From a4438e3326664624b9190b95e6ddeeab2b3cccd8 Mon Sep 17 00:00:00 2001
From: Arthur Sonzogni <[email protected]>
Date: Tue, 19 May 2026 07:21:34 -0700
Subject: [PATCH] Remove this_in_hex_ from gpu::gles2::Logger

The gpu::gles2::Logger class was leaking its heap address in GL error
logs by including its 'this' pointer in the fallback prefix string. This
provided a deterministic heap ASLR bypass for the GPU process.

The underlying bug is closed (crbug.com/242999), so this prefix logic
is no longer required. This patch removes the 'this_in_hex_' member and
its associated formatting code.

Bug: 41013722
Fixed: 501659888
Change-Id: I32b49c87eeaaea9c4c8c45a8fe97784b20e75f82
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7852758
Reviewed-by: Corentin Wallez <[email protected]>
Auto-Submit: Arthur Sonzogni <[email protected]>
Commit-Queue: Corentin Wallez <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1632839}
---

diff --git a/gpu/command_buffer/service/logger.cc b/gpu/command_buffer/service/logger.cc
index 3e100cb4..6b8f706 100644
--- a/gpu/command_buffer/service/logger.cc
+++ b/gpu/command_buffer/service/logger.cc
@@ -23,9 +23,6 @@
       log_message_count_(0),
       log_synthesized_gl_errors_(true),
       disable_gl_error_limit_(disable_gl_error_limit) {
-  this_in_hex_ =
-      base::StringPrintf("GroupMarkerNotSet(crbug.com/242999)!:%" PRIXPTR,
-                         reinterpret_cast<uintptr_t>(this));
   suppress_performance_logs_ =
       base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kSuppressPerformanceLogs);
@@ -56,8 +53,7 @@
 }
 
 const std::string& Logger::GetLogPrefix() const {
-  const std::string& prefix(debug_marker_manager_->GetMarker());
-  return prefix.empty() ? this_in_hex_ : prefix;
+  return debug_marker_manager_->GetMarker();
 }
 
 bool Logger::SuppressPerformanceLogs() const {
diff --git a/gpu/command_buffer/service/logger.h b/gpu/command_buffer/service/logger.h
index 4830a453..6818a79 100644
--- a/gpu/command_buffer/service/logger.h
+++ b/gpu/command_buffer/service/logger.h
@@ -52,7 +52,6 @@
   // Uses the current marker to add information to logs.
   raw_ptr<const DebugMarkerManager> debug_marker_manager_;
   const LogMessageCallback log_message_callback_;
-  std::string this_in_hex_;
 
   int log_message_count_;
   bool log_synthesized_gl_errors_;