Fix the crash of compressedTexImage3D for the WebGL2 conformance test page.

third_party/WebKit/Source/modules/webgl/WebGLTexture.cpp

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 155 matching lines @@
 {
     ASSERT(!m_immutable);
 
     if (!object() || !m_target)
         return;
     // We assume level, internalFormat, width, height, depth, and type have all been
     // validated already.
     int index = mapTargetToIndex(target);
     if (index < 0)
         return;
+
+    if (level < 0 || level >= static_cast<GLint>(m_info[index].size()))
+        return;

[qiankun, 2015/11/23 06:19:00]

See the above comments. level should be validated already when entering
setLevelInfo. I think you should do level validation in
WebGL2RenderingContextBase::compressedTexImage3D. 

+
     m_info[index][level].setInfo(internalFormat, width, height, depth, type);
     update();
 }
 
 void WebGLTexture::setTexStorageInfo(GLenum target, GLint levels, GLenum internalFormat, GLsizei width, GLsizei height, GLsizei depth)
 {
     ASSERT(!m_immutable);
 
     // We assume level, internalFormat, width, height, and depth have all been
     // validated already.
@@ skipping 408 matching lines @@
     case GL_COMPRESSED_RGBA_S3TC_DXT1_EXT:
     case GL_COMPRESSED_RGBA_S3TC_DXT3_EXT:
     case GL_COMPRESSED_RGBA_S3TC_DXT5_EXT:
         return GL_UNSIGNED_BYTE;
     default:
         return GL_NONE;
     }
 }
 
 } // namespace blink