diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc index f9a8cd8a64bc8..788d2c94a89b2 100644 --- a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc +++ b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc @@ -1706,10 +1706,14 @@ void GLES2DecoderPassthroughImpl::MarkContextLost( resources_->MarkContextLost(); } - // SECURITY: crbug.com/500187083. Unconditionally clear the debug callback - // if current context IsCurrent before it gets lost to prevent UAF. + // SECURITY: crbug.com/500187083. Unconditionally clear per-context + // callbacks that hold a raw `this` pointer if the context IsCurrent before + // it gets lost, to prevent UAF when Destroy(have_context=false) skips them. if (api()) { api()->glDebugMessageCallbackKHRFn(nullptr, nullptr); + if (feature_info_ && feature_info_->feature_flags().angle_blob_cache) { + api()->glBlobCacheCallbacksANGLEFn(nullptr, nullptr, nullptr); + } } }