commit 1288aa12369e36c3413537a6cbef6b8e7260fe98
author Geoff Lang <geofflang@chromium.org> Fri Mar 27 12:24:52 2020 -0400
committer Commit Bot <commit-bot@chromium.org> Mon Mar 30 20:02:14 2020 +0000
tree 72f6406afe092de09bf6f37afe49e1446de9cd82
parent b83b0f5e9f63261d3d95a75b74ad758509d7a349

Update the active texture cache before changing the texture binding.

When a new texture is bound, the texture binding state is updated before
updating the active texture cache. With this ordering, it is possible to delete
the currently bound texture when the binding changes and then use-after-free it
when updating the active texture cache.

BUG=angleproject:1065186

Change-Id: Id6d56b6c6db423755b195cda1e5cf1bcb1ee7aee
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/2124588
Commit-Queue: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Jamie Madill <jmadill@chromium.org>

src/libANGLE/State.cpp

diff --git a/src/libANGLE/State.cpp b/src/libANGLE/State.cpp
index 452a695..da929a6 100644
--- a/src/libANGLE/State.cpp
+++ b/src/libANGLE/State.cpp
@@ -1386,14 +1386,14 @@
 
 void State::setSamplerTexture(const Context *context, TextureType type, Texture *texture)
 {
-    mSamplerTextures[type][mActiveSampler].set(context, texture);
-
     if (mExecutable && mExecutable->getActiveSamplersMask()[mActiveSampler] &&
         IsTextureCompatibleWithSampler(type, mExecutable->getActiveSamplerTypes()[mActiveSampler]))
     {
         updateActiveTexture(context, mActiveSampler, texture);
     }
 
+    mSamplerTextures[type][mActiveSampler].set(context, texture);
+
     mDirtyBits.set(DIRTY_BIT_TEXTURE_BINDINGS);
 }