WebGL 2: validate read buffer attachment when reading from FBO

Source/core/html/canvas/WebGL2RenderingContextBase.cpp

Index: Source/core/html/canvas/WebGL2RenderingContextBase.cpp
diff --git a/Source/core/html/canvas/WebGL2RenderingContextBase.cpp b/Source/core/html/canvas/WebGL2RenderingContextBase.cpp
index fc6847ba6ca970f4b6a80fd8283a7d447ac7f31c..52199f4388d13528bf10a7973bcbf79e792c3fc9 100644
--- a/Source/core/html/canvas/WebGL2RenderingContextBase.cpp
+++ b/Source/core/html/canvas/WebGL2RenderingContextBase.cpp
@@ -174,6 +174,37 @@ void WebGL2RenderingContextBase::readBuffer(GLenum mode)
     if (isContextLost())
         return;
 
+    switch (mode) {
+    case GL_BACK:
+    case GL_NONE:
+    case GL_COLOR_ATTACHMENT0:
+        break;
+    default:
+        if (mode > GL_COLOR_ATTACHMENT0
+            && mode < static_cast<GLenum>(GL_COLOR_ATTACHMENT0 + maxColorAttachments()))
+            break;
+        synthesizeGLError(GL_INVALID_ENUM, "readBuffer", "invalid read buffer");
+        return;
+    }
+
+    WebGLFramebuffer* readFramebufferBinding = getFramebufferBinding(GL_READ_FRAMEBUFFER);
+    if (!readFramebufferBinding) {
+        ASSERT(drawingBuffer());
+        if (mode != GL_BACK && mode != GL_NONE) {
+            synthesizeGLError(GL_INVALID_OPERATION, "readBuffer", "invalid read buffer");
+            return;
+        }
+        // translate GL_BACK to GL_COLOR_ATTACHMENT0, because the default
+        // framebuffer for WebGL is not fb 0, it is an internal fbo.
+        if (mode == GL_BACK)
+            mode = GL_COLOR_ATTACHMENT0;
+    } else {
+        if (mode == GL_BACK) {
+            synthesizeGLError(GL_INVALID_OPERATION, "readBuffer", "invalid read buffer");
+            return;
+        }
+        m_readbufferOfFBO = mode;
+    }
     webContext()->readBuffer(mode);
 }
 
@@ -1777,7 +1808,16 @@ ScriptValue WebGL2RenderingContextBase::getParameter(ScriptState* scriptState, G
     case GL_RASTERIZER_DISCARD:
         return getBooleanParameter(scriptState, pname);
     case GL_READ_BUFFER:
-        return getUnsignedIntParameter(scriptState, pname);
+        {
+            GLint value = 0;
+            if (!isContextLost()) {
+                webContext()->getIntegerv(pname, &value);
+                // translate GL_COLOR_ATTACHMENT0 to GL_BACK for the default framebuffer
+                if (value == GL_COLOR_ATTACHMENT0 && !getFramebufferBinding(GL_READ_FRAMEBUFFER))
+                    value = GL_BACK;
+            }
+            return WebGLAny(scriptState, static_cast<unsigned>(value));
+        }
     case GL_READ_FRAMEBUFFER_BINDING:
         return WebGLAny(scriptState, PassRefPtrWillBeRawPtr<WebGLObject>(m_readFramebufferBinding.get()));
     case GL_SAMPLE_ALPHA_TO_COVERAGE: