==918==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ba47ce774ec at pc 0x557d85a0ffed bp 0x7ffe44e942d0 sp 0x7ffe44e942c8 READ of size 1 at 0x7ba47ce774ec thread T0 (chrome) #0 0x557d85a0ffec in blink::ShapeResultBloberizer::AddEmphasisMarkToBloberizer(void*, unsigned int, float, unsigned int, float, blink::CanvasRotationInVertical) third_party/blink/renderer/platform/fonts/shaping/shape_result_bloberizer.cc:381:58 #1 0x557d85a288af in blink::ShapeResultView::ForEachGraphemeClusters(blink::StringView const&, float, unsigned int, unsigned int, unsigned int, void (*)(void*, unsigned int, float, unsigned int, float, blink::CanvasRotationInVertical), void*) const third_party/blink/renderer/platform/fonts/shaping/shape_result_view.cc:554:9 #2 0x557d85a11ef8 in blink::ShapeResultBloberizer::FillTextEmphasisGlyphsNG::FillTextEmphasisGlyphsNG(blink::FontDescription const&, blink::StringView const&, unsigned int, unsigned int, blink::ShapeResultView const*, blink::GlyphData const&) third_party/blink/renderer/platform/fonts/shaping/shape_result_bloberizer.cc:583:22 #3 0x557d858f0ad3 in blink::Font::DrawEmphasisMarks(cc::PaintCanvas*, blink::TextFragmentPaintInfo const&, blink::AtomicString const&, gfx::PointF const&, cc::PaintFlags const&) const third_party/blink/renderer/platform/fonts/font.cc:125:51 #4 0x557d85bd7db3 in blink::GraphicsContext::DrawEmphasisMarks(blink::Font const&, blink::TextFragmentPaintInfo const&, blink::AtomicString const&, gfx::PointF const&, blink::AutoDarkMode const&) third_party/blink/renderer/platform/graphics/graphics_context.cc:488:10 #5 0x557d84c7bec9 in blink::TextPainter::Paint(blink::TextFragmentPaintInfo const&, blink::TextPaintStyle const&, int, blink::AutoDarkMode const&, blink::TextPainter::ShadowMode) third_party/blink/renderer/core/paint/text_painter.cc:397:23 #6 0x557d84c78b6f in blink::TextFragmentPainter::Paint(blink::PaintInfo const&, blink::PhysicalFixedOffset> const&) third_party/blink/renderer/core/paint/text_fragment_painter.cc:555:20 #7 0x557d84a06fdb in blink::BoxFragmentPainter::PaintTextItem(blink::InlineCursor const&, blink::PaintInfo const&, blink::PhysicalFixedOffset> const&, blink::PhysicalFixedOffset> const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:2077:16 #8 0x557d849f6e46 in blink::BoxFragmentPainter::PaintInlineItems(blink::PaintInfo const&, blink::PhysicalFixedOffset> const&, blink::PhysicalFixedOffset> const&, blink::InlineCursor*) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1901:11 #9 0x557d849fc70b in blink::BoxFragmentPainter::PaintLineBoxChildItems(blink::InlineCursor*, blink::PaintInfo const&, blink::PhysicalFixedOffset> const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1994:7 #10 0x557d849f7b58 in blink::BoxFragmentPainter::PaintLineBoxes(blink::PaintInfo const&, blink::PhysicalFixedOffset> const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1015:3 #11 0x557d849f090b in blink::BoxFragmentPainter::PaintObject(blink::PaintInfo const&, blink::PhysicalFixedOffset> const&, bool) third_party/blink/renderer/core/paint/box_fragment_painter.cc:853:9 #12 0x557d849ed94d in blink::BoxFragmentPainter::PaintInternal(blink::PaintInfo const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:702:7 #13 0x557d849ec258 in blink::BoxFragmentPainter::Paint(blink::PaintInfo const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:581:5 #14 0x557d849fd424 in blink::BoxFragmentPainter::PaintBlockChild(blink::PhysicalFragmentLink const&, blink::PaintInfo const&, blink::PaintInfo const&, blink::PhysicalFixedOffset>) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1116:44 #15 0x557d849f9d4c in blink::BoxFragmentPainter::PaintBlockChildren(blink::PaintInfo const&, blink::PhysicalFixedOffset>) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1080:5 #16 0x557d849f0a49 in blink::BoxFragmentPainter::PaintObject(blink::PaintInfo const&, blink::PhysicalFixedOffset> const&, bool) third_party/blink/renderer/core/paint/box_fragment_painter.cc:857:9 #17 0x557d849ed94d in blink::BoxFragmentPainter::PaintInternal(blink::PaintInfo const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:702:7 #18 0x557d849ec258 in blink::BoxFragmentPainter::Paint(blink::PaintInfo const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:581:5 #19 0x557d849fd424 in blink::BoxFragmentPainter::PaintBlockChild(blink::PhysicalFragmentLink const&, blink::PaintInfo const&, blink::PaintInfo const&, blink::PhysicalFixedOffset>) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1116:44 #20 0x557d849f9d4c in blink::BoxFragmentPainter::PaintBlockChildren(blink::PaintInfo const&, blink::PhysicalFixedOffset>) third_party/blink/renderer/core/paint/box_fragment_painter.cc:1080:5 #21 0x557d849f0a49 in blink::BoxFragmentPainter::PaintObject(blink::PaintInfo const&, blink::PhysicalFixedOffset> const&, bool) third_party/blink/renderer/core/paint/box_fragment_painter.cc:857:9 #22 0x557d849ed94d in blink::BoxFragmentPainter::PaintInternal(blink::PaintInfo const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:702:7 #23 0x557d849ec258 in blink::BoxFragmentPainter::Paint(blink::PaintInfo const&) third_party/blink/renderer/core/paint/box_fragment_painter.cc:581:5 #24 0x557d84b7aeb3 in blink::PaintLayerPainter::PaintFragmentWithPhase(blink::PaintPhase, blink::FragmentData const&, unsigned int, blink::PhysicalBoxFragment const*, blink::GraphicsContext&, unsigned int) third_party/blink/renderer/core/paint/paint_layer_painter.cc:708:44 #25 0x557d84b7799b in blink::PaintLayerPainter::PaintWithPhase(blink::PaintPhase, blink::GraphicsContext&, unsigned int) third_party/blink/renderer/core/paint/paint_layer_painter.cc:748:5 #26 0x557d84b78f7b in blink::PaintLayerPainter::PaintForegroundPhases(blink::GraphicsContext&, unsigned int) third_party/blink/renderer/core/paint/paint_layer_painter.cc:773:3 #27 0x557d84b74031 in blink::PaintLayerPainter::Paint(blink::GraphicsContext&, unsigned int) third_party/blink/renderer/core/paint/paint_layer_painter.cc:471:7 #28 0x557d84b7815a in blink::PaintLayerPainter::PaintChildren(blink::PaintLayerIteration, blink::GraphicsContext&, unsigned int) third_party/blink/renderer/core/paint/paint_layer_painter.cc:639:35 #29 0x557d84b7413a in blink::PaintLayerPainter::Paint(blink::GraphicsContext&, unsigned int) third_party/blink/renderer/core/paint/paint_layer_painter.cc:483:7 #30 0x557d84ab3fb4 in blink::FramePainter::Paint(blink::GraphicsContext&, unsigned int) third_party/blink/renderer/core/paint/frame_painter.cc:71:17 #31 0x557d82d03108 in blink::LocalFrameView::PaintTree(blink::PaintBenchmarkMode, std::__Cr::optional&) third_party/blink/renderer/core/frame/local_frame_view.cc:4226:23 #32 0x557d82d086f9 in blink::LocalFrameView::RunPaintLifecyclePhase(blink::PaintBenchmarkMode) third_party/blink/renderer/core/frame/local_frame_view.cc:2921:5 #33 0x557d82d05ff1 in blink::LocalFrameView::UpdateLifecyclePhasesInternal(blink::DocumentLifecycle::LifecycleState, blink::DocumentUpdateReason) third_party/blink/renderer/core/frame/local_frame_view.cc:2605:3 #34 0x557d82d0181c in blink::LocalFrameView::UpdateLifecyclePhases(blink::DocumentLifecycle::LifecycleState, blink::DocumentUpdateReason) third_party/blink/renderer/core/frame/local_frame_view.cc:2345:3 #35 0x557d82d00fad in blink::LocalFrameView::UpdateAllLifecyclePhases(blink::DocumentUpdateReason) third_party/blink/renderer/core/frame/local_frame_view.cc:2060:54 #36 0x557d84968d3d in blink::PageAnimator::UpdateAllLifecyclePhases(blink::LocalFrame&, blink::DocumentUpdateReason) third_party/blink/renderer/core/page/page_animator.cc:394:9 #37 0x557d82e70a7b in blink::WebFrameWidgetImpl::UpdateLifecycle(blink::WebLifecycleUpdate, blink::DocumentUpdateReason) third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:1706:14 #38 0x557d85ede6ab in non-virtual thunk to blink::WidgetBase::UpdateVisualState() third_party/blink/renderer/platform/widget/widget_base.cc:1048:12 #39 0x557d7ae10aec in cc::LayerTreeHost::RequestMainFrameUpdate(bool) cc/trees/layer_tree_host.cc:408:12 #40 0x557d7b117029 in cc::ProxyMain::BeginMainFrame(std::__Cr::unique_ptr>) cc/trees/proxy_main.cc:337:21 #41 0x557d7b13f775 in base::internal::Invoker>), base::WeakPtr&&, std::__Cr::unique_ptr>&&>, base::internal::BindState>), base::WeakPtr, std::__Cr::unique_ptr>>, void ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #42 0x557d752f1326 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) base/functional/callback.h:155:12 #43 0x557d753689c9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) base/task/common/task_annotator.h:112:5 #44 0x557d7536783a in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340:40 #45 0x557d751af927 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:42:55 #46 0x557d7536a0d7 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:644:12 #47 0x557d7526bca0 in base::RunLoop::Run(base::Location const&) base/run_loop.cc:135:14 #48 0x557d815f51fb in content::RendererMain(content::MainFunctionParams) content/renderer/renderer_main.cc:337:16 #49 0x557d70e096ef in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:664:14 #50 0x557d70e0aa1f in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:771:12 #51 0x557d70e0d728 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1152:10 #52 0x557d70e07101 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:358:36 #53 0x557d70e076fc in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:371:10 #54 0x557d5d33cb39 in ChromeMain chrome/app/chrome_main.cc:191:12 #55 0x7f747ec2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) Address 0x7ba47ce774ec is a wild pointer inside of access range of size 0x000000000001. SUMMARY: AddressSanitizer: heap-buffer-overflow third_party/blink/renderer/platform/fonts/shaping/shape_result_bloberizer.cc:381:58 in blink::ShapeResultBloberizer::AddEmphasisMarkToBloberizer(void*, unsigned int, float, unsigned int, float, blink::CanvasRotationInVertical) Shadow bytes around the buggy address: 0x7ba47ce77200: f7 fa 00 00 00 fa f7 fa fd fd fd fd f7 fa 00 00 0x7ba47ce77280: 00 fa f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa 0x7ba47ce77300: 00 00 00 fa f7 fa fd fd fd fd f7 fa 00 00 00 fa 0x7ba47ce77380: f7 fa fd fd fd fd f7 fa 00 00 00 fa f7 fa 00 00 0x7ba47ce77400: 00 fa f7 fa fd fd fd fd f7 fa fd fd fd fd f7 fa =>0x7ba47ce77480: 00 00 00 fa f7 fa fd fd fd fd f7 fa 00[00]00 fa 0x7ba47ce77500: f7 fa fd fd fd fd f7 fa 00 00 00 fa f7 fa fd fd 0x7ba47ce77580: fd fd f7 fa 00 00 00 fa f7 fa 00 00 00 fa f7 fa 0x7ba47ce77600: fd fd fd fd f7 fa 00 00 00 fa f7 fa fd fd fd fd 0x7ba47ce77680: f7 fa 00 00 00 fa f7 fa fd fd fd fd f7 fa fd fd 0x7ba47ce77700: fd fd f7 fa 00 00 00 fa f7 fa fd fd fd fd f7 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==918==ADDITIONAL INFO ==918==Note: Please include this section with the ASan report. Task trace: #0 0x557d7b136c6f in cc::ProxyImpl::ScheduledActionSendBeginMainFrame(viz::BeginFrameArgs const&) cc/trees/proxy_impl.cc:763:7 Command line: `/proc/self/exe --type=renderer --crashpad-handler-pid=840 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/chrome-poc-profile --change-stack-guard-on-fork=enable --no-sandbox --ozone-platform=headless --disable-gpu-compositing --lang=en-US --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1775447330840308 --launch-time-ticks=58101652402 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,2492386814314950527,7637859736321482836,262144 --disable-features=PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,14950808182378636389,2740346997318499531,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=stderr --v=0` ==918==END OF ADDITIONAL INFO ==918==ABORTING