Note: Google Test filter = SkiaGlyphRunUAF.*
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from SkiaGlyphRunUAF
[ RUN      ] SkiaGlyphRunUAF.ReentrantDrawTextBlobViaGlyphDrawable
=================================================================
==1844==ERROR: AddressSanitizer: heap-use-after-free on address 0x6d2b8c9e08e0 at pc 0x5d690f29e3d1 bp 0x7ffeed9ee9b0 sp 0x7ffeed9ee9a8
READ of size 8 at 0x6d2b8c9e08e0 thread T0
    #0 0x5d690f29e3d0 in SkDevice::simplifyGlyphRunRSXFormAndRedraw(SkCanvas*, sktext::GlyphRunList const&, SkPaint const&) third_party/skia/src/text/GlyphRun.h:54:61
    #1 0x5d690f271411 in SkCanvas::onDrawGlyphRunList(sktext::GlyphRunList const&, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:2434:28
    #2 0x5d690f271173 in SkCanvas::onDrawTextBlob(SkTextBlob const*, float, float, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:2419:11
    #3 0x5d690f272771 in SkCanvas::drawTextBlob(SkTextBlob const*, float, float, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:2569:11
    #4 0x5d690f116149 in (anonymous namespace)::SkiaGlyphRunUAF_ReentrantDrawTextBlobViaGlyphDrawable_Test::TestBody() third_party/skia/include/core/SkCanvas.h:2001:15
    #5 0x5d690ffaa30b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #6 0x5d690ffac937 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #7 0x5d690ffae9b3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #8 0x5d690ffdd404 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #9 0x5d690ffdbf7a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #10 0x5d6910a45540 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #11 0x5d690f189c31 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), mojo::core::test::MojoTestSuiteBase*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<mojo::core::test::MojoTestSuiteBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #12 0x5d6910a7006b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #13 0x5d6910a6f98b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #14 0x5d690f189964 in main mojo/core/test/run_all_unittests.cc:30:10
    #15 0x702b8d95b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

0x6d2b8c9e08e0 is located 160 bytes inside of 192-byte region [0x6d2b8c9e0840,0x6d2b8c9e0900)
freed by thread T0 here:
    #0 0x5d690f0de022 in operator delete(void*, unsigned long) (/chromium/chromium/src/out/asan/skia_unittests+0x18e4022) (BuildId: 01c452ea05b89c97)
    #1 0x5d690f54a60e in sktext::GlyphRun* std::__Cr::vector<sktext::GlyphRun, std::__Cr::allocator<sktext::GlyphRun>>::__emplace_back_slow_path<SkFont const&, SkSpan<SkPoint const>&, SkSpan<unsigned short const>&, SkSpan<char const>&, SkSpan<unsigned int const>&, SkSpan<SkPoint const>&>(SkFont const&, SkSpan<SkPoint const>&, SkSpan<unsigned short const>&, SkSpan<char const>&, SkSpan<unsigned int const>&, SkSpan<SkPoint const>&) gen/third_party/libc++/src/include/__new/allocate.h:62:10
    #2 0x5d690f547854 in sktext::GlyphRunBuilder::makeGlyphRun(SkFont const&, SkSpan<unsigned short const>, SkSpan<SkPoint const>, SkSpan<char const>, SkSpan<unsigned int const>, SkSpan<SkPoint const>) gen/third_party/libc++/src/include/__vector/vector.h:1138:21
    #3 0x5d690f548ee0 in sktext::GlyphRunBuilder::blobToGlyphRunList(SkTextBlob const&, SkPoint) third_party/skia/src/text/GlyphRun.cpp:279:15
    #4 0x5d690f271125 in SkCanvas::onDrawTextBlob(SkTextBlob const*, float, float, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:2418:50
    #5 0x5d690f272771 in SkCanvas::drawTextBlob(SkTextBlob const*, float, float, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:2569:11
    #6 0x5d690f116e83 in (anonymous namespace)::ReentrantDrawable::onDraw(SkCanvas*) third_party/skia/include/core/SkCanvas.h:2001:15
    #7 0x5d690f2bb862 in SkDrawable::draw(SkCanvas*, SkMatrix const*) third_party/skia/src/core/SkDrawable.cpp:48:11
    #8 0x5d690f273f28 in SkCanvas::drawDrawable(SkDrawable*, SkMatrix const*) third_party/skia/src/core/SkCanvas.cpp:2652:11
    #9 0x5d690f2bb862 in SkDrawable::draw(SkCanvas*, SkMatrix const*) third_party/skia/src/core/SkDrawable.cpp:48:11
    #10 0x5d690f2e8373 in skcpu::GlyphRunListPainter::drawForBitmapDevice(SkCanvas*, skcpu::BitmapDevicePainter const*, sktext::GlyphRunList const&, SkPaint const&, SkMatrix const&) third_party/skia/src/core/SkGlyphRunPainter.cpp:319:31
    #11 0x5d690f20ba6c in SkBitmapDevice::onDrawGlyphRunList(SkCanvas*, sktext::GlyphRunList const&, SkPaint const&) third_party/skia/src/core/SkBitmapDevice.cpp:546:17
    #12 0x5d690f29e1b5 in SkDevice::simplifyGlyphRunRSXFormAndRedraw(SkCanvas*, sktext::GlyphRunList const&, SkPaint const&) third_party/skia/src/core/SkDevice.cpp:432:15
    #13 0x5d690f271411 in SkCanvas::onDrawGlyphRunList(sktext::GlyphRunList const&, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:2434:28
    #14 0x5d690f271173 in SkCanvas::onDrawTextBlob(SkTextBlob const*, float, float, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:2419:11
    #15 0x5d690f272771 in SkCanvas::drawTextBlob(SkTextBlob const*, float, float, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:2569:11
    #16 0x5d690f116149 in (anonymous namespace)::SkiaGlyphRunUAF_ReentrantDrawTextBlobViaGlyphDrawable_Test::TestBody() third_party/skia/include/core/SkCanvas.h:2001:15
    #17 0x5d690ffaa30b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #18 0x5d690ffac937 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #19 0x5d690ffae9b3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #20 0x5d690ffdd404 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #21 0x5d690ffdbf7a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #22 0x5d6910a45540 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #23 0x5d690f189c31 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), mojo::core::test::MojoTestSuiteBase*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<mojo::core::test::MojoTestSuiteBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #24 0x5d6910a7006b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #25 0x5d6910a6f98b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #26 0x5d690f189964 in main mojo/core/test/run_all_unittests.cc:30:10
    #27 0x702b8d95b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

previously allocated by thread T0 here:
    #0 0x5d690f0dd41d in operator new(unsigned long) (/chromium/chromium/src/out/asan/skia_unittests+0x18e341d) (BuildId: 01c452ea05b89c97)
    #1 0x5d690f54a23f in sktext::GlyphRun* std::__Cr::vector<sktext::GlyphRun, std::__Cr::allocator<sktext::GlyphRun>>::__emplace_back_slow_path<SkFont const&, SkSpan<SkPoint const>&, SkSpan<unsigned short const>&, SkSpan<char const>&, SkSpan<unsigned int const>&, SkSpan<SkPoint const>&>(SkFont const&, SkSpan<SkPoint const>&, SkSpan<unsigned short const>&, SkSpan<char const>&, SkSpan<unsigned int const>&, SkSpan<SkPoint const>&) gen/third_party/libc++/src/include/__new/allocate.h:42:28
    #2 0x5d690f547854 in sktext::GlyphRunBuilder::makeGlyphRun(SkFont const&, SkSpan<unsigned short const>, SkSpan<SkPoint const>, SkSpan<char const>, SkSpan<unsigned int const>, SkSpan<SkPoint const>) gen/third_party/libc++/src/include/__vector/vector.h:1138:21
    #3 0x5d690f548ee0 in sktext::GlyphRunBuilder::blobToGlyphRunList(SkTextBlob const&, SkPoint) third_party/skia/src/text/GlyphRun.cpp:279:15
    #4 0x5d690f271125 in SkCanvas::onDrawTextBlob(SkTextBlob const*, float, float, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:2418:50
    #5 0x5d690f272771 in SkCanvas::drawTextBlob(SkTextBlob const*, float, float, SkPaint const&) third_party/skia/src/core/SkCanvas.cpp:2569:11
    #6 0x5d690f116149 in (anonymous namespace)::SkiaGlyphRunUAF_ReentrantDrawTextBlobViaGlyphDrawable_Test::TestBody() third_party/skia/include/core/SkCanvas.h:2001:15
    #7 0x5d690ffaa30b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc
    #8 0x5d690ffac937 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11
    #9 0x5d690ffae9b3 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30
    #10 0x5d690ffdd404 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44
    #11 0x5d690ffdbf7a in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc
    #12 0x5d6910a45540 in base::TestSuite::Run() base/test/test_suite.cc:440:16
    #13 0x5d690f189c31 in base::internal::Invoker<base::internal::FunctorTraits<int (base::TestSuite::*&&)(), mojo::core::test::MojoTestSuiteBase*>, base::internal::BindState<true, true, false, int (base::TestSuite::*)(), base::internal::UnretainedWrapper<mojo::core::test::MojoTestSuiteBase, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12
    #14 0x5d6910a7006b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/functional/callback.h:155:12
    #15 0x5d6910a6f98b in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10
    #16 0x5d690f189964 in main mojo/core/test/run_all_unittests.cc:30:10
    #17 0x702b8d95b249  (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4)

SUMMARY: AddressSanitizer: heap-use-after-free third_party/skia/src/text/GlyphRun.h:54:61 in SkDevice::simplifyGlyphRunRSXFormAndRedraw(SkCanvas*, sktext::GlyphRunList const&, SkPaint const&)
Shadow bytes around the buggy address:
  0x6d2b8c9e0600: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x6d2b8c9e0680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6d2b8c9e0700: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x6d2b8c9e0780: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
  0x6d2b8c9e0800: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x6d2b8c9e0880: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
  0x6d2b8c9e0900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6d2b8c9e0980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6d2b8c9e0a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6d2b8c9e0a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6d2b8c9e0b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==1844==ADDITIONAL INFO

==1844==Note: Please include this section with the ASan report.
Task trace:


==1844==END OF ADDITIONAL INFO

==1844==ABORTING