WebGL 2: validate read buffer attachment when reading from FBO

Source/core/html/canvas/WebGL2RenderingContextBase.cpp

Index: Source/core/html/canvas/WebGL2RenderingContextBase.cpp
diff --git a/Source/core/html/canvas/WebGL2RenderingContextBase.cpp b/Source/core/html/canvas/WebGL2RenderingContextBase.cpp
index 73963ac03302f8ecfec4700282f78e7884e43238..60922d7a8d59c494c3c4177c33a345701237ddc3 100644
--- a/Source/core/html/canvas/WebGL2RenderingContextBase.cpp
+++ b/Source/core/html/canvas/WebGL2RenderingContextBase.cpp
@@ -168,6 +168,37 @@ void WebGL2RenderingContextBase::readBuffer(GLenum mode)
     if (isContextLost())
         return;
 
+    switch (mode) {
+    case GL_BACK:
+    case GL_NONE:
+    case GL_COLOR_ATTACHMENT0:
+        break;
+    default:
+        if (attachment > GL_COLOR_ATTACHMENT0
+            && attachment < static_cast<GLenum>(GL_COLOR_ATTACHMENT0 + maxColorAttachments()))
+            break;
+        synthesizeGLError(GL_INVALID_ENUM, "readBuffer", "invalid read buffer");
+        return;
+    }
+
+    WebGLFramebuffer* readFramebufferBinding = getFramebufferBinding(GL_READ_FRAMEBUFFER);
+    if (!readFramebufferBinding) {
+        ASSERT(drawingBuffer());
+        if (mode != GL_BACK || mode != GL_NONE) {

[Zhenyao Mo, 2015/06/25 22:42:22]

&&, not ||

[yunchao, 2015/06/30 05:44:56]

Done.

+            synthesizeGLError(GL_INVALID_OPERATION, "readBuffer", "invalid read buffer");
+            return;
+        }
+        // translate GL_BACK to GL_COLOR_ATTACHMENT0, because the default
+        // framebuffer for WebGL is not fb 0, it is an internal fbo.
+        if (mode == GL_BACK)
+            mode = GL_COLOR_ATTACHMENT0;

[Zhenyao Mo, 2015/06/25 22:42:22]

You also need to emulate the reverse in getParameter(READ_BUFFER). I feel it
should be done in the same CL.

[yunchao, 2015/06/30 05:44:56]

Yeah, totally agree with you.

+    } else {
+        if (mode == GL_BACK) {
+            synthesizeGLError(GL_INVALID_OPERATION, "readBuffer", "invalid read buffer");
+            return;
+        }
+        m_readbufferOfFBO = mode;
+    }
     webContext()->readBuffer(mode);
 }