WebGL 2: validate read buffer attachment when reading from FBO

Source/core/html/canvas/WebGLRenderingContextBase.cpp

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 706 matching lines @@
     m_maxCubeMapTextureLevel = WebGLTexture::computeLevelCount(m_maxCubeMapTextureSize, m_maxCubeMapTextureSize, 1);
     m_maxRenderbufferSize = 0;
     webContext()->getIntegerv(GL_MAX_RENDERBUFFER_SIZE, &m_maxRenderbufferSize);
 
     // These two values from EXT_draw_buffers are lazily queried.
     m_maxDrawBuffers = 0;
     m_maxColorAttachments = 0;
 
     m_backDrawBuffer = GL_BACK;
 
+    // set the default read color buffer for FBO
+    m_readbufferOfFBO = GL_COLOR_ATTACHMENT0;
+
     if (isWebGL2OrHigher()) {
         m_defaultVertexArrayObject = WebGLVertexArrayObject::create(this, WebGLVertexArrayObjectBase::VaoTypeDefault);
     } else {
         m_defaultVertexArrayObject = WebGLVertexArrayObjectOES::create(this, WebGLVertexArrayObjectBase::VaoTypeDefault);
     }
     addContextObject(m_defaultVertexArrayObject.get());
     m_boundVertexArrayObject = m_defaultVertexArrayObject;
 
     m_vertexAttribValue.resize(m_maxVertexAttribs);
 
@@ skipping 795 matching lines @@
 
 bool WebGLRenderingContextBase::validateSettableTexFormat(const char* functionName, GLenum format)
 {
     if (WebGLImageConversion::getChannelBitsByFormat(format) & WebGLImageConversion::ChannelDepthStencil) {
         synthesizeGLError(GL_INVALID_OPERATION, functionName, "format can not be set, only rendered to");
         return false;
     }
     return true;
 }
 
+bool WebGLRenderingContextBase::validateReadBufferAttachment(WebGLFramebuffer* readFramebufferBinding)

[Zhenyao Mo, 2015/06/25 22:42:22]

This should not even compile.  You missed the functionName param here.

[yunchao, 2015/06/30 05:44:56]

Sorry. My local Chromium src code has some issues last week. It can not fetch
code and build because of proxy problem. It is OK now. I should run the trybots
to check at that time.

+{
+    if (readFramebufferBinding) {
+        WebGLSharedObject* attachmentObject = readFramebufferBinding->getAttachmentObject(m_readbufferOfFBO);
+        if (!attachmentObject) {
+            synthesizeGLError(GL_INVALID_OPERATION, "copyTexImage2D", "no image attached to read buffer");

[Zhenyao Mo, 2015/06/25 22:42:22]

Should be functionName instead of "copyTexImage2D"

[yunchao, 2015/06/30 05:44:56]

Done.

+            return false;
+        }
+    }
+    return true;
+}
+
 void WebGLRenderingContextBase::copyTexImage2D(GLenum target, GLint level, GLenum internalformat, GLint x, GLint y, GLsizei width, GLsizei height, GLint border)
 {
     if (isContextLost())
         return;
     if (!validateTexFuncParameters("copyTexImage2D", NotTexSubImage2D, target, level, internalformat, width, height, border, internalformat, GL_UNSIGNED_BYTE))
         return;
     if (!validateSettableTexFormat("copyTexImage2D", internalformat))
         return;
     WebGLTexture* tex = validateTextureBinding("copyTexImage2D", target, true);
     if (!tex)
         return;
     if (tex->isImmutable()) {
         synthesizeGLError(GL_INVALID_OPERATION, "copyTexImage2D", "attempted to modify immutable texture");
         return;
     }
     if (!isTexInternalFormatColorBufferCombinationValid(internalformat, boundFramebufferColorFormat())) {
         synthesizeGLError(GL_INVALID_OPERATION, "copyTexImage2D", "framebuffer is incompatible format");
         return;
     }
     if (isNPOTStrict() && level && WebGLTexture::isNPOT(width, height)) {
         synthesizeGLError(GL_INVALID_VALUE, "copyTexImage2D", "level > 0 not power of 2");
         return;
     }
     const char* reason = "framebuffer incomplete";
     if (m_framebufferBinding && !m_framebufferBinding->onAccess(webContext(), &reason)) {
         synthesizeGLError(GL_INVALID_FRAMEBUFFER_OPERATION, "copyTexImage2D", reason);
         return;
     }
+    if (!validateReadBufferAttachment("copyTexImage2D", readFramebufferBinding))
+        return;
     clearIfComposited();
     ScopedDrawingBufferBinder binder(drawingBuffer(), m_framebufferBinding.get());
     webContext()->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
     // FIXME: if the framebuffer is not complete, none of the below should be executed.
     tex->setLevelInfo(target, level, internalformat, width, height, 1, GL_UNSIGNED_BYTE);
 }
 
 void WebGLRenderingContextBase::copyTexSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint x, GLint y, GLsizei width, GLsizei height)
 {
     if (isContextLost())
@@ skipping 23 matching lines @@
         return;
     if (!isTexInternalFormatColorBufferCombinationValid(internalformat, boundFramebufferColorFormat())) {
         synthesizeGLError(GL_INVALID_OPERATION, "copyTexSubImage2D", "framebuffer is incompatible format");
         return;
     }
     const char* reason = "framebuffer incomplete";
     if (m_framebufferBinding && !m_framebufferBinding->onAccess(webContext(), &reason)) {
         synthesizeGLError(GL_INVALID_FRAMEBUFFER_OPERATION, "copyTexSubImage2D", reason);
         return;
     }
+    if (!validateReadBufferAttachment("copyTexSubImage2D", readFramebufferBinding))
+        return;
     clearIfComposited();
     ScopedDrawingBufferBinder binder(drawingBuffer(), m_framebufferBinding.get());
     webContext()->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
 }
 
 PassRefPtrWillBeRawPtr<WebGLBuffer> WebGLRenderingContextBase::createBuffer()
 {
     if (isContextLost())
         return nullptr;
     RefPtrWillBeRawPtr<WebGLBuffer> o = WebGLBuffer::create(this);
@@ skipping 1713 matching lines @@
     GLenum error = WebGLImageConversion::computeImageSizeInBytes(format, type, width, height, m_packAlignment, &totalBytesRequired, &padding);
     if (error != GL_NO_ERROR) {
         synthesizeGLError(error, "readPixels", "invalid dimensions");
         return;
     }
     if (pixels->byteLength() < totalBytesRequired) {
         synthesizeGLError(GL_INVALID_OPERATION, "readPixels", "ArrayBufferView not large enough for dimensions");
         return;
     }
 
+    if (!validateReadBufferAttachment("readPixels", readFramebufferBinding))
+        return;
+
     clearIfComposited();
     void* data = pixels->baseAddress();
 
     {
         ScopedDrawingBufferBinder binder(drawingBuffer(), m_framebufferBinding.get());
         webContext()->readPixels(x, y, width, height, format, type, data);
     }
 
 #if OS(MACOSX)
     // FIXME: remove this section when GL driver bug on Mac is fixed, i.e.,
@@ skipping 2860 matching lines @@
 
     return totalBytesPerPixel;
 }
 
 DrawingBuffer* WebGLRenderingContextBase::drawingBuffer() const
 {
     return m_drawingBuffer.get();
 }
 
 } // namespace blink