================================================================= ==911549==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x73d2e19271f8 at pc 0x6362c40eef88 bp 0x7fff1bd392a0 sp 0x7fff1bd39298 READ of size 8 at 0x73d2e19271f8 thread T0 (chrome) [911501:911501:0406/183341.366755:INFO:CONSOLE:0] "vkCreateQueryPool failed with VK_ERROR_OUT_OF_HOST_MEMORY - While calling [Device].CreateQuerySet([QuerySetDescriptor]). at CheckVkOOMThenSuccessImpl (../../third_party/dawn/src/dawn/native/vulkan/VulkanError.cpp:119) ", source: http://localhost:8000/dawn/archive/vulkan_queryset_oom_type_confusion/poc.html (0) #0 0x6362c40eef87 in dawn::native::vulkan::QuerySet::GetHandle() const third_party/dawn/src/dawn/native/vulkan/QuerySetVk.cpp:80:12 #1 0x6362c407a498 in dawn::native::vulkan::CommandBuffer::RecordRenderPass(dawn::native::vulkan::CommandRecordingContext*, dawn::native::BeginRenderPassCmd*) third_party/dawn/src/dawn/native/vulkan/CommandBufferVk.cpp:1792:77 #2 0x6362c4076ed0 in dawn::native::vulkan::CommandBuffer::RecordCommands(dawn::native::vulkan::CommandRecordingContext*) third_party/dawn/src/dawn/native/vulkan/CommandBufferVk.cpp:1178:26 #3 0x6362c40f0333 in dawn::native::vulkan::Queue::SubmitImpl(unsigned int, dawn::native::CommandBufferBase* const*) third_party/dawn/src/dawn/native/vulkan/QueueVk.cpp:102:42 #4 0x6362c3df1b68 in dawn::native::QueueBase::SubmitInternal(unsigned int, dawn::native::CommandBufferBase* const*) third_party/dawn/src/dawn/native/Queue.cpp:672:14 #5 0x6362c3df1540 in dawn::native::QueueBase::APISubmit(unsigned int, dawn::native::CommandBufferBase* const*) third_party/dawn/src/dawn/native/Queue.cpp:171:25 #6 0x6362c3b7769a in dawn::native::NativeQueueSubmit(WGPUQueueImpl*, unsigned long, WGPUCommandBufferImpl* const*) gen/third_party/dawn/src/dawn/native/ProcTable.cpp:1410:15 #7 0x6362c36df0b3 in dawn::wire::server::Server::DoQueueSubmit(WGPUQueueImpl*, unsigned long, WGPUCommandBufferImpl* const*) gen/third_party/dawn/src/dawn/wire/server/ServerDoers_autogen.cpp:668:9 #8 0x6362c36f5471 in dawn::wire::server::Server::HandleCommands(char const volatile*, unsigned long) gen/third_party/dawn/src/dawn/wire/server/ServerHandlers_autogen.cpp:921:18 #9 0x6362e3aba677 in gpu::webgpu::(anonymous namespace)::DawnWireServer::HandleCommands(char const volatile*, unsigned long) gpu/command_buffer/service/webgpu_decoder_impl.cc:155:33 #10 0x6362e3abaaed in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::HandleDawnCommands(unsigned int, void const volatile*) gpu/command_buffer/service/webgpu_decoder_impl.cc:2001:22 #11 0x6362e3aae9e2 in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::DoCommands(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/webgpu_decoder_impl.cc:1946:18 #12 0x6362cce77814 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35 #13 0x6362e31e320b in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector> const&) gpu/ipc/service/command_buffer_stub.cc:504:22 #14 0x6362e31e2471 in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7 #15 0x6362e320555c in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:833:13 #16 0x6362e3213547 in void base::internal::DecayedFunctorTraits, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>::Invoke, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12 #17 0x6362e3213329 in base::internal::Invoker, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>, base::internal::BindState, gpu::FenceSyncReleaseDelegate*), base::WeakPtr, mojo::StructPtr>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5 #18 0x6362cceba211 in void base::internal::Invoker&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState, base::internal::UnretainedWrapper>, void ()>::RunImpl, std::__Cr::tuple>, 0ul>(base::OnceCallback&&, std::__Cr::tuple>&&, std::__Cr::integer_sequence) base/functional/callback.h:155:12 #19 0x6362cce8e957 in gpu::Scheduler::ExecuteSequence(base::IdType) base/functional/callback.h:155:12 #20 0x6362cce8c988 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:625:3 #21 0x6362cce90571 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #22 0x6362d9d11e76 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #23 0x6362d9d89519 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #24 0x6362d9d8838a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #25 0x6362d9f37098 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #26 0x6362d9f3a658 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 #27 0x7752e45d5584 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5d584) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #28 0x7752e4634976 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xbc976) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #29 0x7752e45d4a22 in g_main_context_iteration (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ca22) (BuildId: 116e142b9b52c8a4dfd403e759e71ab8f95d8bb3) #30 0x6362d9f376b3 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:770:30 #31 0x6362d9d8ac27 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #32 0x6362d9c8c7f0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #33 0x6362e557f0d7 in content::GpuMain(content::MainFunctionParams) content/gpu/gpu_main.cc:484:14 #34 0x6362d583287f in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14 #35 0x6362d5833baf in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12 #36 0x6362d58368b8 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10 #37 0x6362d5830291 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #38 0x6362d583088c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 #39 0x6362c1d56b39 in ChromeMain chrome/app/chrome_main.cc:191:12 #40 0x7752e302a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #41 0x7752e302a28a in __libc_start_main csu/../csu/libc-start.c:360:3 #42 0x6362c1c7c029 in _start (/home/[redacted]/chromium/src/out/asan/chrome+0x10d3d029) (BuildId: 15526e47a2dec23b) 0x73d2e19271f8 is located 0 bytes after 88-byte region [0x73d2e19271a0,0x73d2e19271f8) allocated by thread T0 (chrome) here: #0 0x6362c1d553fd in operator new(unsigned long) (/home/[redacted]/chromium/src/out/asan/chrome+0x10e163fd) (BuildId: 15526e47a2dec23b) #1 0x6362c3deff83 in dawn::native::QuerySetBase::MakeError(dawn::native::DeviceBase*, dawn::native::QuerySetDescriptor const*) third_party/dawn/src/dawn/native/QuerySet.cpp:114:23 #2 0x6362c3ce8f48 in dawn::native::DeviceBase::APICreateQuerySet(dawn::native::QuerySetDescriptor const*) third_party/dawn/src/dawn/native/Device.cpp:1397:18 #3 0x6362c40a8efe in dawn::native::vulkan::Device::GetEmptyPassQuerySet() third_party/dawn/src/dawn/native/vulkan/DeviceVk.cpp:1232:30 #4 0x6362c407a462 in dawn::native::vulkan::CommandBuffer::RecordRenderPass(dawn::native::vulkan::CommandRecordingContext*, dawn::native::BeginRenderPassCmd*) third_party/dawn/src/dawn/native/vulkan/CommandBufferVk.cpp:1791:54 #5 0x6362c4076ed0 in dawn::native::vulkan::CommandBuffer::RecordCommands(dawn::native::vulkan::CommandRecordingContext*) third_party/dawn/src/dawn/native/vulkan/CommandBufferVk.cpp:1178:26 #6 0x6362c40f0333 in dawn::native::vulkan::Queue::SubmitImpl(unsigned int, dawn::native::CommandBufferBase* const*) third_party/dawn/src/dawn/native/vulkan/QueueVk.cpp:102:42 #7 0x6362c3df1b68 in dawn::native::QueueBase::SubmitInternal(unsigned int, dawn::native::CommandBufferBase* const*) third_party/dawn/src/dawn/native/Queue.cpp:672:14 #8 0x6362c3df1540 in dawn::native::QueueBase::APISubmit(unsigned int, dawn::native::CommandBufferBase* const*) third_party/dawn/src/dawn/native/Queue.cpp:171:25 #9 0x6362c3b7769a in dawn::native::NativeQueueSubmit(WGPUQueueImpl*, unsigned long, WGPUCommandBufferImpl* const*) gen/third_party/dawn/src/dawn/native/ProcTable.cpp:1410:15 #10 0x6362c36df0b3 in dawn::wire::server::Server::DoQueueSubmit(WGPUQueueImpl*, unsigned long, WGPUCommandBufferImpl* const*) gen/third_party/dawn/src/dawn/wire/server/ServerDoers_autogen.cpp:668:9 #11 0x6362c36f5471 in dawn::wire::server::Server::HandleCommands(char const volatile*, unsigned long) gen/third_party/dawn/src/dawn/wire/server/ServerHandlers_autogen.cpp:921:18 #12 0x6362e3aba677 in gpu::webgpu::(anonymous namespace)::DawnWireServer::HandleCommands(char const volatile*, unsigned long) gpu/command_buffer/service/webgpu_decoder_impl.cc:155:33 #13 0x6362e3abaaed in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::HandleDawnCommands(unsigned int, void const volatile*) gpu/command_buffer/service/webgpu_decoder_impl.cc:2001:22 #14 0x6362e3aae9e2 in gpu::webgpu::(anonymous namespace)::WebGPUDecoderImpl::DoCommands(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/webgpu_decoder_impl.cc:1946:18 #15 0x6362cce77814 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:267:35 #16 0x6362e31e320b in gpu::CommandBufferStub::OnAsyncFlush(int, unsigned int, std::__Cr::vector> const&) gpu/ipc/service/command_buffer_stub.cc:504:22 #17 0x6362e31e2471 in gpu::CommandBufferStub::ExecuteDeferredRequest(gpu::mojom::DeferredCommandBufferRequestParams&, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/command_buffer_stub.cc:173:7 #18 0x6362e320555c in gpu::GpuChannel::ExecuteDeferredRequest(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*) gpu/ipc/service/gpu_channel.cc:833:13 #19 0x6362e3213547 in void base::internal::DecayedFunctorTraits, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>::Invoke, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr, gpu::FenceSyncReleaseDelegate*>(void (gpu::GpuChannel::*)(mojo::StructPtr, gpu::FenceSyncReleaseDelegate*), base::WeakPtr const&, mojo::StructPtr&&, gpu::FenceSyncReleaseDelegate*&&) base/functional/bind_internal.h:740:12 #20 0x6362e3213329 in base::internal::Invoker, gpu::FenceSyncReleaseDelegate*), base::WeakPtr&&, mojo::StructPtr&&>, base::internal::BindState, gpu::FenceSyncReleaseDelegate*), base::WeakPtr, mojo::StructPtr>, void (gpu::FenceSyncReleaseDelegate*)>::RunOnce(base::internal::BindStateBase*, gpu::FenceSyncReleaseDelegate*) base/functional/bind_internal.h:956:5 #21 0x6362cceba211 in void base::internal::Invoker&&, gpu::FenceSyncReleaseDelegate*>, base::internal::BindState, base::internal::UnretainedWrapper>, void ()>::RunImpl, std::__Cr::tuple>, 0ul>(base::OnceCallback&&, std::__Cr::tuple>&&, std::__Cr::integer_sequence) base/functional/callback.h:155:12 #22 0x6362cce8e957 in gpu::Scheduler::ExecuteSequence(base::IdType) base/functional/callback.h:155:12 #23 0x6362cce8c988 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:625:3 #24 0x6362cce90571 in base::internal::Invoker, base::internal::BindState>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #25 0x6362d9d11e76 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #26 0x6362d9d89519 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #27 0x6362d9d8838a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #28 0x6362d9f37098 in base::MessagePumpGlib::HandleDispatch() base/message_loop/message_pump_glib.cc:736:46 #29 0x6362d9f3a658 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:355:43 SUMMARY: AddressSanitizer: heap-buffer-overflow third_party/dawn/src/dawn/native/vulkan/QuerySetVk.cpp:80:12 in dawn::native::vulkan::QuerySet::GetHandle() const Shadow bytes around the buggy address: 0x73d2e1926f00: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd 0x73d2e1926f80: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd 0x73d2e1927000: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd 0x73d2e1927080: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd 0x73d2e1927100: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd =>0x73d2e1927180: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00[fa] 0x73d2e1927200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x73d2e1927280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x73d2e1927300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x73d2e1927380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x73d2e1927400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==911549==ADDITIONAL INFO ==911549==Note: Please include this section with the ASan report. Task trace: #0 0x6362cce8ce62 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:647:27 #1 0x6362cce8ce62 in gpu::Scheduler::RunNextTask() gpu/command_buffer/service/scheduler.cc:647:27 #2 0x6362cce87bb6 in gpu::Scheduler::TryScheduleSequence(gpu::Scheduler::Sequence*) gpu/command_buffer/service/scheduler.cc:432:29 Command line: `/proc/self/exe --type=gpu-process --no-sandbox --ozone-platform=x11 --crashpad-handler-pid=911503 --enable-crash-reporter=, --user-data-dir=/tmp/x --change-stack-guard-on-fork=enable --gpu-preferences=UAAAAAAAAAAgAQAEAAAAAAAAAAAAAMAAAQAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAFAAAAAAAAAAAQAAAAAAAAAQAAAAAQAAAAgAAAAAAAAALQAAACUAAAB2dWxrYW5fYWRkX3dvcmtfdG9fZW1wdHlfcmVzb2x2ZV9wYXNzAAAACAAAAAAAAAA= --disable-in-process-stack-traces --shared-files --metrics-shmem-handle=4,i,7356134395098904143,5038668657465941214,262144 --field-trial-handle=3,i,14104538206855996188,2330613041052655151,262144 --variations-seed-version --pseudonymization-salt-handle=7,i,8306754576148915557,12823424800566735379,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=stderr --v=0` ==911549==END OF ADDITIONAL INFO ==911549==ABORTING