chore: cherry-pick 4a65a669e11b from angle

[ppontes]

M104: Vulkan: Fix garbage collection vs outside-RP-only flush

In https://chromium-review.googlesource.com/c/angle/angle/+/3379231, an
optimization was implemented such that the excessive recorded texture
uploads would get flushed early and submitted. This caused a
use-after-free bug in the following situation:

• Draw with pipeline A
• Delete A <--- this puts A in the Context garbage list
• Upload a lot of data

At this point, the flush threshold could pass and the commands recorded
outside of the render pass up to this point would be submitted.
Associated with this submission was the current garbage, including
pipeline A. However, the render pass that uses pipeline A is still not
submitted.

Now if after some time the render pass is still open, but the "completed
commands" are checked (another set of uploads causing another
submission, a query status check, etc), the garbage can be cleaned up.

When the render pass closes next and is submitted, the implementation
attempts to use the pipeline, which is already deleted.

In this change, outside-render-pass-only submissions no longer reference
the current garbage. This has the side effect that the temporary
buffers used for uploading texture data won't be released early. A
future optimization may want to separate the garbage list in ContextVk
to render pass and outside render pass garbage.

Bug: chromium:1337538
Change-Id: Ibfc11f2b0d166b0c325fced725f23d6b9328ff98
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3821371
Reviewed-by: Amirali Abdolrashidi abdolrashidi@google.com

Ref electron/security#201

Notes: Security: backported fix for CVE-2022-2854.

[release-clerk]

Release Notes Persisted

Security: backported fix for CVE-2022-2854.