GPU process crash via WebGPU shader - UAF in GlobalIsNeeded at GlobalDCE.cpp:244 [342428008]

Fixed
Vulnerability
Status Update

No update yet.
Description

May 23, 2024 06:15PM
VULNERABILITY DETAILS

Chromium translates wgsl shaders via tint to an OS-specific shader format. On Windows, the OS-specific file format is hlsl, processed in dxcompiler.dll. When compiling chrome-generated hlsl files, this triggers a UAF inside the hlsl compiler.
VERSION

Chrome Version: Pre-compiled ASAN Chromium 127.0.6497.0 (Developer Build) (64-bit)
Operating System: Win11 Build 22631.3447
REPRODUCTION CASE

Attached is a .html file containing a WebGPU shader. Opening the html file (on windows with the D3D12 backend) crashes the GPU process.
Reproducing the issue stand-alone on Linux also possible:
Compile the standalone.wgsl with tint (commit 143523a12f42d663bc0473cf5d8468559d4eb192) to hlsl via ./tint standalone.wgsl -o standalone.hlsl. I also attached standalone.hlsl, but you should get the very same file when compiling standalone.wgsl yourself
Compile the hlsl with dxc (commit a1b945c1a3e0866b409c00d7ff2ed077060f5a57): ./dxc-3.7 -T cs_6_2 -HV 2018 standalone.hlsl. This should trigger an ASAN violation.
Attached:

html that triggers an ASAN violation in chromium
wgsl for producing the hlsl shader
the hlsl shader
asan log file
[13380:9656:0523/073333.826:WARNING:chrome_main_delegate.cc(742)] This is Chrome version 127.0.6497.0 (not a warning)
[13380:13940:0523/073334.014:WARNING:dns_config_service_win.cc(605)] Failed to read DnsConfig.
[13380:14912:0523/073334.077:ERROR:sandbox_win.cc(913)] Sandbox cannot access executable. Check filesystem permissions are valid. See https://bit.ly/31yqMJR.: Access is denied. (0x5)
[13380:9656:0523/073334.249:WARNING:account_consistency_mode_manager.cc(77)] Desktop Identity Consistency cannot be enabled as no OAuth client ID and client secret have been configured.
[13380:9656:0523/073334.469:WARNING:browser_management_service.cc(128)] EnterpriseLogoUrl fetch failed with error code -1 and MIME type
[13380:9656:0523/073335.190:ERROR:network_service_instance_impl.cc(600)] Network service crashed, restarting service.
[13380:9656:0523/073335.237:WARNING:external_registry_loader_win.cc(232)] Error observing HKLM: 5
[10096:8564:0523/073335.300:WARNING:dns_config_service_win.cc(605)] Failed to read DnsConfig.
[13380:8984:0523/073339.025:WARNING:dns_config_service_win.cc(605)] Failed to read DnsConfig.
[10096:8564:0523/073340.309:WARNING:dns_config_service_win.cc(605)] Failed to read DnsConfig.
=================================================================
==15112==ERROR: AddressSanitizer: heap-use-after-free on address 0x11dbb0bca240 at pc 0x7ffb676bbbbc bp 0x00bcfedfc6a0 sp 0x00bcfedfc6e8
READ of size 1 at 0x11dbb0bca240 thread T0
==15112==WARNING: Failed to use and restart external symbolizer!
==15112==*** WARNING: Failed to initialize DbgHelp!              ***
==15112==*** Most likely this means that the app is already      *** 
==15112==*** using DbgHelp, possibly with incompatible flags.    *** 
==15112==*** Due to technical reasons, symbolization might crash *** 
==15112==*** or produce wrong results.                           ***
    #0 0x7ffb676bbbbb in `anonymous namespace'::GlobalDCE::GlobalIsNeeded C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\lib\Transforms\IPO\GlobalDCE.cpp:244
    #1 0x7ffb676b92cf in `anonymous namespace'::GlobalDCE::runOnModule C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\lib\Transforms\IPO\GlobalDCE.cpp:100
    #2 0x7ffb665e97b5 in llvm::legacy::PassManagerImpl::run C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\lib\IR\LegacyPassManager.cpp:1771
    #3 0x7ffb665f2b4c in clang::EmitBackendOutput C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\BackendUtil.cpp:781
    #4 0x7ffb66000921 in clang::BackendConsumer::HandleTranslationUnit C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CodeGenAction.cpp:191
    #5 0x7ffb6671e5a1 in clang::ParseAST C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\Parse\ParseAST.cpp:164
    #6 0x7ffb65ffb612 in clang::CodeGenAction::ExecuteAction C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CodeGenAction.cpp:807
    #7 0x7ffb66008de3 in clang::FrontendAction::Execute C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\Frontend\FrontendAction.cpp:455
    #8 0x7ffb65ee6c13 in DxcCompiler::Compile C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\tools\dxcompiler\dxcompilerobj.cpp:984
    #9 0x7ffb1114a139 in dawn::native::d3d::CompileShader C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d\ShaderUtils.cpp:355
    #10 0x7ffb111ada5e in dawn::native::LoadOrRun<dawn::Result<dawn::native::d3d::CompiledShader,dawn::native::ErrorData> (*)(dawn::native::Blob),dawn::Result<dawn::native::d3d::CompiledShader,dawn::native::ErrorData> (*)(dawn::native::d3d::D3DCompilationRequest)> C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\CacheRequest.h:154
    #11 0x7ffb1124f374 in dawn::native::d3d12::ShaderModule::Compile C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\ShaderModuleD3D12.cpp:378
    #12 0x7ffb11213bdc in dawn::native::d3d12::ComputePipeline::InitializeImpl C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\ComputePipelineD3D12.cpp:87
    #13 0x7ffb11065550 in dawn::native::PipelineBase::Initialize C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Pipeline.cpp:371
    #14 0x7ffb10fb6781 in dawn::native::DeviceBase::CreateComputePipeline C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:1987
    #15 0x7ffb10fb6167 in dawn::native::DeviceBase::APICreateComputePipeline C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:1300
    #16 0x7ffb335603ad in dawn::wire::server::Server::DoDeviceCreateComputePipeline C:\b\s\w\ir\cache\builder\src\out\Release_x64\gen\third_party\dawn\src\dawn\wire\server\ServerDoers_autogen.cpp:250
    #17 0x7ffb32fb0354 in dawn::wire::server::Server::HandleDeviceCreateComputePipeline C:\b\s\w\ir\cache\builder\src\out\Release_x64\gen\third_party\dawn\src\dawn\wire\server\ServerHandlers_autogen.cpp:477   
    #18 0x7ffb32fb869d in dawn::wire::server::Server::HandleCommandsImpl C:\b\s\w\ir\cache\builder\src\out\Release_x64\gen\third_party\dawn\src\dawn\wire\server\ServerHandlers_autogen.cpp:1652
    #19 0x7ffb2eaef6f2 in gpu::webgpu::`anonymous namespace'::DawnWireServer::HandleCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1020
    #20 0x7ffb2eaefb45 in gpu::webgpu::`anonymous namespace'::WebGPUDecoderImpl::HandleDawnCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1924
    #21 0x7ffb2eae3e71 in gpu::webgpu::`anonymous namespace'::WebGPUDecoderImpl::DoCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1869
    #22 0x7ffb22778c23 in gpu::CommandBufferService::Flush C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\command_buffer_service.cc:232
    #23 0x7ffb1f32526c in gpu::CommandBufferStub::OnAsyncFlush C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:506
    #24 0x7ffb1f323d13 in gpu::CommandBufferStub::ExecuteDeferredRequest C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:154
    #25 0x7ffb22796aca in gpu::GpuChannel::ExecuteDeferredRequest C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\gpu_channel.cc:930
    #26 0x7ffb227a7baa in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::GpuChannel::*&&)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, unsigned long long),base::WeakPtr<gpu::GpuChannel> &&,mojo::StructPtr<gpu::mojom::DeferredRequestParams> &&,unsigned long long &&>,base::internal::BindState<1,1,0,void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, unsigned long long),base::WeakPtr<gpu::GpuChannel>,mojo::StructPtr<gpu::mojom::DeferredRequestParams>,unsigned long long>,void ()>::RunImpl<void (gpu::GpuChannel::*)(mojo::StructPtr<gpu::mojom::DeferredRequestParams>, unsigned long long),std::__Cr::tuple<base::WeakPtr<gpu::GpuChannel>,mojo::StructPtr<gpu::mojom::DeferredRequestParams>,unsigned long long>,0,1,2> C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1067
    #27 0x7ffb21dddc9d in gpu::SchedulerDfs::ExecuteSequence C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler_dfs.cc:743
    #28 0x7ffb21ddc068 in gpu::SchedulerDfs::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler_dfs.cc:668
    #29 0x7ffb21ddf1f5 in base::internal::Invoker<base::internal::FunctorTraits<void (gpu::SchedulerDfs::*&&)(),gpu::SchedulerDfs *>,base::internal::BindState<1,1,0,void (gpu::SchedulerDfs::*)(),base::internal::UnretainedWrapper<gpu::SchedulerDfs,base::unretained_traits::MayNotDangle,0> >,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:980
    #30 0x7ffb1d280ad0 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:203
    #31 0x7ffb20c02dae in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:473 
    #32 0x7ffb20c01cb9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:338
    #33 0x7ffb20c380ce in base::MessagePumpDefault::Run C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:40
    #34 0x7ffb20c049fc in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:645
    #35 0x7ffb1d2ca760 in base::RunLoop::Run C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134
    #36 0x7ffb2010bdc9 in content::GpuMain C:\b\s\w\ir\cache\builder\src\content\gpu\gpu_main.cc:438
    #37 0x7ffb1bbb39e2 in content::RunOtherNamedProcessTypeMain C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:780
    #38 0x7ffb1bbb5f63 in content::ContentMainRunnerImpl::Run C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1156
    #39 0x7ffb1bbb197d in content::RunContentProcess C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:332
    #40 0x7ffb1bbb246d in content::ContentMain C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:345
    #41 0x7ffb0ea51601 in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:192
    #42 0x7ff7bec243a5 in MainDllLoader::Launch C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:181
    #43 0x7ff7bec21db2 in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:350
    #44 0x7ff7bf000ac3 in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #45 0x7ffbc73c257c in BaseThreadInitThunk+0x1c (C:\Windows\System32\KERNEL32.DLL+0x18001257c)
    #46 0x7ffbc83eaa47 in RtlUserThreadStart+0x27 (C:\Windows\SYSTEM32\ntdll.dll+0x18005aa47)

0x11dbb0bca240 is located 96 bytes inside of 160-byte region [0x11dbb0bca1e0,0x11dbb0bca280)
freed by thread T0 here:
    #0 0x7ff7becfcc4d in free C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win.cpp:82
    #1 0x7ffb66228c3b in llvm::ICmpInst::~ICmpInst C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\include\llvm\IR\Instructions.h:1093
    #2 0x7ffb673caf7d in llvm::Instruction::eraseFromParent C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\lib\IR\Instruction.cpp:71
    #3 0x7ffb6768019a in `anonymous namespace'::DeleteDeadInstructions C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\lib\Transforms\Scalar\ScalarReplAggregatesHLSL.cpp:1196
    #4 0x7ffb67640b08 in `anonymous namespace'::SROAGlobalAndAllocas C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\lib\Transforms\Scalar\ScalarReplAggregatesHLSL.cpp:2012
    #5 0x7ffb6762c6e5 in `anonymous namespace'::SROA_Parameter_HLSL::runOnModule C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\lib\Transforms\Scalar\ScalarReplAggregatesHLSL.cpp:4316
    #6 0x7ffb665e97b5 in llvm::legacy::PassManagerImpl::run C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\lib\IR\LegacyPassManager.cpp:1771
    #7 0x7ffb665f2b4c in clang::EmitBackendOutput C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\BackendUtil.cpp:781
    #8 0x7ffb66000921 in clang::BackendConsumer::HandleTranslationUnit C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CodeGenAction.cpp:191
    #9 0x7ffb6671e5a1 in clang::ParseAST C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\Parse\ParseAST.cpp:164
    #10 0x7ffb65ffb612 in clang::CodeGenAction::ExecuteAction C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CodeGenAction.cpp:807
    #11 0x7ffb66008de3 in clang::FrontendAction::Execute C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\Frontend\FrontendAction.cpp:455
    #12 0x7ffb65ee6c13 in DxcCompiler::Compile C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\tools\dxcompiler\dxcompilerobj.cpp:984
    #13 0x7ffb1114a139 in dawn::native::d3d::CompileShader C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d\ShaderUtils.cpp:355
    #14 0x7ffb111ada5e in dawn::native::LoadOrRun<dawn::Result<dawn::native::d3d::CompiledShader,dawn::native::ErrorData> (*)(dawn::native::Blob),dawn::Result<dawn::native::d3d::CompiledShader,dawn::native::ErrorData> (*)(dawn::native::d3d::D3DCompilationRequest)> C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\CacheRequest.h:154
    #15 0x7ffb1124f374 in dawn::native::d3d12::ShaderModule::Compile C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\ShaderModuleD3D12.cpp:378
    #16 0x7ffb11213bdc in dawn::native::d3d12::ComputePipeline::InitializeImpl C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\d3d12\ComputePipelineD3D12.cpp:87
    #17 0x7ffb11065550 in dawn::native::PipelineBase::Initialize C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Pipeline.cpp:371
    #18 0x7ffb10fb6781 in dawn::native::DeviceBase::CreateComputePipeline C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:1987
    #19 0x7ffb10fb6167 in dawn::native::DeviceBase::APICreateComputePipeline C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:1300
    #20 0x7ffb335603ad in dawn::wire::server::Server::DoDeviceCreateComputePipeline C:\b\s\w\ir\cache\builder\src\out\Release_x64\gen\third_party\dawn\src\dawn\wire\server\ServerDoers_autogen.cpp:250
    #21 0x7ffb32fb0354 in dawn::wire::server::Server::HandleDeviceCreateComputePipeline C:\b\s\w\ir\cache\builder\src\out\Release_x64\gen\third_party\dawn\src\dawn\wire\server\ServerHandlers_autogen.cpp:477
    #22 0x7ffb32fb869d in dawn::wire::server::Server::HandleCommandsImpl C:\b\s\w\ir\cache\builder\src\out\Release_x64\gen\third_party\dawn\src\dawn\wire\server\ServerHandlers_autogen.cpp:1652
    #23 0x7ffb2eaef6f2 in gpu::webgpu::`anonymous namespace'::DawnWireServer::HandleCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1020
    #24 0x7ffb2eaefb45 in gpu::webgpu::`anonymous namespace'::WebGPUDecoderImpl::HandleDawnCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1924
    #25 0x7ffb2eae3e71 in gpu::webgpu::`anonymous namespace'::WebGPUDecoderImpl::DoCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1869
    #26 0x7ffb22778c23 in gpu::CommandBufferService::Flush C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\command_buffer_service.cc:232
    #27 0x7ffb1f32526c in gpu::CommandBufferStub::OnAsyncFlush C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:506


previously allocated by thread T0 here:
    #0 0x7ff7becfcd4d in malloc C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\asan\asan_malloc_win.cpp:98
    #1 0x7ffb68a05b9e in operator new D:\a\_work\1\s\src\vctools\crt\vcstartup\src\heap\new_scalar.cpp:36
    #2 0x7ffb6748c3f1 in llvm::User::operator new C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\lib\IR\User.cpp:96
    #3 0x7ffb66425aac in llvm::GetElementPtrInst::Create C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\include\llvm\IR\Instructions.h:866
    #4 0x7ffb6812d5a9 in llvm::IRBuilder<0,llvm::ConstantFolder,clang::CodeGen::CGBuilderInserter<0> >::CreateGEP C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\include\llvm\IR\IRBuilder.h:1077
    #5 0x7ffb688af7a7 in clang::CodeGen::CodeGenFunction::EmitCXXMemberOrOperatorMemberCallExpr C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGExprCXX.cpp:270
    #6 0x7ffb688b0b58 in clang::CodeGen::CodeGenFunction::EmitCXXOperatorMemberCallExpr C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGExprCXX.cpp:500
    #7 0x7ffb68126dd1 in clang::CodeGen::CodeGenFunction::EmitCallExpr C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGExpr.cpp:3662
    #8 0x7ffb681065e3 in clang::CodeGen::CodeGenFunction::EmitCallExprLValue C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGExpr.cpp:3772
    #9 0x7ffb680f484d in clang::CodeGen::CodeGenFunction::EmitLValue C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGExpr.cpp:861
    #10 0x7ffb681035f4 in clang::CodeGen::CodeGenFunction::EmitCheckedLValue C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGExpr.cpp:813
    #11 0x7ffb680d082e in `anonymous namespace'::ScalarExprEmitter::VisitCallExpr C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGExprScalar.cpp:361
    #12 0x7ffb680b7061 in `anonymous namespace'::ScalarExprEmitter::Visit C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGExprScalar.cpp:230
    #13 0x7ffb680e3630 in `anonymous namespace'::ScalarExprEmitter::VisitCastExpr C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGExprScalar.cpp:1528
    #14 0x7ffb680b6da6 in `anonymous namespace'::ScalarExprEmitter::Visit C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGExprScalar.cpp:230
    #15 0x7ffb680b589f in clang::CodeGen::CodeGenFunction::EmitScalarExpr C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGExprScalar.cpp:3926
    #16 0x7ffb681464ab in clang::CodeGen::CodeGenFunction::EmitScalarInit C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGDecl.cpp:624
    #17 0x7ffb6814b209 in clang::CodeGen::CodeGenFunction::EmitExprAsInit C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGDecl.cpp:1269
    #18 0x7ffb68148b20 in clang::CodeGen::CodeGenFunction::EmitAutoVarInit C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGDecl.cpp:1174
    #19 0x7ffb6814327b in clang::CodeGen::CodeGenFunction::EmitVarDecl C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGDecl.cpp:165
    #20 0x7ffb687176a9 in clang::CodeGen::CodeGenFunction::EmitSimpleStmt C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGStmt.cpp:264
    #21 0x7ffb68716ac3 in clang::CodeGen::CodeGenFunction::EmitStmt C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGStmt.cpp:52
    #22 0x7ffb6872507a in clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CGStmt.cpp:305
    #23 0x7ffb68137324 in clang::CodeGen::CodeGenFunction::EmitFunctionBody C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CodeGenFunction.cpp:811
    #24 0x7ffb68138743 in clang::CodeGen::CodeGenFunction::GenerateCode C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CodeGenFunction.cpp:932
    #25 0x7ffb67a51206 in clang::CodeGen::CodeGenModule::EmitGlobalFunctionDefinition C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CodeGenModule.cpp:2620
    #26 0x7ffb67a4715d in clang::CodeGen::CodeGenModule::EmitGlobalDefinition C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CodeGenModule.cpp:1603
    #27 0x7ffb67a4e993 in clang::CodeGen::CodeGenModule::EmitGlobal C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\tools\clang\lib\CodeGen\CodeGenModule.cpp:1451

SUMMARY: AddressSanitizer: heap-use-after-free C:\b\s\w\ir\cache\builder\src\third_party\dawn\third_party\dxc\lib\Transforms\IPO\GlobalDCE.cpp:244 in `anonymous namespace'::GlobalDCE::GlobalIsNeeded
Shadow bytes around the buggy address:
  0x11dbb0bc9f80: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
  0x11dbb0bca000: fa fa f7 fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x11dbb0bca080: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa f7 fa
  0x11dbb0bca100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x11dbb0bca180: fd fd fd fd fa fa fa fa fa fa f7 fa fd fd fd fd
=>0x11dbb0bca200: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd
  0x11dbb0bca280: fa fa fa fa fa fa f7 fa fd fd fd fd fd fd fd fd
  0x11dbb0bca300: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x11dbb0bca380: fa fa f7 fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x11dbb0bca400: fd fd fd fd fd fd fd fa fa fa fa fa fa fa f7 fa
  0x11dbb0bca480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

==15112==ADDITIONAL INFO

==15112==Note: Please include this section with the ASan report.
Task trace:
    #0 0x7ffb21ddc1ea in gpu::SchedulerDfs::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler_dfs.cc:684
    #1 0x7ffb21ddc1ea in gpu::SchedulerDfs::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler_dfs.cc:684
    #2 0x7ffb21ddc1ea in gpu::SchedulerDfs::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler_dfs.cc:684
    #3 0x7ffb21ddc1ea in gpu::SchedulerDfs::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler_dfs.cc:684


MiraclePtr Status: NOT PROTECTED
No raw_ptr<T> access to this region was detected prior to this crash.
This crash is still exploitable with MiraclePtr.
Refer to https://chromium.googlesource.com/chromium/src/+/main/base/memory/raw_ptr.md for details.

==15112==END OF ADDITIONAL INFO
==15112==ABORTING
[13380:9656:0523/073419.480:ERROR:gpu_process_host.cc(1002)] GPU process exited unexpectedly: exit_code=1
[13380:9656:0523/073419.480:WARNING:gpu_process_host.cc(1436)] The GPU process has crashed 1 time(s)
Issue 342428008

Description

VULNERABILITY DETAILS

VERSION

REPRODUCTION CASE

Attached:

Issue summary

Comments

Add comment

Issue metadata
