Note: Google Test filter = DawnGraphiteStaticSamplerUAFTest.*
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from DawnGraphiteStaticSamplerUAFTest
[ RUN      ] DawnGraphiteStaticSamplerUAFTest.ManyImmutableSamplersInOnePipeline
=================================================================
==1989==ERROR: AddressSanitizer: heap-use-after-free on address 0x748cbeebda88 at pc 0x56a5edb5bac6 bp 0x7ffd06f71a90 sp 0x7ffd06f71a88
READ of size 4 at 0x748cbeebda88 thread T0
    #0 0x56a5edb5bac5 in dawn::Result<dawn::native::UnpackedPtr<dawn::native::BindGroupLayoutEntry>, dawn::native::ErrorData> dawn::native::ValidateAndUnpack<dawn::native::BindGroupLayoutEntry, void>(dawn::native::BindGroupLayoutEntry const*) gen/third_party/dawn/src/dawn/native/ChainUtils_autogen.cpp:2095:23
    #1 0x56a5edbf7291 in dawn::native::ValidateBindGroupLayoutDescriptor(dawn::native::DeviceBase*, dawn::native::BindGroupLayoutDescriptor const*, bool) third_party/dawn/src/dawn/native/BindGroupLayoutInternal.cpp:357:32
    #2 0x56a5edcd97a2 in dawn::native::DeviceBase::CreateBindGroupLayout(dawn::native::BindGroupLayoutDescriptor const*, bool) third_party/dawn/src/dawn/native/Device.cpp:1982:13
    #3 0x56a5edcd93a0 in dawn::native::DeviceBase::APICreateBindGroupLayout(dawn::native::BindGroupLayoutDescriptor const*) third_party/dawn/src/dawn/native/Device.cpp:1206:23
    #4 0x56a5ed39f6b5 in skgpu::graphite::DawnGraphicsPipeline::Make(skgpu::graphite::DawnSharedContext const*, skgpu::graphite::RuntimeEffectDictionary const*, skgpu::UniqueKey const&, skgpu::graphite::GraphicsPipelineDesc const&, skgpu::graphite::RenderPassDesc const&, SkEnumBitMask<skgpu::graphite::PipelineCreationFlags>, unsigned int) gen/third_party/dawn/include/dawn/webgpu_cpp.h:8987:19
    #5 0x56a5ed2df9a7 in skgpu::graphite::SharedContext::findOrCreateGraphicsPipeline(skgpu::graphite::RuntimeEffectDictionary const*, skgpu::UniqueKey const&, skgpu::graphite::GraphicsPipelineDesc const&, skgpu::graphite::RenderPassDesc const&, SkEnumBitMask<skgpu::graphite::PipelineCreationFlags>) third_party/skia/src/gpu/graphite/SharedContext.cpp:106:26
    #6 0x56a5ed27034b in skgpu::graphite::PipelineManager::startPipelineCreationTask(skgpu::graphite::SharedContext*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>, skgpu::graphite::GraphicsPipelineHandle const&) third_party/skia/src/gpu/graphite/PipelineManager.cpp:78:55
    #7 0x56a5ed22420d in skgpu::graphite::DrawPass::prepareResources(skgpu::graphite::ResourceProvider*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>, skgpu::graphite::RenderPassDesc const&) third_party/skia/src/gpu/graphite/DrawPass.cpp:51:27
    #8 0x56a5ed34c2d1 in skgpu::graphite::RenderPassTask::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/RenderPassTask.cpp:157:24
    #9 0x56a5ed34eb01 in skgpu::graphite::TaskList::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/TaskList.cpp:46:22
    #10 0x56a5ed34b171 in skgpu::graphite::DrawTask::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/DrawTask.cpp:51:24
    #11 0x56a5ed34eb01 in skgpu::graphite::TaskList::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/TaskList.cpp:46:22
    #12 0x56a5ed298925 in skgpu::graphite::RecordingPriv::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/Recording.cpp:205:54
    #13 0x56a5ed288e46 in skgpu::graphite::Recorder::snap() third_party/skia/src/gpu/graphite/Recorder.cpp:249:32
    #14 0x56a5ec136383 in gpu::(anonymous namespace)::DawnGraphiteStaticSamplerUAFTest_ManyImmutableSamplersInOnePipeline_Test::TestBody() gpu/command_buffer/service/dawn_graphite_static_sampler_uaf_test.cc:202:69
    #15 0x56a5eecb8b7b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #16 0x56a5eecbb6e7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #17 0x56a5eecbd763 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #18 0x56a5eecec1b4 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #19 0x56a5eecead2a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #20 0x56a5f16b5e60 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #21 0x56a5eb6cd181 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), (anonymous namespace)::GpuTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<(anonymous namespace)::GpuTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #22 0x56a5f16c12ab in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #23 0x56a5f16c0bcb in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #24 0x56a5eb6cce77 in main gpu/command_buffer/common/unittest_main.cc:38:10
    #25 0x777cc0425249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x748cbeebda88 is located 8 bytes inside of 256-byte region [0x748cbeebda80,0x748cbeebdb80)
freed by thread T0 here:
    #0 0x56a5eb1525e6 in free (/chromium/chromium/src/out/asan/gpu_unittests+0x4d3d5e6) (BuildId: 26e768faa511ef5b)
    #1 0x56a5ed3a52e8 in skia_private::TArray<wgpu::StaticSamplerBindingLayout, false>::installDataAndUpdateCapacity(SkSpan<std::byte>) third_party/skia/include/private/base/SkTArray.h:736:13
    #2 0x56a5ed3a1a1d in wgpu::StaticSamplerBindingLayout& skia_private::TArray<wgpu::StaticSamplerBindingLayout, false>::emplace_back<>() third_party/skia/include/private/base/SkTArray.h:699:15
    #3 0x56a5ed39ed9b in skgpu::graphite::DawnGraphicsPipeline::Make(skgpu::graphite::DawnSharedContext const*, skgpu::graphite::RuntimeEffectDictionary const*, skgpu::UniqueKey const&, skgpu::graphite::GraphicsPipelineDesc const&, skgpu::graphite::RenderPassDesc const&, SkEnumBitMask<skgpu::graphite::PipelineCreationFlags>, unsigned int) third_party/skia/src/gpu/graphite/dawn/DawnGraphicsPipeline.cpp:541:54
    #4 0x56a5ed2df9a7 in skgpu::graphite::SharedContext::findOrCreateGraphicsPipeline(skgpu::graphite::RuntimeEffectDictionary const*, skgpu::UniqueKey const&, skgpu::graphite::GraphicsPipelineDesc const&, skgpu::graphite::RenderPassDesc const&, SkEnumBitMask<skgpu::graphite::PipelineCreationFlags>) third_party/skia/src/gpu/graphite/SharedContext.cpp:106:26
    #5 0x56a5ed27034b in skgpu::graphite::PipelineManager::startPipelineCreationTask(skgpu::graphite::SharedContext*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>, skgpu::graphite::GraphicsPipelineHandle const&) third_party/skia/src/gpu/graphite/PipelineManager.cpp:78:55
    #6 0x56a5ed22420d in skgpu::graphite::DrawPass::prepareResources(skgpu::graphite::ResourceProvider*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>, skgpu::graphite::RenderPassDesc const&) third_party/skia/src/gpu/graphite/DrawPass.cpp:51:27
    #7 0x56a5ed34c2d1 in skgpu::graphite::RenderPassTask::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/RenderPassTask.cpp:157:24
    #8 0x56a5ed34eb01 in skgpu::graphite::TaskList::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/TaskList.cpp:46:22
    #9 0x56a5ed34b171 in skgpu::graphite::DrawTask::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/DrawTask.cpp:51:24
    #10 0x56a5ed34eb01 in skgpu::graphite::TaskList::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/TaskList.cpp:46:22
    #11 0x56a5ed298925 in skgpu::graphite::RecordingPriv::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/Recording.cpp:205:54
    #12 0x56a5ed288e46 in skgpu::graphite::Recorder::snap() third_party/skia/src/gpu/graphite/Recorder.cpp:249:32
    #13 0x56a5ec136383 in gpu::(anonymous namespace)::DawnGraphiteStaticSamplerUAFTest_ManyImmutableSamplersInOnePipeline_Test::TestBody() gpu/command_buffer/service/dawn_graphite_static_sampler_uaf_test.cc:202:69
    #14 0x56a5eecb8b7b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #15 0x56a5eecbb6e7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #16 0x56a5eecbd763 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #17 0x56a5eecec1b4 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #18 0x56a5eecead2a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #19 0x56a5f16b5e60 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #20 0x56a5eb6cd181 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), (anonymous namespace)::GpuTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<(anonymous namespace)::GpuTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #21 0x56a5f16c12ab in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #22 0x56a5f16c0bcb in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #23 0x56a5eb6cce77 in main gpu/command_buffer/common/unittest_main.cc:38:10
    #24 0x777cc0425249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 here:
    #0 0x56a5eb152bb4 in malloc (/chromium/chromium/src/out/asan/gpu_unittests+0x4d3dbb4) (BuildId: 26e768faa511ef5b)
    #1 0x56a5f15d0683 in base::UncheckedMalloc(unsigned long, void**) base/process/memory_linux.cc:131:13
    #2 0x56a5f1af3796 in sk_malloc_flags(unsigned long, unsigned int) skia/ext/SkMemory_new_handler.cpp:115:17
    #3 0x56a5ecc94c28 in SkContainerAllocator::allocate(int, double) third_party/skia/include/private/base/SkMalloc.h:68:12
    #4 0x56a5ed3a1969 in wgpu::StaticSamplerBindingLayout& skia_private::TArray<wgpu::StaticSamplerBindingLayout, false>::emplace_back<>() third_party/skia/include/private/base/SkTArray.h:630:62
    #5 0x56a5ed39ed9b in skgpu::graphite::DawnGraphicsPipeline::Make(skgpu::graphite::DawnSharedContext const*, skgpu::graphite::RuntimeEffectDictionary const*, skgpu::UniqueKey const&, skgpu::graphite::GraphicsPipelineDesc const&, skgpu::graphite::RenderPassDesc const&, SkEnumBitMask<skgpu::graphite::PipelineCreationFlags>, unsigned int) third_party/skia/src/gpu/graphite/dawn/DawnGraphicsPipeline.cpp:541:54
    #6 0x56a5ed2df9a7 in skgpu::graphite::SharedContext::findOrCreateGraphicsPipeline(skgpu::graphite::RuntimeEffectDictionary const*, skgpu::UniqueKey const&, skgpu::graphite::GraphicsPipelineDesc const&, skgpu::graphite::RenderPassDesc const&, SkEnumBitMask<skgpu::graphite::PipelineCreationFlags>) third_party/skia/src/gpu/graphite/SharedContext.cpp:106:26
    #7 0x56a5ed27034b in skgpu::graphite::PipelineManager::startPipelineCreationTask(skgpu::graphite::SharedContext*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>, skgpu::graphite::GraphicsPipelineHandle const&) third_party/skia/src/gpu/graphite/PipelineManager.cpp:78:55
    #8 0x56a5ed22420d in skgpu::graphite::DrawPass::prepareResources(skgpu::graphite::ResourceProvider*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>, skgpu::graphite::RenderPassDesc const&) third_party/skia/src/gpu/graphite/DrawPass.cpp:51:27
    #9 0x56a5ed34c2d1 in skgpu::graphite::RenderPassTask::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/RenderPassTask.cpp:157:24
    #10 0x56a5ed34eb01 in skgpu::graphite::TaskList::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/TaskList.cpp:46:22
    #11 0x56a5ed34b171 in skgpu::graphite::DrawTask::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/DrawTask.cpp:51:24
    #12 0x56a5ed34eb01 in skgpu::graphite::TaskList::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/task/TaskList.cpp:46:22
    #13 0x56a5ed298925 in skgpu::graphite::RecordingPriv::prepareResources(skgpu::graphite::ResourceProvider*, skgpu::graphite::ScratchResourceManager*, sk_sp<skgpu::graphite::RuntimeEffectDictionary const>) third_party/skia/src/gpu/graphite/Recording.cpp:205:54
    #14 0x56a5ed288e46 in skgpu::graphite::Recorder::snap() third_party/skia/src/gpu/graphite/Recorder.cpp:249:32
    #15 0x56a5ec136383 in gpu::(anonymous namespace)::DawnGraphiteStaticSamplerUAFTest_ManyImmutableSamplersInOnePipeline_Test::TestBody() gpu/command_buffer/service/dawn_graphite_static_sampler_uaf_test.cc:202:69
    #16 0x56a5eecb8b7b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #17 0x56a5eecbb6e7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #18 0x56a5eecbd763 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #19 0x56a5eecec1b4 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #20 0x56a5eecead2a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #21 0x56a5f16b5e60 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #22 0x56a5eb6cd181 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), (anonymous namespace)::GpuTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<(anonymous namespace)::GpuTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #23 0x56a5f16c12ab in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #24 0x56a5f16c0bcb in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #25 0x56a5eb6cce77 in main gpu/command_buffer/common/unittest_main.cc:38:10
    #26 0x777cc0425249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free gen/third_party/dawn/src/dawn/native/ChainUtils_autogen.cpp:2095:23 in dawn::Result<dawn::native::UnpackedPtr<dawn::native::BindGroupLayoutEntry>, dawn::native::ErrorData> dawn::native::ValidateAndUnpack<dawn::native::BindGroupLayoutEntry, void>(dawn::native::BindGroupLayoutEntry const*)
Shadow bytes around the buggy address:
  0x748cbeebd800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x748cbeebd880: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
  0x748cbeebd900: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x748cbeebd980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x748cbeebda00: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa fa
=>0x748cbeebda80: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x748cbeebdb00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x748cbeebdb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x748cbeebdc00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x748cbeebdc80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x748cbeebdd00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==1989==ADDITIONAL INFO

==1989==Note: Please include this section with the ASan report.
Task trace:


==1989==END OF ADDITIONAL INFO

==1989==ABORTING