Note: Google Test filter = *BubbleSetBoundsSyncCloseOnStateUpdate* [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from XdgVersionStableTest/WaylandWindowTest [ RUN ] XdgVersionStableTest/WaylandWindowTest.BubbleSetBoundsSyncCloseOnStateUpdate/0 [2119:2119:WARNING:ui/ozone/platform/wayland/gpu/wayland_buffer_manager_gpu.cc:456] Failed to initialize drm render node handle. [2119:2119:WARNING:ui/ozone/platform/wayland/common/wayland_object.cc:119] Binding to wl_shm version 1 but version 2 is available. [2119:2119:WARNING:ui/ozone/platform/wayland/common/wayland_object.cc:119] Binding to zwp_pointer_gestures_v1 version 1 but version 3 is available. [2119:2119:WARNING:ui/ozone/platform/wayland/host/wayland_surface.cc:200] Server doesn't support wp_content_type_v1 [2119:2119:WARNING:ui/ozone/platform/wayland/host/wayland_surface.cc:214] Server doesn't support wp_color_management_surface_v1. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: TokenCommit(0x7c94b960cb40, 0x7c44b95f9900) NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: Activate(0x7c94b960cb40, 0x7c44b95f8e80, 0x7c94b9617d9c pointing to "", 0x7c44b95f9000) NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. ================================================================= ==2119==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cf4b95e1ef0 at pc 0x5a4eb18f6a53 bp 0x7ffca75871f0 sp 0x7ffca75871e8 READ of size 8 at 0x7cf4b95e1ef0 thread T0 #0 0x5a4eb18f6a52 in ui::WaylandBubble::SetBoundsInDIP(gfx::Rect const&) third_party/libc++/src/include/__memory/unique_ptr.h:275:12 #1 0x5a4eaf83db60 in ui::WaylandWindowTest_BubbleSetBoundsSyncCloseOnStateUpdate_Test::TestBody() ui/ozone/platform/wayland/host/wayland_window_unittest.cc:5516:15 #2 0x5a4eb031190b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x5a4eb0314567 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x5a4eb0316663 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x5a4eb0345aaa in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x5a4eb034457e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x5a4eb2747eec in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x5a4eaf41fc51 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #9 0x5a4eb275087b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #10 0x5a4eb275019b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #11 0x5a4eaf41f50b in main mojo/core/test/run_all_unittests.cc:30:10 #12 0x7f84bad2c249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7cf4b95e1ef0 is located 624 bytes inside of 656-byte region [0x7cf4b95e1c80,0x7cf4b95e1f10) freed by thread T0 here: #0 0x5a4eaf41ea56 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/ozone_unittests+0x2b2ba56) (BuildId: ed2ff622aec68131) #1 0x5a4eaf881e3a in base::internal::BindLambdaForTestingHelper::Run(ui::WaylandWindowTest_BubbleSetBoundsSyncCloseOnStateUpdate_Test::TestBody()::$_0 const&) third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x5a4eaf881f60 in base::internal::Invoker, base::internal::BindState, bool ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #3 0x5a4eb1b5291f in base::RepeatingCallback::Run() const & base/functional/callback.h:346:12 #4 0x5a4eb1b524c2 in ui::MockWaylandPlatformWindowDelegate::OnStateUpdate(ui::PlatformWindowDelegate::State const&, ui::PlatformWindowDelegate::State const&) ui/ozone/platform/wayland/test/mock_wayland_platform_window_delegate.cc:66:36 #5 0x5a4eb1a131bd in ui::WaylandWindow::MaybeApplyLatestStateRequest(bool) ui/ozone/platform/wayland/host/wayland_window.cc:1599:33 #6 0x5a4eb1a11f75 in ui::WaylandWindow::RequestState(ui::PlatformWindowDelegate::State, long, bool) ui/ozone/platform/wayland/host/wayland_window.cc:1427:3 #7 0x5a4eb1a07f69 in ui::WaylandWindow::SetBoundsInDIP(gfx::Rect const&) ui/ozone/platform/wayland/host/wayland_window.cc:1350:3 #8 0x5a4eb18f672c in ui::WaylandBubble::SetBoundsInDIP(gfx::Rect const&) ui/ozone/platform/wayland/host/wayland_bubble.cc:64:18 #9 0x5a4eaf83db60 in ui::WaylandWindowTest_BubbleSetBoundsSyncCloseOnStateUpdate_Test::TestBody() ui/ozone/platform/wayland/host/wayland_window_unittest.cc:5516:15 #10 0x5a4eb031190b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #11 0x5a4eb0314567 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #12 0x5a4eb0316663 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #13 0x5a4eb0345aaa in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #14 0x5a4eb034457e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #15 0x5a4eb2747eec in base::TestSuite::Run() base/test/test_suite.cc:440:16 #16 0x5a4eaf41fc51 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #17 0x5a4eb275087b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #18 0x5a4eb275019b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #19 0x5a4eaf41f50b in main mojo/core/test/run_all_unittests.cc:30:10 #20 0x7f84bad2c249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) previously allocated by thread T0 here: #0 0x5a4eaf41de51 in operator new(unsigned long) (/chromium/chromium/src/out/asan/ozone_unittests+0x2b2ae51) (BuildId: ed2ff622aec68131) #1 0x5a4eb1a2e1af in ui::WaylandWindow::Create(ui::PlatformWindowDelegate*, ui::WaylandConnection*, ui::PlatformWindowInitProperties) third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x5a4eb1b51ffa in ui::MockWaylandPlatformWindowDelegate::CreateWaylandWindow(ui::WaylandConnection*, ui::PlatformWindowInitProperties) ui/ozone/platform/wayland/test/mock_wayland_platform_window_delegate.cc:47:17 #3 0x5a4eaf9dc75f in ui::WaylandTestBase::CreateWaylandWindowWithParams(ui::PlatformWindowType, gfx::Rect, ui::MockWaylandPlatformWindowDelegate*, unsigned int, bool) ui/ozone/platform/wayland/test/wayland_test.cc:269:17 #4 0x5a4eaf83d98e in ui::WaylandWindowTest_BubbleSetBoundsSyncCloseOnStateUpdate_Test::TestBody() ui/ozone/platform/wayland/host/wayland_window_unittest.cc:5488:43 #5 0x5a4eb031190b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #6 0x5a4eb0314567 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #7 0x5a4eb0316663 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #8 0x5a4eb0345aaa in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #9 0x5a4eb034457e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #10 0x5a4eb2747eec in base::TestSuite::Run() base/test/test_suite.cc:440:16 #11 0x5a4eaf41fc51 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #12 0x5a4eb275087b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #13 0x5a4eb275019b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #14 0x5a4eaf41f50b in main mojo/core/test/run_all_unittests.cc:30:10 #15 0x7f84bad2c249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) SUMMARY: AddressSanitizer: heap-use-after-free third_party/libc++/src/include/__memory/unique_ptr.h:275:12 in ui::WaylandBubble::SetBoundsInDIP(gfx::Rect const&) Shadow bytes around the buggy address: 0x7cf4b95e1c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7cf4b95e1c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7cf4b95e1d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7cf4b95e1d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x7cf4b95e1e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x7cf4b95e1e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd 0x7cf4b95e1f00: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7cf4b95e1f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7cf4b95e2000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7cf4b95e2080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7cf4b95e2100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==2119==ADDITIONAL INFO ==2119==Note: Please include this section with the ASan report. Task trace: ==2119==END OF ADDITIONAL INFO ==2119==ABORTING