================================================================= ==6426==ERROR: AddressSanitizer: heap-use-after-free on address 0x61a000000311 at pc 0x55ee03c531f7 bp 0x7ffee8e53c60 sp 0x7ffee8e53c50 READ of size 1 at 0x61a000000311 thread T0 #0 0x55ee03c531f6 in test_optpass(int, char**) glsl/test_optpass.cpp:270 #1 0x55ee03c50fe9 in main glsl/test.cpp:71 #2 0x7fbc5df4dae6 in __libc_start_main (/lib64/libc.so.6+0x21ae6) #3 0x55ee03c50cc9 in _start (/mnt/ram/mesa-18.2.4/src/compiler/glsl/glsl_test+0x8acc9) 0x61a000000311 is located 657 bytes inside of 1400-byte region [0x61a000000080,0x61a0000005f8) freed by thread T0 here: #0 0x7fbc5efad750 in __interceptor_free (/usr/lib/gcc/x86_64-pc-linux-gnu/8.2.0/libasan.so.5+0xed750) #1 0x55ee03f48dce in unsafe_free /mnt/ram/mesa-18.2.4/src/util/ralloc.c:276 #2 0x55ee03f48a4c in ralloc_free /mnt/ram/mesa-18.2.4/src/util/ralloc.c:239 #3 0x55ee03c531aa in test_optpass(int, char**) glsl/test_optpass.cpp:267 #4 0x55ee03c50fe9 in main glsl/test.cpp:71 #5 0x7fbc5df4dae6 in __libc_start_main (/lib64/libc.so.6+0x21ae6) #6 0x55ee03c50cc9 in _start (/mnt/ram/mesa-18.2.4/src/compiler/glsl/glsl_test+0x8acc9) previously allocated by thread T0 here: #0 0x7fbc5efadb10 in malloc (/usr/lib/gcc/x86_64-pc-linux-gnu/8.2.0/libasan.so.5+0xedb10) #1 0x55ee03f484d1 in ralloc_size /mnt/ram/mesa-18.2.4/src/util/ralloc.c:121 #2 0x55ee03f48645 in rzalloc_size /mnt/ram/mesa-18.2.4/src/util/ralloc.c:153 #3 0x55ee03c535ee in _mesa_glsl_parse_state::operator new(unsigned long, void*) glsl/glsl_parser_extras.h:83 #4 0x55ee03c52884 in test_optpass(int, char**) glsl/test_optpass.cpp:209 #5 0x55ee03c50fe9 in main glsl/test.cpp:71 #6 0x7fbc5df4dae6 in __libc_start_main (/lib64/libc.so.6+0x21ae6) #7 0x55ee03c50cc9 in _start (/mnt/ram/mesa-18.2.4/src/compiler/glsl/glsl_test+0x8acc9) SUMMARY: AddressSanitizer: heap-use-after-free glsl/test_optpass.cpp:270 in test_optpass(int, char**) Shadow bytes around the buggy address: 0x0c347fff8010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c347fff8020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c347fff8030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c347fff8040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c347fff8050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c347fff8060: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c347fff8070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c347fff8080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c347fff8090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c347fff80a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c347fff80b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==6426==ABORTING