Note: Google Test filter = *OnChannelDestroyedSnapshotSurvivesWindowDeletion* [==========] Running 3 tests from 3 test suites. [----------] Global test environment set-up. [----------] 1 test from XdgVersionStableTest/WaylandBufferManagerTest [ RUN ] XdgVersionStableTest/WaylandBufferManagerTest.OnChannelDestroyedSnapshotSurvivesWindowDeletion/0 [1980:1980:WARNING:ui/ozone/platform/wayland/gpu/wayland_buffer_manager_gpu.cc:456] Failed to initialize drm render node handle. [1980:1980:WARNING:ui/ozone/platform/wayland/common/wayland_object.cc:119] Binding to wl_shm version 1 but version 2 is available. [1980:1980:WARNING:ui/ozone/platform/wayland/common/wayland_object.cc:119] Binding to zwp_pointer_gestures_v1 version 1 but version 3 is available. [1980:1980:WARNING:ui/ozone/platform/wayland/host/wayland_surface.cc:200] Server doesn't support wp_content_type_v1 [1980:1980:WARNING:ui/ozone/platform/wayland/host/wayland_surface.cc:214] Server doesn't support wp_color_management_surface_v1. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: TokenCommit(0x75c73fa0f5c0, 0x75773f9f9900) NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: Activate(0x75c73fa0f5c0, 0x75773f9f8e80, 0x75c73fa17d9c pointing to "", 0x75773f9f9000) NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: TokenSetSurface(0x75c73fa0f5c0, 0x75773f9fa740, 0x75773f9f9000) NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. GMOCK WARNING: Uninteresting mock function call - returning directly. Function call: TokenCommit(0x75c73fa0f5c0, 0x75773f9fa740) NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/main/docs/gmock_cook_book.md#knowing-when-to-expect-useoncall for details. ================================================================= ==1980==ERROR: AddressSanitizer: heap-use-after-free on address 0x76473f9e7e78 at pc 0x5d71b1a66b2e bp 0x7ffface3ff70 sp 0x7ffface3ff68 READ of size 8 at 0x76473f9e7e78 thread T0 #0 0x5d71b1a66b2d in ui::WaylandWindow::OnChannelDestroyed() third_party/libc++/src/include/__memory/unique_ptr.h:265:101 #1 0x5d71b195f580 in ui::WaylandBufferManagerHost::OnChannelDestroyed() ui/ozone/platform/wayland/host/wayland_buffer_manager_host.cc:85:13 #2 0x5d71adfd709b in ui::WaylandBufferManagerTest_OnChannelDestroyedSnapshotSurvivesWindowDeletion_Test::TestBody() ui/ozone/platform/wayland/wayland_buffer_manager_unittest.cc:3029:18 #3 0x5d71ae86a88b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #4 0x5d71ae86d4e7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #5 0x5d71ae86f5e3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #6 0x5d71ae89eb1a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #7 0x5d71ae89d5ee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x5d71b2794c3c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #9 0x5d71ad930235 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #10 0x5d71b279d614 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #11 0x5d71b279cf3f in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #12 0x5d71ad92faed in main mojo/core/test/run_all_unittests.cc:30:10 #13 0x78b7411ab249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 93ac61ec5a8eb1396f9fbd350e3169a558528a40) 0x76473f9e7e78 is located 248 bytes inside of 1040-byte region [0x76473f9e7d80,0x76473f9e8190) freed by thread T0 here: #0 0x5d71ad92efd6 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/ozone_unittests+0x36e5fd6) (BuildId: 8361346dfdf9f0d3) #1 0x5d71ae001624 in base::internal::BindLambdaForTestingHelper::Run(ui::WaylandBufferManagerTest_OnChannelDestroyedSnapshotSurvivesWindowDeletion_Test::TestBody()::$_0 const&) third_party/libc++/src/include/__memory/unique_ptr.h:74:5 #2 0x5d71ae001790 in base::internal::Invoker, base::internal::BindState, bool ()>::Run(base::internal::BindStateBase*) base/functional/bind_internal.h:673:12 #3 0x5d71b1bb5f4f in base::RepeatingCallback::Run() const & base/functional/callback.h:346:12 #4 0x5d71b1bb5a8d in ui::MockWaylandPlatformWindowDelegate::OnStateUpdate(ui::PlatformWindowDelegate::State const&, ui::PlatformWindowDelegate::State const&) ui/ozone/platform/wayland/test/mock_wayland_platform_window_delegate.cc:60:36 #5 0x5d71b1a73c8f in ui::WaylandWindow::MaybeApplyLatestStateRequest(bool) ui/ozone/platform/wayland/host/wayland_window.cc:1642:33 #6 0x5d71b1a75105 in ui::WaylandWindow::ProcessSequencePoint(long) ui/ozone/platform/wayland/host/wayland_window.cc:1520:3 #7 0x5d71b1a5ac59 in ui::WaylandToplevelWindow::OnSequencePoint(long) ui/ozone/platform/wayland/host/wayland_toplevel_window.cc:659:3 #8 0x5d71b19ee0e2 in ui::WaylandFrameManager::MaybeProcessPendingFrame() ui/ozone/platform/wayland/host/wayland_frame_manager.cc:203:16 #9 0x5d71b19eccbd in ui::WaylandFrameManager::RecordFrame(std::__Cr::unique_ptr>) ui/ozone/platform/wayland/host/wayland_frame_manager.cc:149:5 #10 0x5d71b1a66a5a in ui::WaylandWindow::OnChannelDestroyed() ui/ozone/platform/wayland/host/wayland_window.cc:510:19 #11 0x5d71b195f580 in ui::WaylandBufferManagerHost::OnChannelDestroyed() ui/ozone/platform/wayland/host/wayland_buffer_manager_host.cc:85:13 #12 0x5d71adfd709b in ui::WaylandBufferManagerTest_OnChannelDestroyedSnapshotSurvivesWindowDeletion_Test::TestBody() ui/ozone/platform/wayland/wayland_buffer_manager_unittest.cc:3029:18 #13 0x5d71ae86a88b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #14 0x5d71ae86d4e7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #15 0x5d71ae86f5e3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #16 0x5d71ae89eb1a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #17 0x5d71ae89d5ee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #18 0x5d71b2794c3c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #19 0x5d71ad930235 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #20 0x5d71b279d614 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #21 0x5d71b279cf3f in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #22 0x5d71ad92faed in main mojo/core/test/run_all_unittests.cc:30:10 #23 0x78b7411ab249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 93ac61ec5a8eb1396f9fbd350e3169a558528a40) previously allocated by thread T0 here: #0 0x5d71ad92e381 in operator new(unsigned long) (/chromium/chromium/src/out/asan/ozone_unittests+0x36e5381) (BuildId: 8361346dfdf9f0d3) #1 0x5d71b1a8f083 in ui::WaylandWindow::Create(ui::PlatformWindowDelegate*, ui::WaylandConnection*, ui::PlatformWindowInitProperties) third_party/libc++/src/include/__memory/unique_ptr.h:756:26 #2 0x5d71b1bb5546 in ui::MockWaylandPlatformWindowDelegate::CreateWaylandWindow(ui::WaylandConnection*, ui::PlatformWindowInitProperties) ui/ozone/platform/wayland/test/mock_wayland_platform_window_delegate.cc:38:17 #3 0x5d71adf29a2a in ui::WaylandTestBase::CreateWaylandWindowWithParams(ui::PlatformWindowType, gfx::Rect, ui::MockWaylandPlatformWindowDelegate*, unsigned int, bool) ui/ozone/platform/wayland/test/wayland_test.cc:269:17 #4 0x5d71adfd636a in ui::WaylandBufferManagerTest_OnChannelDestroyedSnapshotSurvivesWindowDeletion_Test::TestBody() ui/ozone/platform/wayland/wayland_buffer_manager_unittest.cc:2987:43 #5 0x5d71ae86a88b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #6 0x5d71ae86d4e7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #7 0x5d71ae86f5e3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #8 0x5d71ae89eb1a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #9 0x5d71ae89d5ee in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #10 0x5d71b2794c3c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #11 0x5d71ad930235 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #12 0x5d71b279d614 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #13 0x5d71b279cf3f in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #14 0x5d71ad92faed in main mojo/core/test/run_all_unittests.cc:30:10 #15 0x78b7411ab249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 93ac61ec5a8eb1396f9fbd350e3169a558528a40) SUMMARY: AddressSanitizer: heap-use-after-free third_party/libc++/src/include/__memory/unique_ptr.h:265:101 in ui::WaylandWindow::OnChannelDestroyed() Shadow bytes around the buggy address: 0x76473f9e7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x76473f9e7c00: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x76473f9e7c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x76473f9e7d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x76473f9e7d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x76473f9e7e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd] 0x76473f9e7e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x76473f9e7f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x76473f9e7f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x76473f9e8000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x76473f9e8080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1980==ADDITIONAL INFO ==1980==Note: Please include this section with the ASan report. Task trace: ==1980==END OF ADDITIONAL INFO ==1980==ABORTING