commit 375c37c9ab3e01c834fae5e0c04d80fb8cf36024
author Jamie Madill <jmadill@chromium.org> Tue Jul 21 15:14:08 2015 -0400
committer Jamie Madill <jmadill@chromium.org> Tue Jul 21 20:09:24 2015 +0000
tree 2d969612fbe5442297c52af0c5014cc556675965
parent 86af3d278974d1b0053942e4bc6d8118dcd8bf9b

ES3: Fix crash when binding nullptr to DEPTH_STENCIL.

In some cases, binding nullptr could query for the internal format
of the null object, causing us to dereference null and crash.

BUG=angleproject:1080
TEST=dEQP-GLES3.functional.multisample.fbo_*

Change-Id: I592ab31dc1efadfac003c39051632fc2a0fff0cc
Reviewed-on: https://chromium-review.googlesource.com/286853
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Tested-by: Jamie Madill <jmadill@chromium.org>

src/libANGLE/Framebuffer.cpp

diff --git a/src/libANGLE/Framebuffer.cpp b/src/libANGLE/Framebuffer.cpp
index 635c8c6..04c7856 100644
--- a/src/libANGLE/Framebuffer.cpp
+++ b/src/libANGLE/Framebuffer.cpp
@@ -601,19 +601,21 @@
     if (binding == GL_DEPTH_STENCIL || binding == GL_DEPTH_STENCIL_ATTACHMENT)
     {
         // ensure this is a legitimate depth+stencil format
-        FramebufferAttachment::Target target(binding, textureIndex);
-        GLenum internalFormat = resource->getAttachmentInternalFormat(target);
-        const InternalFormat &formatInfo = GetInternalFormatInfo(internalFormat);
-        if (resource && formatInfo.depthBits > 0 && formatInfo.stencilBits > 0)
+        FramebufferAttachmentObject *attachmentObj = resource;
+        if (resource)
         {
-            mData.mDepthAttachment.attach(type, binding, textureIndex, resource);
-            mData.mStencilAttachment.attach(type, binding, textureIndex, resource);
+            FramebufferAttachment::Target target(binding, textureIndex);
+            GLenum internalFormat            = resource->getAttachmentInternalFormat(target);
+            const InternalFormat &formatInfo = GetInternalFormatInfo(internalFormat);
+            if (formatInfo.depthBits == 0 || formatInfo.stencilBits == 0)
+            {
+                // Attaching nullptr detaches the current attachment.
+                attachmentObj = nullptr;
+            }
         }
-        else
-        {
-            mData.mDepthAttachment.detach();
-            mData.mStencilAttachment.detach();
-        }
+
+        mData.mDepthAttachment.attach(type, binding, textureIndex, attachmentObj);
+        mData.mStencilAttachment.attach(type, binding, textureIndex, attachmentObj);
         mImpl->onUpdateDepthStencilAttachment();
     }
     else