Commit 80b2411a by Corentin Wallez

Context: directly delete the resource instead of also detaching

Otherwise when detaching vertex array 0 and N the following would happen: - call Context::deleteVertexArray(0) - call Context::detachVertexArray(0) - call State::removeVertexArrayBinding(0) set mVertexArray to nullptr, returns true - call State::bindVertexArray(0) reset mVertexArray to its previous value - call Context::deleteVertexArray(n) - call Context::detachVertexArray(n) - call State::removeVertexArrayBinding(n) Incorrectly call mVertexArray->id() which is a use after free. BUG=angleproject:1137 Change-Id: I594044fee6c90b1775a61943b15df92bf323ff2a Reviewed-on: https://chromium-review.googlesource.com/295123Reviewed-by: 's avatarJamie Madill <jmadill@chromium.org> Reviewed-by: 's avatarGeoff Lang <geofflang@chromium.org> Tested-by: 's avatarCorentin Wallez <cwallez@chromium.org>
parent 5f57cc6e
......@@ -140,25 +140,25 @@ Context::~Context()
}
}
while (!mFenceNVMap.empty())
for (auto fence : mFenceNVMap)
{
deleteFenceNV(mFenceNVMap.begin()->first);
SafeDelete(fence.second);
}
while (!mQueryMap.empty())
for (auto query : mQueryMap)
{
deleteQuery(mQueryMap.begin()->first);
query.second->release();
}
while (!mVertexArrayMap.empty())
for (auto vertexArray : mVertexArrayMap)
{
deleteVertexArray(mVertexArrayMap.begin()->first);
SafeDelete(vertexArray.second);
}
mTransformFeedbackZero.set(NULL);
while (!mTransformFeedbackMap.empty())
for (auto transformFeedback : mTransformFeedbackMap)
{
deleteTransformFeedback(mTransformFeedbackMap.begin()->first);
SafeDelete(transformFeedback.second);
}
for (auto &zeroTexture : mZeroTextures)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment