commit ed54e5db326cfd0c8db67f671b0c98834f8a6e46
author Gregoire Payen de La Garanderie <Gregory.Payen@imgtec.com> Tue Mar 17 16:51:24 2015 +0000
committer Jamie Madill <jmadill@chromium.org> Thu Mar 19 17:22:35 2015 +0000
tree 28ddcaf3c4ae32d7d5faa06824ef3c25d35f6d45
parent e79904c37c361bc689c86565ccea01575a7fdd2f

Fix framebuffer zero used after being destroyed in Context destructor.

BUG=angleproject:950

Change-Id: I06e9e6ccf92ee8ca0b1de98cc48ef68a85107214
Reviewed-on: https://chromium-review.googlesource.com/260573
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Tested-by: Gregoire Payen de La Garanderie <Gregory.Payen@imgtec.com>

src/libANGLE/Context.cpp

diff --git a/src/libANGLE/Context.cpp b/src/libANGLE/Context.cpp
index a37d8b3..5ea039f 100644
--- a/src/libANGLE/Context.cpp
+++ b/src/libANGLE/Context.cpp
@@ -133,7 +133,8 @@
 
     while (!mFramebufferMap.empty())
     {
-        deleteFramebuffer(mFramebufferMap.begin()->first);
+        // Delete the framebuffer in reverse order to destroy the framebuffer zero last.
+        deleteFramebuffer(mFramebufferMap.rbegin()->first);
     }
 
     while (!mFenceNVMap.empty())
@@ -1346,12 +1347,12 @@
     // If a framebuffer that is currently bound to the target FRAMEBUFFER is deleted, it is as though
     // BindFramebuffer had been executed with the target of FRAMEBUFFER and framebuffer of zero.
 
-    if (mState.removeReadFramebufferBinding(framebuffer))
+    if (mState.removeReadFramebufferBinding(framebuffer) && framebuffer != 0)
     {
         bindReadFramebuffer(0);
     }
 
-    if (mState.removeDrawFramebufferBinding(framebuffer))
+    if (mState.removeDrawFramebufferBinding(framebuffer) && framebuffer != 0)
     {
         bindDrawFramebuffer(0);
     }