IMPORTANT DEBUGGING NOTE: batches of tests are run inside their own process. For debugging a test inside a debugger, use the --gtest_filter= flag along with --single-process-tests. Using sharding settings from environment. This is shard 0/1 Using 1 parallel jobs. Note: Google Test filter = GradientCacheCollisionTest.FloatStorageManagerNumStopsDesync [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from GradientCacheCollisionTest [ RUN ] GradientCacheCollisionTest.FloatStorageManagerNumStopsDesync === FloatStorageManager uniqueID-collision desync === gradient_a: ptr=0x7128873e7cc0 uniqueID=1 numStops=9 -> {dstData=0x7118873e8b00, bufferOffset=0} (allocated 45 floats) gradient_b: ptr=0x7128873ffb40 uniqueID=1 numStops=10000 -> {dstData=(nil), bufferOffset=0} (allocated 0 floats: CACHE HIT ON COLLISION) finalize() will bind an SSBO of 90 floats (360 bytes) $colorize_grad_buf for gradient_b reads up to index 49996 => GPU storage-buffer OOB READ of 49910 floats (199640 bytes) past the binding On macOS (Graphite/Dawn-Metal default, disable_robustness toggle set in dawn_context_provider.cc), the emitted MSL indexes a raw `device float*` with no bounds check; leaked bytes are rendered as RGBA and readable via getImageData(). ===================================================== ../../skia/ext/gradient_cache_collision_unittest.cc:169: Failure Expected: (off_b + 5 * kLargeStops) <= (ssbo_floats), actual: 50000 vs 90 VULNERABILITY CONFIRMED: gradient_b's uniforms encode {bufferOffset=0, numStops=10000} => shader reads indices [0, 49999] from a 90-float SSBO. FloatStorageManager::allocateGradientData() returned a cached offset for a colliding uniqueID without cross-checking numStops. Stack trace: #0 0x653c4c15571d (/chromium/chromium/src/out/asan/skia_unittests+0x191f71c) [ FAILED ] GradientCacheCollisionTest.FloatStorageManagerNumStopsDesync (40 ms) [----------] 1 test from GradientCacheCollisionTest (48 ms total) [----------] Global test environment tear-down [==========] 1 test from 1 test suite ran. (48 ms total) [ PASSED ] 0 tests. [ FAILED ] 1 test, listed below: [ FAILED ] GradientCacheCollisionTest.FloatStorageManagerNumStopsDesync 1 FAILED TEST [1/1] GradientCacheCollisionTest.FloatStorageManagerNumStopsDesync (40 ms) 1 test failed: GradientCacheCollisionTest.FloatStorageManagerNumStopsDesync (../../skia/ext/gradient_cache_collision_unittest.cc:61) Tests took 0 seconds.