[5380:5380:0517/051003.985522:WARNING:sandbox/policy/linux/sandbox_linux.cc:404] InitializeSandbox() called with multiple threads in process gpu-process. #READY [5417:5417:0517/051004.017883:WARNING:base/debug/stack_trace_posix.cc:1030] WARNING: sanitizers are preventing signal handler installation. WebAssembly trap handlers are disabled. [5419:5419:0517/051004.027009:WARNING:base/debug/stack_trace_posix.cc:1030] WARNING: sanitizers are preventing signal handler installation. WebAssembly trap handlers are disabled. [5432:5432:0517/051004.038973:WARNING:base/debug/stack_trace_posix.cc:1030] WARNING: sanitizers are preventing signal handler installation. WebAssembly trap handlers are disabled. CONSOLE MESSAGE: UNMASKED_RENDERER: ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver) CONSOLE MESSAGE: UNMASKED_RENDERER: ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver) CONSOLE MESSAGE: PLS coherent: false CONSOLE MESSAGE: PLS coherent: false CONSOLE MESSAGE: PLS program linked OK CONSOLE MESSAGE: PLS program linked OK CONSOLE MESSAGE: [1] PLS active planes after begin: 1 (expected 1) CONSOLE MESSAGE: [1] PLS active planes after begin: 1 (expected 1) CONSOLE MESSAGE: [2] glError after renderbufferStorage(4096x4096): 0x0 (expected 0x0 - no guard) CONSOLE MESSAGE: [2] glError after renderbufferStorage(4096x4096): 0x0 (expected 0x0 - no guard) CONSOLE MESSAGE: [3] PLS active planes after RB resize: 1 (BUG: still 1, should be 0 if guarded) CONSOLE MESSAGE: [3] PLS active planes after RB resize: 1 (BUG: still 1, should be 0 if guarded) CONSOLE MESSAGE: [4] glError after draw: 0x0 (draw+finish took 2.5 ms) CONSOLE MESSAGE: [4] glError after draw: 0x0 (draw+finish took 2.5 ms) CONSOLE MESSAGE: [5] Draw dispatched: 4096x4096 fragments wrote to 4096x1 storage image -> OOB imageStore CONSOLE MESSAGE: [5] Draw dispatched: 4096x4096 fragments wrote to 4096x1 storage image -> OOB imageStore CONSOLE MESSAGE: VULNERABILITY CONFIRMED: glRenderbufferStorage did not end PLS; rendering area enlarged past PLS image dimensions. AddressSanitizer:DEADLYSIGNAL AddressSanitizer:DEADLYSIGNAL AddressSanitizer:DEADLYSIGNAL AddressSanitizer:DEADLYSIGNAL AddressSanitizer:DEADLYSIGNAL AddressSanitizer:DEADLYSIGNAL AddressSanitizer:DEADLYSIGNAL AddressSanitizer:DEADLYSIGNAL AddressSanitizerAddressSanitizer:DEADLYSIGNAL :DEADLYSIGNAL AddressSanitizer:DEADLYSIGNAL AddressSanitizer:DEADLYSIGNAL AddressSanitizerAddressSanitizer:DEADLYSIGNAL :DEADLYSIGNAL AddressSanitizer:DEADLYSIGNAL AddressSanitizer:DEADLYSIGNAL ================================================================= ==5380==ERROR: AddressSanitizer: SEGV on unknown address 0x70a924003900 (pc 0x70a92a50298a bp 0x70a9139ca6b0 sp 0x70a9139ca5f0 T13) ==5380==The signal is caused by a WRITE memory access. #0 0x70a92a50298a () #1 0x70a9228e5450 in marl::Scheduler::Worker::runUntilIdle() gen/third_party/libc++/src/include/__functional/function.h:502:12 #2 0x70a9228e30bb in marl::Scheduler::Worker::runUntilShutdown() third_party/swiftshader/third_party/marl/src/scheduler.cpp:586:5 #3 0x70a9228e4d12 in marl::Scheduler::Worker::run() third_party/swiftshader/third_party/marl/src/scheduler.cpp:579:3 #4 0x70a9228edde2 in void std::__Cr::__function::__policy_func::__call_func(std::__Cr::__function::__policy_storage const*) third_party/swiftshader/third_party/marl/src/scheduler.cpp:383:11 #5 0x70a9228f7295 in void* std::__Cr::__thread_proxy>, marl::Thread::Impl::Impl(marl::Thread::Affinity&&, std::__Cr::function&&)::'lambda'()>>(void*) gen/third_party/libc++/src/include/__functional/function.h:502:12 #6 0x62f6d9531f16 in asan_thread_start(void*) asan_interceptors.cpp ==5380==Register values: rax = 0x00000000000d0000 rbx = 0x000070d92ddfcc48 rcx = 0x00000000ffff3500 rdx = 0x000070a923f33900 rdi = 0x000070a92a33e820 rsi = 0x000070a8fe877d50 rbp = 0x000070a9139ca6b0 rsp = 0x000070a9139ca5f0 r8 = 0x0000000000000010 r9 = 0x0000000000000000 r10 = 0x0000000000000000 r11 = 0x0000000000000246 r12 = 0x00000e1b25bbf989 r13 = 0x000072392ddeb9a8 r14 = 0x000071292de78050 r15 = 0x00000e2525bcf00a AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV () Thread T13 created by T0 (content_shell) here: #0 0x62f6d9517d91 in pthread_create (/chromium/chromium/src/out/asan/content_shell+0xc84cd91) (BuildId: 4d472caeda69a514) #1 0x70a9228f71ae in std::__Cr::thread::thread&&)::'lambda'(), 0>(marl::Thread::Impl::Impl(marl::Thread::Affinity&&, std::__Cr::function&&)::'lambda'()&&) gen/third_party/libc++/src/include/__thread/support/pthread.h:182:10 #2 0x70a9228f6b42 in marl::Thread::Impl::Impl(marl::Thread::Affinity&&, std::__Cr::function&&) third_party/swiftshader/third_party/marl/src/thread.cpp:385:60 #3 0x70a9228f6a16 in marl::Thread::Thread(marl::Thread::Affinity&&, std::__Cr::function&&) third_party/swiftshader/third_party/marl/src/thread.cpp:424:16 #4 0x70a9228dfda7 in marl::Scheduler::Worker::start() third_party/swiftshader/third_party/marl/src/scheduler.cpp:370:16 #5 0x70a9228e0a8d in marl::Scheduler::Scheduler(marl::Scheduler::Config const&) third_party/swiftshader/third_party/marl/src/scheduler.cpp:139:23 #6 0x70a9228d508b in marl::Scheduler* std::__Cr::construct_at(marl::Scheduler*, marl::Scheduler::Config&) gen/third_party/libc++/src/include/__memory/construct_at.h:37:49 #7 0x70a9228bdf24 in vkCreateDevice gen/third_party/libc++/src/include/__memory/construct_at.h:45:10 #8 0x70a923954d1a in terminator_CreateDevice third_party/vulkan-loader/src/loader/loader.c:6477:11 #9 0x70a9239586a7 in loader_create_device_chain third_party/vulkan-loader/src/loader/loader.c:5535:15 #10 0x70a9239569f4 in loader_layer_create_device third_party/vulkan-loader/src/loader/loader.c:4892:11 #11 0x70a923972a21 in vkCreateDevice third_party/vulkan-loader/src/loader/trampoline.c:994:20 #12 0x70a9252ba058 in rx::vk::Renderer::createDeviceAndQueue(rx::vk::ErrorContext*, unsigned int) third_party/angle/src/libANGLE/renderer/vulkan/vk_renderer.cpp:4736:27 #13 0x70a9252b4b54 in rx::vk::Renderer::initialize(rx::vk::ErrorContext*, rx::vk::GlobalOps*, angle::vk::ICD, unsigned int, unsigned int, unsigned char const*, unsigned char const*, VkDriverId, rx::vk::UseDebugLayers, char const*, char const*, angle::NativeWindowSystem, angle::FeatureOverrides const&) third_party/angle/src/libANGLE/renderer/vulkan/vk_renderer.cpp:2746:15 #14 0x70a924ff195c in rx::DisplayVk::initialize(egl::Display*) third_party/angle/src/libANGLE/renderer/vulkan/DisplayVk.cpp:184:39 #15 0x70a925317cb2 in rx::DisplayVkXcb::initialize(egl::Display*) third_party/angle/src/libANGLE/renderer/vulkan/linux/xcb/DisplayVkXcb.cpp:68:23 #16 0x70a9254da9a2 in egl::Display::initialize() third_party/angle/src/libANGLE/Display.cpp:1093:36 #17 0x70a924ef03dc in egl::Initialize(egl::Thread*, egl::Display*, int*, int*) third_party/angle/src/libGLESv2/egl_stubs.cpp:502:43 #18 0x70a924ef4cbf in EGL_Initialize third_party/angle/src/libGLESv2/entry_points_egl_autogen.cpp:597:27 #19 0x62f6efa24b02 in gl::GLDisplayEGL::InitializeDisplay(bool, std::__Cr::vector>, gl::EGLDisplayPlatform, gl::GLDisplayEGL*) ui/gl/gl_display.cc:635:12 #20 0x62f6efa22f5a in gl::GLDisplayEGL::Initialize(bool, std::__Cr::vector>, gl::EGLDisplayPlatform) ui/gl/gl_display.cc:522:8 #21 0x62f6dbe77843 in ui::GLOzoneEGL::InitializeGLOneOffPlatform(bool, std::__Cr::vector>, gl::GpuPreference) ui/ozone/common/gl_ozone_egl.cc:25:17 #22 0x62f6f41360fe in gl::init::InitializeGLOneOffPlatform(gl::GpuPreference) ui/gl/init/gl_initializer_ozone.cc:27:26 #23 0x62f6f41346c0 in gl::init::InitializeGLOneOffPlatformImplementation(bool, bool, gl::GpuPreference) ui/gl/init/gl_factory.cc:184:24 #24 0x62f6f4134140 in gl::init::(anonymous namespace)::InitializeGLOneOffPlatformHelper(bool, gl::GpuPreference) ui/gl/init/gl_factory.cc:124:10 #25 0x62f6f413448d in gl::init::InitializeGLNoExtensionsOneOff(bool, gl::GpuPreference) ui/gl/init/gl_factory.cc:154:10 #26 0x62f6f41729b7 in gpu::GpuInit::InitializeAndStartSandbox(base::CommandLine*, gpu::GpuPreferences const&) gpu/ipc/service/gpu_init.cc:514:18 #27 0x62f6f4946b2a in content::GpuMain(content::MainFunctionParams) content/gpu/gpu_main.cc:381:39 #28 0x62f6d9d0e029 in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:665:14 #29 0x62f6d9d0f32b in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string, std::__Cr::allocator> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:772:12 #30 0x62f6d9d121a5 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1164:10 #31 0x62f6d9d0b918 in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:356:36 #32 0x62f6d9d0bf1c in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:369:10 #33 0x62f6d956ead8 in main content/shell/app/shell_main.cc:100:10 #34 0x74a92fc2b249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) ==5380==ADDITIONAL INFO ==5380==Note: Please include this section with the ASan report. Task trace: Command line: `/proc/self/exe --type=gpu-process --no-sandbox --disable-angle-features=supportsShaderFramebufferFetch --disable-gpu-rasterization --disable-skia-runtime-opts --headless --disable-skia-graphite --suppress-performance-logs --ozone-platform=headless --use-angle=swiftshader --enable-unsafe-swiftshader --run-web-tests --gpu-preferences=UAAAAAAAAAAgAAAEAAAAAAAAAAAAAMAAAQAAAAAAAAAAAAAAAAAAABMAAAAAAAAAAAAAAAAAAAAYAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --shared-files --field-trial-handle=3,i,201565804863714807,18209534330472613070,262144 --enable-features=CookieIndicesHeader,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPolicyNegotiation,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,HTMLProcessingInstruction,HstsTopLevelNavigationsOnly,OriginIsolationHeader,PrefetchCookieIndices,ThirdPartyStoragePartitioning --disable-features=IgnoreDuplicateNavs,PaintHolding --variations-seed-version --pseudonymization-salt-handle=7,i,12884684445859937795,9944522274900960276,4 --trace-process-track-uuid=3190708988185955192 --enable-logging` ==5380==END OF ADDITIONAL INFO ==5380==ABORTING