WebGL 2: validate read buffer attachment when reading from FBO

Source/core/html/canvas/WebGL2RenderingContextBase.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/html/canvas/WebGL2RenderingContextBase.h"
 
 #include "bindings/core/v8/WebGLAny.h"
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/HTMLImageElement.h"
@@ skipping 156 matching lines @@
         return;
 
     webContext()->invalidateSubFramebuffer(target, attachments.size(), attachments.data(), x, y, width, height);
 }
 
 void WebGL2RenderingContextBase::readBuffer(GLenum mode)
 {
     if (isContextLost())
         return;
 
+    switch (mode) {
+    case GL_BACK:
+    case GL_NONE:
+    case GL_COLOR_ATTACHMENT0:
+        break;
+    default:
+        if (mode > GL_COLOR_ATTACHMENT0
+            && mode < static_cast<GLenum>(GL_COLOR_ATTACHMENT0 + maxColorAttachments()))
+            break;
+        synthesizeGLError(GL_INVALID_ENUM, "readBuffer", "invalid read buffer");
+        return;
+    }
+
+    WebGLFramebuffer* readFramebufferBinding = getFramebufferBinding(GL_READ_FRAMEBUFFER);
+    if (!readFramebufferBinding) {
+        ASSERT(drawingBuffer());
+        if (mode != GL_BACK && mode != GL_NONE) {
+            synthesizeGLError(GL_INVALID_OPERATION, "readBuffer", "invalid read buffer");
+            return;
+        }
+        // translate GL_BACK to GL_COLOR_ATTACHMENT0, because the default
+        // framebuffer for WebGL is not fb 0, it is an internal fbo.
+        if (mode == GL_BACK)
+            mode = GL_COLOR_ATTACHMENT0;
+    } else {
+        if (mode == GL_BACK) {
+            synthesizeGLError(GL_INVALID_OPERATION, "readBuffer", "invalid read buffer");
+            return;
+        }
+        m_readbufferOfFBO = mode;
+    }
     webContext()->readBuffer(mode);
 }
 
 void WebGL2RenderingContextBase::renderbufferStorageImpl(
     GLenum target, GLsizei samples, GLenum internalformat, GLsizei width, GLsizei height,
     const char* functionName)
 {
     switch (internalformat) {
     case GL_R8UI:
     case GL_R8I:
@@ skipping 1583 matching lines @@
         return getIntParameter(scriptState, pname);
     case GL_PACK_SKIP_ROWS:
         return getIntParameter(scriptState, pname);
     case GL_PIXEL_PACK_BUFFER_BINDING:
         return WebGLAny(scriptState, PassRefPtrWillBeRawPtr<WebGLObject>(m_boundPixelPackBuffer.get()));
     case GL_PIXEL_UNPACK_BUFFER_BINDING:
         return WebGLAny(scriptState, PassRefPtrWillBeRawPtr<WebGLObject>(m_boundPixelUnpackBuffer.get()));
     case GL_RASTERIZER_DISCARD:
         return getBooleanParameter(scriptState, pname);
     case GL_READ_BUFFER:
-        return getUnsignedIntParameter(scriptState, pname);
+        {
+            GLint value = 0;
+            if (!isContextLost()) {
+                webContext()->getIntegerv(pname, &value);
+                // translate GL_COLOR_ATTACHMENT0 to GL_BACK for the default framebuffer
+                if (value == GL_COLOR_ATTACHMENT0 && !getFramebufferBinding(GL_READ_FRAMEBUFFER))
+                    value = GL_BACK;
+            }
+            return WebGLAny(scriptState, static_cast<unsigned>(value));
+        }
     case GL_READ_FRAMEBUFFER_BINDING:
         return WebGLAny(scriptState, PassRefPtrWillBeRawPtr<WebGLObject>(m_readFramebufferBinding.get()));
     case GL_SAMPLE_ALPHA_TO_COVERAGE:
         return getBooleanParameter(scriptState, pname);
     case GL_SAMPLE_COVERAGE:
         return getBooleanParameter(scriptState, pname);
     // case GL_SAMPLER_BINDING WebGLSampler
     case GL_TEXTURE_BINDING_2D_ARRAY:
         return WebGLAny(scriptState, PassRefPtrWillBeRawPtr<WebGLObject>(m_textureUnits[m_activeTextureUnit].m_texture2DArrayBinding.get()));
     case GL_TEXTURE_BINDING_3D:
@@ skipping 433 matching lines @@
 GLenum WebGL2RenderingContextBase::boundFramebufferColorFormat()
 {
     if (m_readFramebufferBinding && m_readFramebufferBinding->object())
         return m_readFramebufferBinding->colorBufferFormat();
     if (m_requestedAttributes.alpha())
         return GL_RGBA;
     return GL_RGB;
 }
 
 } // namespace blink