commit daa8c27f57c16cfc574ec6e4b32d56396f70c4bd
author Jamie Madill <jmadill@chromium.org> Wed Nov 18 14:13:55 2015 -0500
committer Jamie Madill <jmadill@chromium.org> Wed Nov 18 21:19:51 2015 +0000
tree 6efbed4dc0c42cb4491ff6a2ea66f5dba83bc1ab
parent 55c25d0cf26f66da41f1fe8d9dc6dc0cb1b1bfd9

Fix a user-after-free in a ValidationES unittest.

The State destructor was trying to unref a Program that had already
been deleted. Fix this by unbinding resources from State before we
exit the test.

BUG=554520

Change-Id: I2215b1e5d27a34a649572c8f81e96dfeef7e983e
Reviewed-on: https://chromium-review.googlesource.com/312977
Tryjob-Request: Jamie Madill <jmadill@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Tested-by: Jamie Madill <jmadill@chromium.org>

src/libANGLE/validationES_unittest.cpp

diff --git a/src/libANGLE/validationES_unittest.cpp b/src/libANGLE/validationES_unittest.cpp
index 1b84c00..1b4a640 100644
--- a/src/libANGLE/validationES_unittest.cpp
+++ b/src/libANGLE/validationES_unittest.cpp
@@ -132,6 +132,11 @@
                                       &indexRange));
 
     texture->release();
+
+    state.setVertexArrayBinding(nullptr);
+    state.setDrawFramebufferBinding(nullptr);
+    state.setProgram(nullptr);
+
     SafeDelete(vertexArray);
     SafeDelete(framebuffer);
     SafeDelete(program);