[Backport] CVE-2022-0978

Fix base level changes not updating FBO completeness check.

M96 merge issues:
  - RendererVk.cpp:
  conflicting kSkippedSyncvalMessages entries
  - vk_helpers.cpp
  getRenderPassWriteCommandCount() not present in M96
  - capture_replay_expectations.txt:
  conflicting skipped test entries
  - src/tests/gl_tests/FramebufferTest.cpp
  RedefineLayerAttachment not present in M96

Backport review link::
https://chromium-review.googlesource.com/c/angle/angle/+/3498282

Bug: chromium:1299264
Change-Id: I663f9e02364d3d716acfa615f8c30e1cca7ece1c
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

2 files changed, 10 insertions, 2 deletions

diff --git a/chromium/third_party/angle/src/libANGLE/Texture.cpp b/chromium/third_party/angle/src/libANGLE/Texture.cpp
index 51b90c12016..8b06fa19d89 100644
--- a/chromium/third_party/angle/src/libANGLE/Texture.cpp
+++ b/chromium/third_party/angle/src/libANGLE/Texture.cpp
@@ -1147,7 +1147,15 @@ void Texture::signalDirtyState(size_t dirtyBit)
     mDirtyBits.set(dirtyBit);
     invalidateCompletenessCache();
     mState.mCachedSamplerFormatValid = false;
-    onStateChange(angle::SubjectMessage::DirtyBitsFlagged);
+
+    if (dirtyBit == DIRTY_BIT_BASE_LEVEL || dirtyBit == DIRTY_BIT_MAX_LEVEL)
+    {
+        onStateChange(angle::SubjectMessage::SubjectChanged);
+    }
+    else
+    {
+        onStateChange(angle::SubjectMessage::DirtyBitsFlagged);
+    }
 }
 
 angle::Result Texture::setImage(Context *context,
diff --git a/chromium/third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.cpp b/chromium/third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.cpp
index b2506365613..a1379fbcea2 100644
--- a/chromium/third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.cpp
+++ b/chromium/third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.cpp
@@ -1379,7 +1379,7 @@ void CommandBufferHelper::invalidateRenderPassDepthAttachment(const gl::DepthSte
 {
     ASSERT(mIsRenderPassCommandBuffer);
     // Keep track of the size of commands in the command buffer.  If the size grows in the
-    // future, that implies that drawing occured since invalidated.
+    // future, that implies that drawing occurred since invalidated.
     mDepthCmdSizeInvalidated = mCommandBuffer.getCommandSize();
 
     // Also track the size if the attachment is currently disabled.