commit 28bedaf892e4ca63aeae98a76b65744fe0191202
author Jamie Madill <jmadill@chromium.org> Thu Jun 26 13:17:22 2014 -0400
committer Jamie Madill <jmadill@chromium.org> Thu Jun 26 17:36:39 2014 +0000
tree 0677166df02f9bcd5bdf96cb2af190d987cd8262
parent d38f926ad0a14e8927db2468df840a3ecf330924

Fix double delete in Framebuffer.cpp.

Depth-stencil buffers were using the same pointer for both
attachments, which was causing a double-delete in the
Framebuffer destructor.

BUG=angle:686

Change-Id: I8b263e5a084c33b495ce18ef2a2a810918ef6540
Reviewed-on: https://chromium-review.googlesource.com/205639
Tested-by: Jamie Madill <jmadill@chromium.org>
Reviewed-by: Geoff Lang <geofflang@chromium.org>

src/libGLESv2/Framebuffer.cpp

diff --git a/src/libGLESv2/Framebuffer.cpp b/src/libGLESv2/Framebuffer.cpp
index b220f1d..4d5e8d4 100644
--- a/src/libGLESv2/Framebuffer.cpp
+++ b/src/libGLESv2/Framebuffer.cpp
@@ -160,7 +160,10 @@
     if (attachment && attachment->getDepthSize() > 0 && attachment->getStencilSize() > 0)
     {
         mDepthbuffer = attachment;
-        mStencilbuffer = attachment;
+
+        // Make a new attachment object to ensure we do not double-delete
+        // See angle issue 686
+        mStencilbuffer = createAttachment(type, depthStencilBuffer, level, layer);
     }
 }
 
@@ -618,10 +621,12 @@
     Renderbuffer *colorRenderbuffer = new Renderbuffer(0, colorbuffer);
     mColorbuffers[0] = new RenderbufferAttachment(colorRenderbuffer);
 
-    Renderbuffer *depthStencilRenderbuffer = new Renderbuffer(0, depthStencil);
-    FramebufferAttachment *depthStencilAttachment = new RenderbufferAttachment(depthStencilRenderbuffer);
-    mDepthbuffer = (depthStencilRenderbuffer->getDepthSize() != 0 ? depthStencilAttachment : NULL);
-    mStencilbuffer = (depthStencilRenderbuffer->getStencilSize() != 0 ? depthStencilAttachment : NULL);
+    Renderbuffer *depthStencilBuffer = new Renderbuffer(0, depthStencil);
+
+    // Make a new attachment objects to ensure we do not double-delete
+    // See angle issue 686
+    mDepthbuffer = (depthStencilBuffer->getDepthSize() != 0 ? new RenderbufferAttachment(depthStencilBuffer) : NULL);
+    mStencilbuffer = (depthStencilBuffer->getStencilSize() != 0 ? new RenderbufferAttachment(depthStencilBuffer) : NULL);
 
     mDrawBufferStates[0] = GL_BACK;
     mReadBufferState = GL_BACK;