Add validation to the mailbox functions in the passthrough cmd decoder.

gpu/command_buffer/service/texture_manager.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef GPU_COMMAND_BUFFER_SERVICE_TEXTURE_MANAGER_H_
 #define GPU_COMMAND_BUFFER_SERVICE_TEXTURE_MANAGER_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 33 matching lines @@
 class TextureRef;
 
 class GPU_EXPORT TextureBase {
  public:
   explicit TextureBase(GLuint service_id);
   virtual ~TextureBase();
 
   // The service side OpenGL id of the texture.
   GLuint service_id() const { return service_id_; }
 
+  // Returns the target this texure was first bound to or 0 if it has not
+  // been bound. Once a texture is bound to a specific target it can never be
+  // bound to a different target.
+  GLenum target() const { return target_; }
+
  protected:
   // The id of the texture.
   GLuint service_id_;
 
+  // The target. 0 if unset, otherwise GL_TEXTURE_2D or GL_TEXTURE_CUBE_MAP.
+  //             Or GL_TEXTURE_2D_ARRAY or GL_TEXTURE_3D (for GLES3).
+  GLenum target_;
+
+  void SetTarget(GLenum target);
+
   void DeleteFromMailboxManager();
 
  private:
   friend class MailboxManagerSync;
   friend class MailboxManagerImpl;
 
   void SetMailboxManager(MailboxManager* mailbox_manager);
 
   MailboxManager* mailbox_manager_;
 };
 
 // A ref-counted version of the TextureBase class that deletes the texture after
 // all references have been released.
 class TexturePassthrough final : public TextureBase,
                                  public base::RefCounted<TexturePassthrough> {
  public:
-  explicit TexturePassthrough(GLuint service_id);
+  TexturePassthrough(GLuint service_id, GLenum target);
 
   // Notify the texture that the context is lost and it shouldn't delete the
   // native GL texture in the destructor
   void MarkContextLost();
 
  protected:
   ~TexturePassthrough() override;
 
  private:
   friend class base::RefCounted<TexturePassthrough>;
@@ skipping 103 matching lines @@
 
   bool CanRenderTo(const FeatureInfo* feature_info, GLint level) const;
 
   void SetServiceId(GLuint service_id) {
     DCHECK(service_id);
     DCHECK_EQ(owned_service_id_, service_id_);
     service_id_ = service_id;
     owned_service_id_ = service_id;
   }
 
-  // Returns the target this texure was first bound to or 0 if it has not
-  // been bound. Once a texture is bound to a specific target it can never be
-  // bound to a different target.
-  GLenum target() const {
-    return target_;
-  }
-
   bool SafeToRenderFrom() const {
     return cleared_;
   }
 
   // Get the width/height/depth for a particular level. Returns false if level
   // does not exist.
   // |depth| is optional and can be nullptr.
   bool GetLevelSize(
       GLint target, GLint level,
       GLsizei* width, GLsizei* height, GLsizei* depth) const;
@@ skipping 371 matching lines @@
   // stored in |service_id_| and overrides the owned service id for all purposes
   // except deleting the texture name.
   GLuint owned_service_id_;
 
   // Whether all renderable mips of this texture have been cleared.
   bool cleared_;
 
   int num_uncleared_mips_;
   int num_npot_faces_;
 
-  // The target. 0 if unset, otherwise GL_TEXTURE_2D or GL_TEXTURE_CUBE_MAP.
-  //             Or GL_TEXTURE_2D_ARRAY or GL_TEXTURE_3D (for GLES3).
-  GLenum target_;
-
   // Texture parameters.
   SamplerState sampler_state_;
   GLenum usage_;
   GLint base_level_;
   GLint max_level_;
   GLenum swizzle_r_;
   GLenum swizzle_g_;
   GLenum swizzle_b_;
   GLenum swizzle_a_;
 
@@ skipping 655 matching lines @@
  private:
   DecoderTextureState* texture_state_;
   base::TimeTicks begin_time_;
   DISALLOW_COPY_AND_ASSIGN(ScopedTextureUploadTimer);
 };
 
 }  // namespace gles2
 }  // namespace gpu
 
 #endif  // GPU_COMMAND_BUFFER_SERVICE_TEXTURE_MANAGER_H_