Fix semantics of uploading HTML sources to 3D textures.

third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1049 matching lines @@
         subRect.height() < 0) {
       synthesizeGLError(GL_INVALID_OPERATION, functionName,
                         "source sub-rectangle specified via pixel unpack "
                         "parameters is invalid");
       return false;
     }
 
     if (functionID == TexImage3D || functionID == TexSubImage3D) {
       DCHECK_GE(unpackImageHeight, 0);
 
-      // Verify that the image data can cover the required depth.
-      WTF::CheckedNumeric<GLint> maxDepthSupported = 1;
-      if (unpackImageHeight) {
-        maxDepthSupported = subRect.height();
-        maxDepthSupported /= unpackImageHeight;
+      if (depth < 1) {
+        synthesizeGLError(GL_INVALID_OPERATION, functionName,
+                          "Can't define a 3D texture with depth < 1");
+        return false;
       }
 
-      if (!maxDepthSupported.IsValid() ||
-          maxDepthSupported.ValueOrDie() < depth) {
+      // According to the WebGL 2.0 spec, specifying depth > 1 means
+      // to select multiple rectangles stacked vertically.
+      WTF::CheckedNumeric<GLint> maxYAccessed;
+      if (unpackImageHeight) {
+        maxYAccessed = unpackImageHeight;
+      } else {
+        maxYAccessed = subRect.height();
+      }
+      maxYAccessed *= depth - 1;
+      maxYAccessed += subRect.height();
+      maxYAccessed += subRect.y();
+
+      if (!maxYAccessed.IsValid()) {
+        synthesizeGLError(GL_INVALID_OPERATION, functionName,
+                          "Out-of-range parameters passed for 3D texture "
+                          "upload");
+        return false;
+      }
+
+      if (maxYAccessed.ValueOrDie() > imageHeight) {
         synthesizeGLError(GL_INVALID_OPERATION, functionName,
                           "Not enough data supplied to upload to a 3D texture "
                           "with depth > 1");
         return false;
       }
     } else {
       DCHECK_EQ(depth, 1);
       DCHECK_EQ(unpackImageHeight, 0);
     }
     return true;
@@ skipping 562 matching lines @@
                   context,
                   context->is3d(),
                   context.is3d());
 
 }  // namespace blink
 
 WTF_ALLOW_MOVE_INIT_AND_COMPARE_WITH_MEM_FUNCTIONS(
     blink::WebGLRenderingContextBase::TextureUnitState);
 
 #endif  // WebGLRenderingContextBase_h