Fix WebGL compat feedback loop null deref.

src/libANGLE/VertexAttribute.cpp

@@ -86,7 +86,7 @@ VertexAttribute::VertexAttribute(GLuint bindingIndex)
       relativeOffset(0),
       vertexAttribArrayStride(0),
       bindingIndex(bindingIndex),
-      cachedSizePlusRelativeOffset(0)
+      cachedSizePlusRelativeOffset(16)
 {
 }
 

src/libANGLE/validationES.cpp

@@ -173,7 +173,7 @@ bool ValidateDrawAttribs(Context *context, GLint primcount, GLint maxVertex, GLi
             const VertexBinding &binding = vertexBindings[attrib.bindingIndex];
 
             gl::Buffer *buffer = binding.getBuffer().get();
-            if (buffer->isBoundForTransformFeedbackAndOtherUse())
+            if (buffer && buffer->isBoundForTransformFeedbackAndOtherUse())
             {
                 ANGLE_VALIDATION_ERR(context, InvalidOperation(),
                                      VertexBufferBoundForTransformFeedback);

src/tests/gl_tests/WebGLCompatibilityTest.cpp

@@ -4135,6 +4135,23 @@ TEST_P(WebGL2CompatibilityTest, BindAttribLocationLimitation)
     EXPECT_GL_ERROR(GL_INVALID_VALUE);
 }
 
+// Covers a bug in transform feedback loop detection.
+TEST_P(WebGL2CompatibilityTest, TransformFeedbackCheckNullDeref)
+{
+    constexpr char kVS[] = R"(attribute vec4 color; void main() { color.r; })";
+    constexpr char kFS[] = R"(void main(){})";
+    ANGLE_GL_PROGRAM(program, kVS, kFS);
+    glUseProgram(program);
+
+    GLBuffer buffer;
+    glBindBuffer(GL_ARRAY_BUFFER, buffer);
+    glEnableVertexAttribArray(0);
+    glDrawArrays(GL_POINTS, 0, 1);
+
+    // This should fail because it is trying to pull one vertex from an empty buffer.
+    EXPECT_GL_ERROR(GL_INVALID_OPERATION);
+}
+
 // Use this to select which configurations (e.g. which renderer, which GLES major version) these
 // tests should be run against.
 ANGLE_INSTANTIATE_TEST(WebGLCompatibilityTest,