Note: Google Test filter = *ReadPixelsR16ExtZeroSizeValidationOOB/0
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from Service/GLES3DecoderManualInitTest
[ RUN      ] Service/GLES3DecoderManualInitTest.ReadPixelsR16ExtZeroSizeValidationOOB/0
=================================================================
==5787==ERROR: AddressSanitizer: use-after-poison on address 0x741132b70800 at pc 0x5b51c00499f5 bp 0x7fffb0f52550 sp 0x7fffb0f51d20
WRITE of size 2048 at 0x741132b70800 thread T0
    #0 0x5b51c00499f4 in __asan_memset (/chromium/chromium/src/out/asan/gpu_unittests+0x4f509f4) (BuildId: c66bf63ed9eed9c0)
    #1 0x5b51c134cc64 in void std::__Cr::__function::__policy_func<void (int, int, int, int, unsigned int, unsigned int, void*)>::__call_func<gpu::gles2::GLES3DecoderManualInitTest_ReadPixelsR16ExtZeroSizeValidationOOB_Test::TestBody()::$_1>(std::__Cr::__function::__policy_storage const*, int, int, int, int, unsigned int, unsigned int, void*) gpu/command_buffer/service/gles2_cmd_decoder_unittest_framebuffers.cc:907:21
    #2 0x5b51c81349f5 in testing::internal::FunctionMocker<void (int, int, int, int, unsigned int, unsigned int, void*)>::PerformAction(void const*, std::__Cr::tuple<int, int, int, int, unsigned int, unsigned int, void*>&&, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&) const gen/third_party/libc++/src/include/__functional/function.h:502:12
    #3 0x5b51c8133bc6 in testing::internal::FunctionMocker<void (int, int, int, int, unsigned int, unsigned int, void*)>::InvokeWith(std::__Cr::tuple<int, int, int, int, unsigned int, unsigned int, void*>&&) third_party/googletest/src/googlemock/include/gmock/gmock-spec-builders.h:1869:12
    #4 0x5b51c7c85fdd in gl::MockGLInterface::Mock_glReadPixels(int, int, int, int, unsigned int, unsigned int, void*) third_party/googletest/src/googlemock/include/gmock/gmock-spec-builders.h:1548:12
    #5 0x5b51c7968e70 in gl::GLApiBase::glReadPixelsFn(int, int, int, int, unsigned int, unsigned int, void*) ui/gl/gl_bindings_autogen_gl.cc:3872:3
    #6 0x5b51c79f0545 in gl::RealGLApi::glReadPixelsFn(int, int, int, int, unsigned int, unsigned int, void*) ui/gl/gl_gl_api_implementation.cc:377:14
    #7 0x5b51cb33e0cd in gpu::gles2::GLES2DecoderImpl::HandleReadPixels(unsigned int, void const volatile*) gpu/command_buffer/service/gles2_cmd_decoder.cc
    #8 0x5b51cb38fb79 in gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder.cc:4780:18
    #9 0x5b51c12a58d4 in gpu::gles2::GLES3DecoderManualInitTest_ReadPixelsR16ExtZeroSizeValidationOOB_Test::TestBody() gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.h:109:22
    #10 0x5b51c41f1e3b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #11 0x5b51c41f49a7 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #12 0x5b51c41f6a23 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #13 0x5b51c4225474 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #14 0x5b51c4223fea in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #15 0x5b51c6bed060 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #16 0x5b51c05c6381 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), (anonymous namespace)::GpuTestSuite*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<(anonymous namespace)::GpuTestSuite, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #17 0x5b51c6bf84ab in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #18 0x5b51c6bf7dcb in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #19 0x5b51c05c6077 in main gpu/command_buffer/common/unittest_main.cc:38:10
    #20 0x741133a45249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

Address 0x741132b70800 is a wild pointer inside of access range of size 0x000000000800.
SUMMARY: AddressSanitizer: use-after-poison (/chromium/chromium/src/out/asan/gpu_unittests+0x4f509f4) (BuildId: c66bf63ed9eed9c0) in __asan_memset
Shadow bytes around the buggy address:
  0x741132b70580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x741132b70600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x741132b70680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x741132b70700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x741132b70780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x741132b70800:[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x741132b70880: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x741132b70900: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x741132b70980: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x741132b70a00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x741132b70a80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

NOTE: the stack trace above identifies the code that *accessed* the poisoned memory.
To identify the code that *poisoned* the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=<size>.