==31140==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x11cdfac6447e at pc 0x7ff8e74db30c bp 0x004c03bfd2d0 sp 0x004c03bfd318
READ of size 3 at 0x11cdfac6447e thread T0
    #0 0x7ff8e74db30b in _asan_memcpy+0x25b (D:\chromium\src\out\asan-release\clang_rt.asan_dynamic-x86_64.dll+0x18004b30b)
    #1 0x7ff819469c24 in rx::CopyNativeVertexData<signed char,3,4,127> D:\chromium\src\third_party\angle\src\libANGLE\renderer\copyvertex.inc.h:102
    #2 0x7ff819bc3c8f in rx::VertexBuffer11::storeVertexAttributes D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\d3d11\VertexBuffer11.cpp:133
    #3 0x7ff819c96530 in rx::StaticVertexBufferInterface::storeStaticAttribute D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\VertexBuffer.cpp:299
    #4 0x7ff819c9a233 in rx::VertexDataManager::StoreStaticAttrib D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\VertexDataManager.cpp:406
    #5 0x7ff819bc2059 in rx::VertexArray11::updateDirtyAttribs D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\d3d11\VertexArray11.cpp:277
    #6 0x7ff819bc162c in rx::VertexArray11::syncStateForDraw D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\d3d11\VertexArray11.cpp:151
    #7 0x7ff819b6680a in rx::StateManager11::updateState D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\d3d11\StateManager11.cpp:2001
    #8 0x7ff819adc11d in rx::Context11::drawArrays D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\d3d11\Context11.cpp:285
    #9 0x7ff819165dc0 in GL_DrawArrays D:\chromium\src\third_party\angle\src\libGLESv2\entry_points_gles_2_0_autogen.cpp:1819
    #10 0x7ff8dd51de75 in gl::RealGLApi::glDrawArraysFn D:\chromium\src\ui\gl\gl_gl_api_implementation.cc:390
    #11 0x7ff835f7dc6f in gpu::gles2::GLES2DecoderPassthroughImpl::DoDrawArrays D:\chromium\src\gpu\command_buffer\service\gles2_cmd_decoder_passthrough_doers.cc:1155
    #12 0x7ff835f4235c in gpu::gles2::GLES2DecoderPassthroughImpl::DoCommandsImpl<0> D:\chromium\src\gpu\command_buffer\service\gles2_cmd_decoder_passthrough.cc:742
    #13 0x7ff8347fc37d in gpu::CommandBufferService::Flush D:\chromium\src\gpu\command_buffer\service\command_buffer_service.cc:267
    #14 0x7ff835ca6b54 in gpu::CommandBufferStub::OnAsyncFlush D:\chromium\src\gpu\ipc\service\command_buffer_stub.cc:504
    #15 0x7ff835ca5a1e in gpu::CommandBufferStub::ExecuteDeferredRequest D:\chromium\src\gpu\ipc\service\command_buffer_stub.cc:173
    #16 0x7ff835cd21ff in gpu::GpuChannel::ExecuteDeferredRequest D:\chromium\src\gpu\ipc\service\gpu_channel.cc:833
    #17 0x7ff835ce30c2 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,base::internal::BindState<1,1,0,void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel>,mojo::StructPtr<gpu::mojom::DeferredRequestParams> >,void (gpu::FenceSyncReleaseDelegate *)>::RunOnce D:\chromium\src\base\functional\bind_internal.h:982
    #18 0x7ff83484a66f in base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)> &&,gpu::FenceSyncReleaseDelegate *>,base::internal::BindState<0,1,1,base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate,base::unretained_traits::MayNotDangle,0> >,void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate,base::unretained_traits::MayNotDangle,0> >,0> D:\chromium\src\base\functional\bind_internal.h:1069
    #19 0x7ff8348197ef in gpu::Scheduler::ExecuteSequence D:\chromium\src\gpu\command_buffer\service\scheduler.cc:707
    #20 0x7ff834817915 in gpu::Scheduler::RunNextTask D:\chromium\src\gpu\command_buffer\service\scheduler.cc:625
    #21 0x7ff83481cc18 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(),gpu::Scheduler *>,base::internal::BindState<1,1,0,void (gpu::Scheduler::*)(),base::internal::UnretainedWrapper<gpu::Scheduler,base::unretained_traits::MayNotDangle,0> >,void ()>::RunOnce D:\chromium\src\base\functional\bind_internal.h:982
    #22 0x7ff8e8a420d8 in base::TaskAnnotator::RunTaskImpl D:\chromium\src\base\task\common\task_annotator.cc:229
    #23 0x7ff8e8ad6471 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl D:\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:475
    #24 0x7ff8e8ad52d3 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork D:\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:346
    #25 0x7ff8e88a5060 in base::MessagePumpDefault::Run D:\chromium\src\base\message_loop\message_pump_default.cc:42
    #26 0x7ff8e8ad820f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run D:\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:650
    #27 0x7ff8e8993cbd in base::RunLoop::Run D:\chromium\src\base\run_loop.cc:135
    #28 0x7ff8ad0dbdb9 in content::GpuMain D:\chromium\src\content\gpu\gpu_main.cc:479
    #29 0x7ff8b368229c in content::RunOtherNamedProcessTypeMain D:\chromium\src\content\app\content_main_runner_impl.cc:762
    #30 0x7ff8b3684f2f in content::ContentMainRunnerImpl::Run D:\chromium\src\content\app\content_main_runner_impl.cc:1152
    #31 0x7ff8b3678232 in content::RunContentProcess D:\chromium\src\content\app\content_main.cc:358
    #32 0x7ff8b3678990 in content::ContentMain D:\chromium\src\content\app\content_main.cc:371
    #33 0x7ff891542673 in ChromeMain D:\chromium\src\chrome\app\chrome_main.cc:191
    #34 0x7ff6bef73da6 in MainDllLoader::Launch D:\chromium\src\chrome\app\main_dll_loader_win.cc:204
    #35 0x7ff6bef71bdd in main D:\chromium\src\chrome\app\chrome_exe_main_win.cc:351
    #36 0x7ff6bf12c5b3 in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #37 0x7ff948197373 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017373)
    #38 0x7ff94919cc90 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18004cc90)

0x11cdfac6447e is located 2 bytes before 256-byte region [0x11cdfac64480,0x11cdfac64580)
allocated by thread T0 here:
    #0 0x7ff8e74dc8df in _asan_wrap_memcpy+0x73f (D:\chromium\src\out\asan-release\clang_rt.asan_dynamic-x86_64.dll+0x18004c8df)
    #1 0x7ff819f99bcd in angle::MemoryBuffer::resize D:\chromium\src\third_party\angle\src\common\MemoryBuffer.cpp:40
    #2 0x7ff819ad0a24 in rx::Buffer11::SystemMemoryStorage::resize D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\d3d11\Buffer11.cpp:1691
    #3 0x7ff819ac2e34 in rx::Buffer11::getData D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\d3d11\Buffer11.cpp:375
    #4 0x7ff819c99c00 in rx::VertexDataManager::StoreStaticAttrib D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\VertexDataManager.cpp:375
    #5 0x7ff819bc2059 in rx::VertexArray11::updateDirtyAttribs D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\d3d11\VertexArray11.cpp:277
    #6 0x7ff819bc162c in rx::VertexArray11::syncStateForDraw D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\d3d11\VertexArray11.cpp:151
    #7 0x7ff819b6680a in rx::StateManager11::updateState D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\d3d11\StateManager11.cpp:2001
    #8 0x7ff819adc11d in rx::Context11::drawArrays D:\chromium\src\third_party\angle\src\libANGLE\renderer\d3d\d3d11\Context11.cpp:285
    #9 0x7ff819165dc0 in GL_DrawArrays D:\chromium\src\third_party\angle\src\libGLESv2\entry_points_gles_2_0_autogen.cpp:1819
    #10 0x7ff8dd51de75 in gl::RealGLApi::glDrawArraysFn D:\chromium\src\ui\gl\gl_gl_api_implementation.cc:390
    #11 0x7ff835f7dc6f in gpu::gles2::GLES2DecoderPassthroughImpl::DoDrawArrays D:\chromium\src\gpu\command_buffer\service\gles2_cmd_decoder_passthrough_doers.cc:1155
    #12 0x7ff835f4235c in gpu::gles2::GLES2DecoderPassthroughImpl::DoCommandsImpl<0> D:\chromium\src\gpu\command_buffer\service\gles2_cmd_decoder_passthrough.cc:742
    #13 0x7ff8347fc37d in gpu::CommandBufferService::Flush D:\chromium\src\gpu\command_buffer\service\command_buffer_service.cc:267
    #14 0x7ff835ca6b54 in gpu::CommandBufferStub::OnAsyncFlush D:\chromium\src\gpu\ipc\service\command_buffer_stub.cc:504
    #15 0x7ff835ca5a1e in gpu::CommandBufferStub::ExecuteDeferredRequest D:\chromium\src\gpu\ipc\service\command_buffer_stub.cc:173
    #16 0x7ff835cd21ff in gpu::GpuChannel::ExecuteDeferredRequest D:\chromium\src\gpu\ipc\service\gpu_channel.cc:833
    #17 0x7ff835ce30c2 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&>,base::internal::BindState<1,1,0,void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, gpu::FenceSyncReleaseDelegate *),base::WeakPtr<gpu::GpuChannel>,mojo::StructPtr<gpu::mojom::DeferredRequestParams> >,void (gpu::FenceSyncReleaseDelegate *)>::RunOnce D:\chromium\src\base\functional\bind_internal.h:982
    #18 0x7ff83484a66f in base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)> &&,gpu::FenceSyncReleaseDelegate *>,base::internal::BindState<0,1,1,base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate,base::unretained_traits::MayNotDangle,0> >,void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,std::__Cr::tuple<base::internal::UnretainedWrapper<gpu::FenceSyncReleaseDelegate,base::unretained_traits::MayNotDangle,0> >,0> D:\chromium\src\base\functional\bind_internal.h:1069
    #19 0x7ff8348197ef in gpu::Scheduler::ExecuteSequence D:\chromium\src\gpu\command_buffer\service\scheduler.cc:707
    #20 0x7ff834817915 in gpu::Scheduler::RunNextTask D:\chromium\src\gpu\command_buffer\service\scheduler.cc:625
    #21 0x7ff83481cc18 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::Scheduler::*&&)(),gpu::Scheduler *>,base::internal::BindState<1,1,0,void (gpu::Scheduler::*)(),base::internal::UnretainedWrapper<gpu::Scheduler,base::unretained_traits::MayNotDangle,0> >,void ()>::RunOnce D:\chromium\src\base\functional\bind_internal.h:982
    #22 0x7ff8e8a420d8 in base::TaskAnnotator::RunTaskImpl D:\chromium\src\base\task\common\task_annotator.cc:229
    #23 0x7ff8e8ad6471 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl D:\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:475
    #24 0x7ff8e8ad52d3 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork D:\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:346
    #25 0x7ff8e88a5060 in base::MessagePumpDefault::Run D:\chromium\src\base\message_loop\message_pump_default.cc:42
    #26 0x7ff8e8ad820f in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run D:\chromium\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:650
    #27 0x7ff8e8993cbd in base::RunLoop::Run D:\chromium\src\base\run_loop.cc:135

SUMMARY: AddressSanitizer: heap-buffer-overflow D:\chromium\src\third_party\angle\src\libANGLE\renderer\copyvertex.inc.h:102 in rx::CopyNativeVertexData<signed char,3,4,127>
Shadow bytes around the buggy address:
  0x11cdfac64180: fd fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
  0x11cdfac64200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x11cdfac64280: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x11cdfac64300: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x11cdfac64380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x11cdfac64400: fd fa fa fa fa fa fa fa fa fa fa fa fa fa f7[fa]
  0x11cdfac64480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x11cdfac64500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x11cdfac64580: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x11cdfac64600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x11cdfac64680: fd fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==31140==ADDITIONAL INFO

==31140==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7ff834811d60 in gpu::Scheduler::TryScheduleSequence D:\chromium\src\gpu\command_buffer\service\scheduler.cc:432


Command line: `"D:\chromium\src\out\asan-release\chrome.exe" --type=gpu-process --user-data-dir=%TEMP%/poc --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAMAAAwAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1920,i,10490834724793029898,2388292894377688792,262144 --field-trial-handle=1984,i,3767446914577667278,12320467992890915198,262144 --variations-seed-version --pseudonymization-salt-handle=1988,i,2032624292129013399,2621659810708305538,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=stderr --mojo-platform-channel-handle=1980 /prefetch:2`


==31140==END OF ADDITIONAL INFO

==31140==ABORTING