[.] Sanitizer coverage enabled. Counter map size: 6099325, Cmp map size: 262144 IMPORTANT DEBUGGING NOTE: batches of tests are run inside their own process. For debugging a test inside a debugger, use the --gtest_filter= flag along with --single-process-tests. Using sharding settings from environment. This is shard 0/1 Using 1 parallel jobs. [.] Sanitizer coverage enabled. Counter map size: 6099325, Cmp map size: 262144 Note: Google Test filter = StructTraitsTest.CopyOutputResult_BitmapMaliciousRowBytesEyeDropper [==========] Running 1 test from 1 test suite. [----------] Global test environment set-up. [----------] 1 test from StructTraitsTest [ RUN ] StructTraitsTest.CopyOutputResult_BitmapMaliciousRowBytesEyeDropper ================================================================= ==1502==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c2bccb29c70 at pc 0x5720d0105ec2 bp 0x7ffcc861dc30 sp 0x7ffcc861d3f0 WRITE of size 8192 at 0x7c2bccb29c70 thread T0 #0 0x5720d0105ec1 in __asan_memcpy (/chromium/chromium/src/out/asan/services_unittests+0xbbd0ec1) (BuildId: 1d91849c8cc31466) #1 0x5720d324a97d in viz::StructTraitsTest_CopyOutputResult_BitmapMaliciousRowBytesEyeDropper_Test::TestBody() services/viz/public/cpp/compositing/mojom_traits_unittest.cc:1655:15 #2 0x5720d5cf112b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #3 0x5720d5cf4297 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #4 0x5720d5cf6393 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #5 0x5720d5d25f5a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #6 0x5720d5d24a2e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #7 0x5720e501728c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #8 0x5720d1e16c21 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #9 0x5720e502271b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #10 0x5720e502203b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #11 0x5720d1e160f4 in main services/test/run_all_unittests.cc:95:10 #12 0x7ffbce045249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) 0x7c2bccb29c70 is located 0 bytes after 32-byte region [0x7c2bccb29c50,0x7c2bccb29c70) allocated by thread T0 here: #0 0x5720d01086a6 in calloc (/chromium/chromium/src/out/asan/services_unittests+0xbbd36a6) (BuildId: 1d91849c8cc31466) #1 0x5720e0877d73 in base::UncheckedCalloc(unsigned long, unsigned long, void**) base/process/memory_linux.cc:120:13 #2 0x5720e3bd965d in sk_malloc_flags(unsigned long, unsigned int) skia/ext/SkMemory_new_handler.cpp:135:17 #3 0x5720d56ae511 in SkMallocPixelRef::MakeAllocate(SkImageInfo const&, unsigned long) third_party/skia/include/private/base/SkMalloc.h:82:12 #4 0x5720d5571a8e in SkBitmap::tryAllocPixels(SkImageInfo const&, unsigned long) third_party/skia/src/core/SkBitmap.cpp:274:28 #5 0x5720d5571181 in SkBitmap::allocN32Pixels(int, int, bool) third_party/skia/src/core/SkBitmap.cpp:249:29 #6 0x5720d324a969 in viz::StructTraitsTest_CopyOutputResult_BitmapMaliciousRowBytesEyeDropper_Test::TestBody() services/viz/public/cpp/compositing/mojom_traits_unittest.cc:1652:10 #7 0x5720d5cf112b in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc #8 0x5720d5cf4297 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2892:11 #9 0x5720d5cf6393 in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3070:30 #10 0x5720d5d25f5a in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:6062:44 #11 0x5720d5d24a2e in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc #12 0x5720e501728c in base::TestSuite::Run() base/test/test_suite.cc:440:16 #13 0x5720d1e16c21 in base::internal::Invoker, base::internal::BindState>, int ()>::RunOnce(base::internal::BindStateBase*) base/functional/bind_internal.h:740:12 #14 0x5720e502271b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback, unsigned long, int, unsigned long, bool, base::RepeatingCallback, base::OnceCallback) base/functional/callback.h:155:12 #15 0x5720e502203b in base::LaunchUnitTests(int, char**, base::OnceCallback, unsigned long) base/test/launcher/unit_test_launcher.cc:337:10 #16 0x5720d1e160f4 in main services/test/run_all_unittests.cc:95:10 #17 0x7ffbce045249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249) (BuildId: 6196744a316dbd57c0fd8968df1680aac482cec4) Shadow bytes around the buggy address: 0x7c2bccb29980: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa 0x7c2bccb29a00: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd 0x7c2bccb29a80: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa 0x7c2bccb29b00: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa 0x7c2bccb29b80: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd =>0x7c2bccb29c00: fd fa fa fa fd fd fd fd fa fa 00 00 00 00[fa]fa 0x7c2bccb29c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c2bccb29d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c2bccb29d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c2bccb29e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7c2bccb29e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb WARNING: All log messages before absl::InitializeLog() is called are written to STDERR E0000 00:00:1779771249.930583 1502 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==1502==ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779771249.930704 1502 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==1502==Note: Please include this section with the ASan report. === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779771249.930741 1502 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: Task trace: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779771249.930773 1502 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779771249.930802 1502 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==1502==END OF ADDITIONAL INFO === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 E0000 00:00:1779771249.930834 1502 runtime.cc:173] Failed to extract sanitizer crash type: INVALID_ARGUMENT: No `SUMMARY: ` prefix in sanitizer error summary: ==1502==ABORTING === Source Location Trace: === ../../third_party/fuzztest/src/fuzztest/internal/sanitizer_interface.cc:31 [1/1] StructTraitsTest.CopyOutputResult_BitmapMaliciousRowBytesEyeDropper (CRASHED) 1 test crashed: StructTraitsTest.CopyOutputResult_BitmapMaliciousRowBytesEyeDropper (../../services/viz/public/cpp/compositing/mojom_traits_unittest.cc:1581) Tests took 1 seconds.