Update the active texture cache before changing the texture binding.

When a new texture is bound, the texture binding state is updated before updating the active texture cache. With this ordering, it is possible to delete the currently bound texture when the binding changes and then use-after-free it when updating the active texture cache. BUG=angleproject:1065186 Change-Id: Id6d56b6c6db423755b195cda1e5cf1bcb1ee7aee Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/2124588 Commit-Queue: Geoff Lang <geofflang@chromium.org> Reviewed-by: Jamie Madill <jmadill@chromium.org>

Update the active texture cache before changing the texture binding.
1288aa12 · Geoff Lang · Commit Bot · b83b0f5e · 1288aa12
Commit 1288aa12 authored Mar 27, 2020 by Geoff Lang Committed by Commit Bot Mar 30, 2020
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

State.cpp src/libANGLE/State.cpp +2 -2

No files found.
--- a/src/libANGLE/State.cpp
+++ b/src/libANGLE/State.cpp
@@ -1386,14 +1386,14 @@ void State::setActiveSampler(unsigned int active)
 void State::setSamplerTexture(const Context *context, TextureType type, Texture *texture)
 {
-    mSamplerTextures[type][mActiveSampler].set(context, texture);
    if (mExecutable && mExecutable->getActiveSamplersMask()[mActiveSampler] &&
        IsTextureCompatibleWithSampler(type, mExecutable->getActiveSamplerTypes()[mActiveSampler]))
    {
        updateActiveTexture(context, mActiveSampler, texture);
    }
+    mSamplerTextures[type][mActiveSampler].set(context, texture);
    mDirtyBits.set(DIRTY_BIT_TEXTURE_BINDINGS);
 }