Update the active texture cache before changing the texture binding.

When a new texture is bound, the texture binding state is updated before updating the active texture cache. With this ordering, it is possible to delete the currently bound texture when the binding changes and then use-after-free it when updating the active texture cache. BUG=chromium:1065186 Change-Id: Id6d56b6c6db423755b195cda1e5cf1bcb1ee7aee Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/2124588 Commit-Queue: Geoff Lang <geofflang@chromium.org> Reviewed-by: Jamie Madill <jmadill@chromium.org> (cherry picked from commit 1288aa12) Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/2156966Reviewed-by: Geoff Lang <geofflang@chromium.org>

Update the active texture cache before changing the texture binding.
91c39dae · Geoff Lang · e514b0cb · 91c39dae
Commit 91c39dae authored Mar 27, 2020 by Geoff Lang
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

State.cpp src/libANGLE/State.cpp +2 -2

No files found.
--- a/src/libANGLE/State.cpp
+++ b/src/libANGLE/State.cpp
@@ -1170,14 +1170,14 @@ void State::setActiveSampler(unsigned int active)

 void State::setSamplerTexture(const Context *context, TextureType type, Texture *texture)
 {
-    mSamplerTextures[type][mActiveSampler].set(context, texture);
-
    if (mProgram && mProgram->getActiveSamplersMask()[mActiveSampler] &&
        IsTextureCompatibleWithSampler(type, mProgram->getActiveSamplerTypes()[mActiveSampler]))
    {
        updateActiveTexture(context, mActiveSampler, texture);
    }

+    mSamplerTextures[type][mActiveSampler].set(context, texture);
+
    mDirtyBits.set(DIRTY_BIT_TEXTURE_BINDINGS);
 }