WebGL 2: validate read buffer attachment when reading from FBO

Source/core/html/canvas/WebGL2RenderingContextBase.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef WebGL2RenderingContextBase_h
 #define WebGL2RenderingContextBase_h
 
 #include "core/html/canvas/WebGLExtension.h"
 #include "core/html/canvas/WebGLRenderingContextBase.h"
 #include "wtf/PassRefPtr.h"
@@ skipping 193 matching lines @@
 
     WebGLBuffer* validateBufferDataTarget(const char* functionName, GLenum target) override;
 
     void removeBoundBuffer(WebGLBuffer*) override;
 
     RefPtrWillBeMember<WebGLFramebuffer> m_readFramebufferBinding;
     RefPtrWillBeMember<WebGLTransformFeedback> m_transformFeedbackBinding;
     GLint m_max3DTextureSize;
     GLint m_max3DTextureLevel;
 
+    GLenum m_readBuffer;
+
     RefPtrWillBeMember<WebGLBuffer> m_boundCopyReadBuffer;
     RefPtrWillBeMember<WebGLBuffer> m_boundCopyWriteBuffer;
     RefPtrWillBeMember<WebGLBuffer> m_boundPixelPackBuffer;
     RefPtrWillBeMember<WebGLBuffer> m_boundPixelUnpackBuffer;
     RefPtrWillBeMember<WebGLBuffer> m_boundTransformFeedbackBuffer;
     RefPtrWillBeMember<WebGLBuffer> m_boundUniformBuffer;
 
     RefPtrWillBeMember<WebGLQuery> m_currentBooleanOcclusionQuery;
     RefPtrWillBeMember<WebGLQuery> m_currentTransformFeedbackPrimitivesWrittenQuery;
 };
 
 DEFINE_TYPE_CASTS(WebGL2RenderingContextBase, CanvasRenderingContext, context,
     context->is3d() && WebGLRenderingContextBase::getWebGLVersion(context) >= 2,
     context.is3d() && WebGLRenderingContextBase::getWebGLVersion(&context) >= 2);
 
 } // namespace blink
 
 #endif