` ==2268==END OF ADDITIONAL INFO ==2268==ABORTING [2235:2235:0606/015201.003733:ERROR:content/browser/gpu/gpu_process_host.cc:1089] GPU process exited unexpectedly: exit_code=256 [2235:2235:0606/015201.003782:WARNING:content/browser/gpu/gpu_process_host.cc:1531] The GPU process has crashed 1 time(s)