Explicitly disable all attribs before drawing in CopyTextureCHROMIUM

gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc

Index: gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc
diff --git a/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc b/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc
index 36f2b42bd6c2d038cba5ba192d7f7f966f789465..e7022fca0fafed523ce44030151747bb89a3f58b 100644
--- a/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc
+++ b/gpu/command_buffer/service/gles2_cmd_copy_texture_chromium.cc
@@ -388,6 +388,9 @@ void CopyTextureCHROMIUMResourceManager::DoCopyTextureWithTransform(
   glFramebufferTexture2DEXT(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, dest_target,
                             dest_id, level);
 
+  GLint max_attribs = 0;
+  glGetIntegerv(GL_MAX_VERTEX_ATTRIBS, &max_attribs);
+
 #ifndef NDEBUG
   GLenum fb_status = glCheckFramebufferStatusEXT(GL_FRAMEBUFFER);
   if (GL_FRAMEBUFFER_COMPLETE != fb_status) {
@@ -396,6 +399,10 @@ void CopyTextureCHROMIUMResourceManager::DoCopyTextureWithTransform(
 #endif
   {
     glEnableVertexAttribArray(kVertexPositionAttrib);
+    for (int i = 0; i < max_attribs; ++i) {
+      if (i != kVertexPositionAttrib)
+        glDisableVertexAttribArray(i);
+    }

[Ken Russell (switch to Gerrit), 2014/02/11 23:15:24]

The vertex attribute divisor also needs to be set to 0 for
kVertexPositionAttrib. That's almost certainly the cause of the other,
non-crasher, bug. It will be restored in RestoreAttribute.

 
     glBindBuffer(GL_ARRAY_BUFFER, buffer_id_);
     glVertexAttribPointer(kVertexPositionAttrib, 4, GL_FLOAT, GL_FALSE,
@@ -421,7 +428,8 @@ void CopyTextureCHROMIUMResourceManager::DoCopyTextureWithTransform(
     glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
   }
 
-  decoder->RestoreAttribute(kVertexPositionAttrib);
+  for (int i = 0; i < max_attribs; ++i)
+    decoder->RestoreAttribute(i);
   decoder->RestoreTextureState(source_id);
   decoder->RestoreTextureState(dest_id);
   decoder->RestoreTextureUnitBindings(0);