Buffer11: Fix use-after-free with system memory storage.

src/libANGLE/renderer/d3d/d3d11/Buffer11.cpp

@@ -571,16 +571,19 @@ bool Buffer11::canDeallocateSystemMemory() const
             mSize <= mRenderer->getNativeCaps().maxUniformBlockSize);
 }
 
-gl::Error Buffer11::markBufferUsage(BufferUsage usage)
+void Buffer11::markBufferUsage(BufferUsage usage)
 {
     mIdleness[usage] = 0;
+}
 
-    if (usage != BUFFER_USAGE_SYSTEM_MEMORY && canDeallocateSystemMemory())
+gl::Error Buffer11::garbageCollection(BufferUsage currentUsage)
+{
+    if (currentUsage != BUFFER_USAGE_SYSTEM_MEMORY && canDeallocateSystemMemory())
     {
         ANGLE_TRY(checkForDeallocation(BUFFER_USAGE_SYSTEM_MEMORY));
     }
 
-    if (usage != BUFFER_USAGE_STAGING)
+    if (currentUsage != BUFFER_USAGE_STAGING)
     {
         ANGLE_TRY(checkForDeallocation(BUFFER_USAGE_STAGING));
     }
@@ -686,14 +689,18 @@ gl::ErrorOrResult<Buffer11::BufferStorage *> Buffer11::getBufferStorage(BufferUs
         newStorage = allocateStorage(usage);
     }
 
+    markBufferUsage(usage);
+
     // resize buffer
     if (newStorage->getSize() < mSize)
     {
         ANGLE_TRY(newStorage->resize(mSize, true));
     }
 
+    ASSERT(newStorage);
+
     ANGLE_TRY(updateBufferStorage(newStorage, 0, mSize));
-    ANGLE_TRY(markBufferUsage(usage));
+    ANGLE_TRY(garbageCollection(usage));
 
     return newStorage;
 }
@@ -737,6 +744,8 @@ gl::ErrorOrResult<Buffer11::BufferStorage *> Buffer11::getConstantBufferRangeSto
         newStorage           = cacheEntry->storage;
     }
 
+    markBufferUsage(BUFFER_USAGE_UNIFORM);
+
     if (newStorage->getSize() < static_cast<size_t>(size))
     {
         size_t maximumAllowedAdditionalSize = 2 * getSize();
@@ -771,7 +780,7 @@ gl::ErrorOrResult<Buffer11::BufferStorage *> Buffer11::getConstantBufferRangeSto
     }
 
     ANGLE_TRY(updateBufferStorage(newStorage, offset, size));
-    ANGLE_TRY(markBufferUsage(BUFFER_USAGE_UNIFORM));
+    ANGLE_TRY(garbageCollection(BUFFER_USAGE_UNIFORM));
     return newStorage;
 }
 
@@ -782,6 +791,8 @@ gl::Error Buffer11::updateBufferStorage(BufferStorage *storage,
     BufferStorage *latestBuffer = nullptr;
     ANGLE_TRY_RESULT(getLatestBufferStorage(), latestBuffer);
 
+    ASSERT(storage);
+
     if (latestBuffer && latestBuffer->getDataRevision() > storage->getDataRevision())
     {
         // Copy through a staging buffer if we're copying from or to a non-staging, mappable

src/libANGLE/renderer/d3d/d3d11/Buffer11.h

@@ -106,7 +106,8 @@ class Buffer11 : public BufferD3D
         unsigned int lruCount;
     };
 
-    gl::Error markBufferUsage(BufferUsage usage);
+    void markBufferUsage(BufferUsage usage);
+    gl::Error garbageCollection(BufferUsage currentUsage);
     gl::ErrorOrResult<NativeStorage *> getStagingStorage();
     gl::ErrorOrResult<PackStorage *> getPackStorage();
     gl::ErrorOrResult<SystemMemoryStorage *> getSystemMemoryStorage();