Commit 38723c28c0a5eb61ad70c5ac3dec12de438d8e11
2022-02-15T16:29:36
Vulkan: Allocate space for default attrib only if it is enabled When context's default attributes is dirty, we allocate space for the default attribute, regardless it is enabled or not. Then we call into VertexArrayVk::updateDefaultAttrib() which only update its state if the attribute is enabled. This causes a use-after-free scenario that if it is disabled, the vertex array may have a pointer to the buffer that is now becomes inflight which may gets deleted when DynamicBuffer code think the size no longer matches etc. Bug: chromium:1296467 Change-Id: Ib9ec8e60ebdb326f9bbfb215b3711c37631fce4b Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3466776 Reviewed-by: Jamie Madill <jmadill@chromium.org> Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org> Commit-Queue: Charlie Lao <cclao@google.com>