The test does this: 1. Context 1: Read Texture 1 and draw into Framebuffer 1 2. Context 2: Read Texture 1 and draw into Framebuffer 2 3. Context 1: Delete Framebuffer 1 4. Context 1: Flush 5. Context 2: Modify Texture 1 Issue is Texture 1's mCurrentReadingNodes contains one node from each context's command graph, one of which is deleted at step 4. At step 5, a dependency is added from both nodes (one already deleted) to a new node, causing use-after-free. Bug: angleproject:4130 Change-Id: I06720aec20d0b49114937f1cd9b193a4f1df9d8d Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/1924790Reviewed-by:Geoff Lang <geofflang@chromium.org> Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org>
| Name |
Last commit
|
Last update |
|---|---|---|
| .. | ||
| third_party | Loading commit data... | |
| ANGLETest.cpp | Loading commit data... | |
| ANGLETest.h | Loading commit data... | |
| ConstantFoldingTest.cpp | Loading commit data... | |
| ConstantFoldingTest.h | Loading commit data... | |
| MultiviewTest.cpp | Loading commit data... | |
| MultiviewTest.h | Loading commit data... | |
| ShaderCompileTreeTest.cpp | Loading commit data... | |
| ShaderCompileTreeTest.h | Loading commit data... | |
| ShaderExtensionTest.h | Loading commit data... | |
| VulkanExternalHelper.cpp | Loading commit data... | |
| VulkanExternalHelper.h | Loading commit data... | |
| angle_test_configs.cpp | Loading commit data... | |
| angle_test_configs.h | Loading commit data... | |
| angle_test_instantiate.cpp | Loading commit data... | |
| angle_test_instantiate.h | Loading commit data... | |
| angle_test_instantiate_apple.h | Loading commit data... | |
| angle_test_instantiate_apple.mm | Loading commit data... | |
| compiler_test.cpp | Loading commit data... | |
| compiler_test.h | Loading commit data... | |
| draw_call_perf_utils.cpp | Loading commit data... | |
| draw_call_perf_utils.h | Loading commit data... | |
| gl_raii.h | Loading commit data... |