ASAN_SYMBOLIZER_PATH=third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer ./out/asan/angle_end2end_tests --gtest_filter="*StaleFormatIDHeapOverflowRead*" Note: Google Test filter = *StaleFormatIDHeapOverflowRead* [==========] Running 5 tests from 1 test suite. [----------] Global test environment set-up. [----------] 5 tests from Texture2DTestES3 [ RUN ] Texture2DTestES3.StaleFormatIDHeapOverflowRead/ES3_OpenGL OOB pixels: 0 / 1024 [ OK ] Texture2DTestES3.StaleFormatIDHeapOverflowRead/ES3_OpenGL (510 ms) [ RUN ] Texture2DTestES3.StaleFormatIDHeapOverflowRead/ES3_Vulkan_SwiftShader OOB pixels: 0 / 1024 [ OK ] Texture2DTestES3.StaleFormatIDHeapOverflowRead/ES3_Vulkan_SwiftShader (276 ms) [ RUN ] Texture2DTestES3.StaleFormatIDHeapOverflowRead/ES3_Metal 2026-04-02 11:44:13.186 angle_end2end_tests[54404:13763311] Using Metal Device: Apple M2 ================================================================= ==54404==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6190003a749f at pc 0x00011a301238 bp 0x00016b5fe3d0 sp 0x00016b5fe3c8 READ of size 48 at 0x6190003a749f thread T0 #0 0x00011a301234 in angle::LoadToNativeByte3To4Impl(angle::ImageLoadContext const&, unsigned char, unsigned long, unsigned long, unsigned long, unsigned char const*, unsigned long, unsigned long, unsigned char*, unsigned long, unsigned long) third_party/angle/src/image_util/loadimage.inc:198:21 #1 0x00011a300654 in void angle::LoadToNative3To4(angle::ImageLoadContext const&, unsigned long, unsigned long, unsigned long, unsigned char const*, unsigned long, unsigned long, unsigned char*, unsigned long, unsigned long) third_party/angle/src/image_util/loadimage.inc:243:5 #2 0x00011a5e46b8 in rx::TextureMtl::convertAndSetPerSliceSubImage(gl::Context const*, int, MTLRegion const&, gl::InternalFormat const&, unsigned int, angle::Format const&, unsigned long, unsigned long, gl::Buffer*, unsigned char const*, rx::ImageDefinitionMtl const&) third_party/angle/src/libANGLE/renderer/metal/TextureMtl.mm:2557:25 #3 0x00011a5e34c0 in rx::TextureMtl::setPerSliceSubImage(gl::Context const*, int, MTLRegion const&, gl::InternalFormat const&, unsigned int, angle::Format const&, unsigned long, unsigned long, gl::Buffer*, unsigned char const*, rx::ImageDefinitionMtl const&) third_party/angle/src/libANGLE/renderer/metal/TextureMtl.mm:2290:16 #4 0x00011a5dcb00 in rx::TextureMtl::setSubImageImpl(gl::Context const*, gl::ImageIndex const&, gl::Box const&, gl::InternalFormat const&, unsigned int, gl::PixelUnpackState const&, gl::Buffer*, unsigned char const*) third_party/angle/src/libANGLE/renderer/metal/TextureMtl.mm:2263:19 #5 0x00011a2413b0 in gl::Texture::setSubImage(gl::Context*, gl::PixelUnpackState const&, gl::Buffer*, gl::TextureTarget, int, gl::Box const&, unsigned int, unsigned int, unsigned char const*) third_party/angle/src/libANGLE/Texture.cpp:1441:25 #6 0x00011a0b0bcc in gl::Context::texSubImage2D(gl::TextureTarget, int, int, int, int, int, unsigned int, unsigned int, void const*) third_party/angle/src/libANGLE/Context.cpp:5652:32 #7 0x000119cadcf8 in GL_TexSubImage2D third_party/angle/src/libGLESv2/entry_points_gles_2_0_autogen.cpp:4983:22 #8 0x000107095474 in (anonymous namespace)::Texture2DTestES3_StaleFormatIDHeapOverflowRead_Test::TestBody() third_party/angle/src/tests/gl_tests/TextureTest.cpp:2928:5 #9 0x000107e8136c in HandleExceptionsInMethodIfSupported third_party/googletest/src/googletest/src/gtest.cc #10 0x000107e8136c in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2746:5 #11 0x000107e83440 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #12 0x000107e84d7c in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #13 0x000107ea55c8 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #14 0x000107ea44bc in HandleExceptionsInMethodIfSupported third_party/googletest/src/googletest/src/gtest.cc #15 0x000107ea44bc in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc:5602:10 #16 0x000107e20eb8 in RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #17 0x000107e20eb8 in angle::TestSuite::run() third_party/angle/src/tests/test_utils/runner/TestSuite.cpp:1739:22 #18 0x000107cc4ee8 in main third_party/angle/src/tests/angle_end2end_tests_main.cpp:85:22 #19 0x00019d065d50 in start (/usr/lib/dyld:arm64e+0x8d50) 0x6190003a749f is located 31 bytes after 1024-byte region [0x6190003a7080,0x6190003a7480) allocated by thread T0 here: #0 0x00010e8f13bc in __sanitizer_finish_switch_fiber (/Users/tguillem/work/git/chromium/src/out/asan/libclang_rt.asan_osx_dynamic.dylib:arm64+0x653bc) #1 0x000107095078 in __libcpp_allocate /Users/tguillem/work/git/chromium/src/out/asan/gen/third_party/libc++/src/include/__new/allocate.h:43:28 #2 0x000107095078 in allocate /Users/tguillem/work/git/chromium/src/out/asan/gen/third_party/libc++/src/include/__memory/allocator.h:92:14 #3 0x000107095078 in allocate_at_least /Users/tguillem/work/git/chromium/src/out/asan/gen/third_party/libc++/src/include/__memory/allocator.h:99:13 #4 0x000107095078 in allocate_at_least > /Users/tguillem/work/git/chromium/src/out/asan/gen/third_party/libc++/src/include/__memory/allocator_traits.h:280:22 #5 0x000107095078 in __allocate_at_least > /Users/tguillem/work/git/chromium/src/out/asan/gen/third_party/libc++/src/include/__memory/allocate_at_least.h:36:16 #6 0x000107095078 in __vallocate /Users/tguillem/work/git/chromium/src/out/asan/gen/third_party/libc++/src/include/__vector/vector.h:580:25 #7 0x000107095078 in vector /Users/tguillem/work/git/chromium/src/out/asan/gen/third_party/libc++/src/include/__vector/vector.h:168:7 #8 0x000107095078 in vector /Users/tguillem/work/git/chromium/src/out/asan/gen/third_party/libc++/src/include/__vector/vector.h:165:100 #9 0x000107095078 in (anonymous namespace)::Texture2DTestES3_StaleFormatIDHeapOverflowRead_Test::TestBody() third_party/angle/src/tests/gl_tests/TextureTest.cpp:2927:26 #10 0x000107e8136c in HandleExceptionsInMethodIfSupported third_party/googletest/src/googletest/src/gtest.cc #11 0x000107e8136c in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2746:5 #12 0x000107e83440 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #13 0x000107e84d7c in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #14 0x000107ea55c8 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #15 0x000107ea44bc in HandleExceptionsInMethodIfSupported third_party/googletest/src/googletest/src/gtest.cc #16 0x000107ea44bc in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc:5602:10 #17 0x000107e20eb8 in RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2337:73 #18 0x000107e20eb8 in angle::TestSuite::run() third_party/angle/src/tests/test_utils/runner/TestSuite.cpp:1739:22 #19 0x000107cc4ee8 in main third_party/angle/src/tests/angle_end2end_tests_main.cpp:85:22 #20 0x00019d065d50 in start (/usr/lib/dyld:arm64e+0x8d50) SUMMARY: AddressSanitizer: heap-buffer-overflow third_party/angle/src/image_util/loadimage.inc:198:21 in angle::LoadToNativeByte3To4Impl(angle::ImageLoadContext const&, unsigned char, unsigned long, unsigned long, unsigned long, unsigned char const*, unsigned long, unsigned long, unsigned char*, unsigned long, unsigned long) Shadow bytes around the buggy address: 0x6190003a7200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x6190003a7280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x6190003a7300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x6190003a7380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x6190003a7400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x6190003a7480: fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa 0x6190003a7500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x6190003a7580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x6190003a7600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x6190003a7680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x6190003a7700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==54404==ABORTING Signal 6: No results file specified. Backtrace: angle::Handler(int) (+0x78) _sigtramp (+0x38) pthread_kill (+0x128) abort (+0x7c) __sanitizer_sandbox_on_notify (+0x4cc) __sanitizer_get_dtls_size (+0x4994) __asan_on_error (+0x634) __asan_unpoison_intra_object_redzone (+0x3be8) __asan_report_load_n (+0x3c) angle::LoadToNativeByte3To4Impl(angle::ImageLoadContext const&, unsigned char, unsigned long, unsigned long, unsigned long, unsigned char const*, unsigned long, unsigned long, unsigned char*, unsigned long, unsigned long) (+0xbd4) void angle::LoadToNative3To4(angle::ImageLoadContext const&, unsigned long, unsigned long, unsigned long, unsigned char const*, unsigned long, unsigned long, unsigned char*, unsigned long, unsigned long) (+0x3c) rx::TextureMtl::convertAndSetPerSliceSubImage(gl::Context const*, int, MTLRegion const&, gl::InternalFormat const&, unsigned int, angle::Format const&, unsigned long, unsigned long, gl::Buffer*, unsigned char const*, rx::ImageDefinitionMtl const&) (+0x718) rx::TextureMtl::setPerSliceSubImage(gl::Context const*, int, MTLRegion const&, gl::InternalFormat const&, unsigned int, angle::Format const&, unsigned long, unsigned long, gl::Buffer*, unsigned char const*, rx::ImageDefinitionMtl const&) (+0x1e0) rx::TextureMtl::setSubImageImpl(gl::Context const*, gl::ImageIndex const&, gl::Box const&, gl::InternalFormat const&, unsigned int, gl::PixelUnpackState const&, gl::Buffer*, unsigned char const*) (+0x4e0) gl::Texture::setSubImage(gl::Context*, gl::PixelUnpackState const&, gl::Buffer*, gl::TextureTarget, int, gl::Box const&, unsigned int, unsigned int, unsigned char const*) (+0x218) gl::Context::texSubImage2D(gl::TextureTarget, int, int, int, int, int, unsigned int, unsigned int, void const*) (+0x1e0) GL_TexSubImage2D (+0xf4) (anonymous namespace)::Texture2DTestES3_StaleFormatIDHeapOverflowRead_Test::TestBody() (+0x874) testing::Test::Run() (+0x1f4) testing::TestInfo::Run() (+0x238) testing::TestSuite::Run() (+0x700) testing::internal::UnitTestImpl::RunAllTests() (+0xf94) testing::UnitTest::Run() (+0x28c) angle::TestSuite::run() (+0x1160) main (+0x39c)