1348382 - WebGL crash: [@mozilla::dom::WebGL2RenderingContextBinding::framebufferTextureLayer]

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: FramebufferTextureLayer.html

Assertion failure: IsValueLegal(mValue), at /srv/mozilla/mozilla-inbound/dom/canvas/WebGLStrongTypes.h:136
#01: mozilla::dom::WebGL2RenderingContextBinding::framebufferTextureLayer(JSContext*, JS::Handle<JSObject*>, mozilla::WebGL2Context*, JSJitMethodCallArgs const&)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x4dea963]
#02: mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x597461e]
#03: js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc38bc6e]
#04: js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc38b389]
#05: Interpret(JSContext*, js::RunState&)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc3688d3]
#06: js::RunScript(JSContext*, js::RunState&)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc354741]
#07: js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc38f882]
#08: js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc390618]
#09: Evaluate(JSContext*, js::ScopeKind, JS::Handle<JSObject*>, JS::ReadOnlyCompileOptions const&, JS::SourceBufferHolder&, JS::MutableHandle<JS::Value>)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xd078c7e]
#10: Evaluate(JSContext*, JS::AutoObjectVector&, JS::ReadOnlyCompileOptions const&, JS::SourceBufferHolder&, JS::MutableHandle<JS::Value>)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xd07a09d]
#11: nsJSUtils::EvaluateString(JSContext*, JS::SourceBufferHolder&, JS::Handle<JSObject*>, JS::CompileOptions&, nsJSUtils::EvaluateOptions const&, JS::MutableHandle<JS::Value>, void**)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x39ce802]
#12: nsJSUtils::EvaluateString(JSContext*, JS::SourceBufferHolder&, JS::Handle<JSObject*>, JS::CompileOptions&, void**)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x39d03d5]
#13: nsScriptLoader::EvaluateScript(nsScriptLoadRequest*)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3a76cb8]
#14: nsScriptLoader::ProcessRequest(nsScriptLoadRequest*)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3a72cb8]
#15: nsScriptLoader::ProcessScriptElement(nsIScriptElement*)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3a52764]
#16: nsScriptElement::MaybeProcessScript()[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3a4e2a7]
#17: nsHtml5TreeOpExecutor::RunScript(nsIContent*)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2787f51]
#18: nsHtml5TreeOpExecutor::RunFlushLoop()[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2785baa]
#19: nsHtml5ExecutorFlusher::Run()[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x278cfbf]
#20: nsThread::ProcessNextEvent(bool, bool*)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3133ab]
#21: NS_ProcessPendingEvents(nsIThread*, unsigned int)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x30b581]
#22: nsBaseAppShell::NativeEventCallback()[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7d9f3d0]
#23: nsAppShell::ProcessGeckoEvents(void*)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7eb0556]
#24: __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0xa7981]
#25: __CFRunLoopDoSources0[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x889f7]
#26: __CFRunLoopRun[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x87f76]
#27: CFRunLoopRunSpecific[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x87974]
#28: RunCurrentEventLoopInMode[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x30a5c]
#29: ReceiveNextEventCommon[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x30891]
#30: _BlockUntilNextEventMatchingListInModeWithFilter[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x306c6]
#31: _DPSNextEvent[/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x475b4]
#32: -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x7c1d6b]
#33: -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:][/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7eaea6d]
#34: -[NSApplication run][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x3bf35]
#35: nsAppShell::Run()[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7eb15e7]
#36: nsAppStartup::Run()[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xbaedc8e]
#37: XREMain::XRE_mainRun()[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xbd0d796]
#38: XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xbd1076b]
#39: XRE_main(int, char**, mozilla::BootstrapConfig const&)[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xbd11dde]
#40: main[/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/firefox +0x20e0]
ASAN:DEADLYSIGNAL
=================================================================
==61141==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0001230c2443 bp 0x7fff4fecf8d0 sp 0x7fff4fecf870 T0)
#0 0x1230c2442 in mozilla::WebGLFramebuffer::FramebufferTextureLayer(char const*, unsigned int, mozilla::WebGLTexture*, int, int) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x5c0f442)
#1 0x12229d962 in mozilla::dom::WebGL2RenderingContextBinding::framebufferTextureLayer(JSContext*, JS::Handle<JSObject*>, mozilla::WebGL2Context*, JSJitMethodCallArgs const&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x4dea962)
#2 0x122e2761d in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x597461d)
#3 0x12983ec6d in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc38bc6d)
#4 0x12983e388 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc38b388)
#5 0x12981b8d2 in Interpret(JSContext*, js::RunState&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc3688d2)
#6 0x129807740 in js::RunScript(JSContext*, js::RunState&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc354740)
#7 0x129842881 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc38f881)
#8 0x129843617 in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xc390617)
#9 0x12a52bc7d in Evaluate(JSContext*, js::ScopeKind, JS::Handle<JSObject*>, JS::ReadOnlyCompileOptions const&, JS::SourceBufferHolder&, JS::MutableHandle<JS::Value>) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xd078c7d)
#10 0x12a52d09c in Evaluate(JSContext*, JS::AutoObjectVector&, JS::ReadOnlyCompileOptions const&, JS::SourceBufferHolder&, JS::MutableHandle<JS::Value>) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xd07a09c)
#11 0x120e81801 in nsJSUtils::EvaluateString(JSContext*, JS::SourceBufferHolder&, JS::Handle<JSObject*>, JS::CompileOptions&, nsJSUtils::EvaluateOptions const&, JS::MutableHandle<JS::Value>, void**) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x39ce801)
#12 0x120e833d4 in nsJSUtils::EvaluateString(JSContext*, JS::SourceBufferHolder&, JS::Handle<JSObject*>, JS::CompileOptions&, void**) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x39d03d4)
#13 0x120f29cb7 in nsScriptLoader::EvaluateScript(nsScriptLoadRequest*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x3a76cb7)
#14 0x120f25cb7 in nsScriptLoader::ProcessRequest(nsScriptLoadRequest*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x3a72cb7)
#15 0x120f05763 in nsScriptLoader::ProcessScriptElement(nsIScriptElement*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x3a52763)
#16 0x120f012a6 in nsScriptElement::MaybeProcessScript() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x3a4e2a6)
#17 0x11fc3af50 in nsHtml5TreeOpExecutor::RunScript(nsIContent*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x2787f50)
#18 0x11fc38ba9 in nsHtml5TreeOpExecutor::RunFlushLoop() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x2785ba9)
#19 0x11fc3ffbe in nsHtml5ExecutorFlusher::Run() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x278cfbe)
#20 0x11d7c63aa in nsThread::ProcessNextEvent(bool, bool*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x3133aa)
#21 0x11d7be580 in NS_ProcessPendingEvents(nsIThread*, unsigned int) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x30b580)
#22 0x1252523cf in nsBaseAppShell::NativeEventCallback() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x7d9f3cf)
#23 0x125363555 in nsAppShell::ProcessGeckoEvents(void*) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x7eb0555)
#24 0x7fff9571a980 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xa7980)
#25 0x7fff956fb9f6 in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x889f6)
#26 0x7fff956faf75 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87f75)
#27 0x7fff956fa973 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87973)
#28 0x7fff94c86a5b in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30a5b)
#29 0x7fff94c86890 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30890)
#30 0x7fff94c866c5 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x306c5)
#31 0x7fff9322c5b3 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x475b3)
#32 0x7fff939a6d6a in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x7c1d6a)
#33 0x125361a6c in -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x7eaea6c)
#34 0x7fff93220f34 in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x3bf34)
#35 0x1253645e6 in nsAppShell::Run() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x7eb15e6)
#36 0x128fa0c8d in nsAppStartup::Run() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xbaedc8d)
#37 0x1291c0795 in XREMain::XRE_mainRun() (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xbd0d795)
#38 0x1291c376a in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xbd1076a)
#39 0x1291c4ddd in XRE_main(int, char**, mozilla::BootstrapConfig const&) (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0xbd11ddd)
#40 0x10fd290df in main (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/firefox+0x1000020df)
#41 0x10fd28993 in start (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/firefox+0x100001993)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/XUL+0x5c0f442) in mozilla::WebGLFramebuffer::FramebufferTextureLayer(char const*, unsigned int, mozilla::WebGLTexture*, int, int)

Command: /srv/mozilla/mozilla-inbound/ff-asan-debug/dist/NightlyDebug.app/Contents/MacOS/firefox -width 512 -height 512 /Users/posidron/Desktop/testcase.html

Comment 1

[Peter Chang[:pchang]]

Daosheng, please help on this bug.

Comment 2

[Daosheng Mu[:daoshengmu]]

The reason of this crash is 'TEXTURE_CUBE_MAP` not one of TexImageTarget.

Comment 3

[Daosheng Mu[:daoshengmu]]

Attachment: Bug 1348382 - Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer;

Review commit: https://reviewboard.mozilla.org/r/122204/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/122204/

Comment 4

[Daosheng Mu[:daoshengmu]]

Comment on attachment 8849438 [details]
Bug 1348382 - Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/122204/diff/1-2/

Comment 5

[Ethan Lin[:ethlin]]

Comment on attachment 8849438 [details]
Bug 1348382 - Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer;

https://reviewboard.mozilla.org/r/122204/#review124312

Comment 6

[Kelsey Gilbert [:jgilbert]]

This is DEBUG-only, thus not critical.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/397a59f9c50d
Check texture image target format is valid at FramebufferTextureLayer validation; r=ethlin

Comment 8

[Kelsey Gilbert [:jgilbert]]

Comment on attachment 8849438 [details]
Bug 1348382 - Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer;

https://reviewboard.mozilla.org/r/122204/#review124742

This isn't the correct fix.

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Backed out in https://hg.mozilla.org/integration/autoland/rev/38ddb566186ab4314327c5d407d7d5235690bff4 for the r-

Comment 10

[Kelsey Gilbert [:jgilbert]]

This fix treats the symptom, but not the root cause of the bug.

It looks like the issue is that the texture has a non-TexImageTarget, which is normal. (TEXTURE_CUBE_MAP) This is not an error the way the patch purports to fix it.

It looks like our behavior might not handle CUBE_MAPs for this function properly.

Comment 11

[Kelsey Gilbert [:jgilbert]]

For clarity, either the reviewer or the author of a change must be an owner or peer of the module the change is for. I was expecting to see an r?me after the initial review, so sorry for the last-minute r- and backout.

Comment 12

[Daosheng Mu[:daoshengmu]]

Thanks for the remainder. I will send the r? again.


According to https://www.khronos.org/registry/OpenGL-Refpages/es3.0/html/glFramebufferTextureLayer.xhtml, it mentions glFramebufferTextureLayer operates like glFramebufferTexture2D, except that only a single layer of the texture level, given by layer, is attached to the attachment point... .

Therefore, I think we can follow the same way to check CUBE_MAPs that we have already done for WebGLFramebuffer::FramebufferTexture2D();

Comment 13

[Daosheng Mu[:daoshengmu]]

Comment on attachment 8849438 [details]
Bug 1348382 - Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/122204/diff/2-3/

Comment 14

[Kelsey Gilbert [:jgilbert]]

Comment on attachment 8849438 [details]
Bug 1348382 - Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer;

https://reviewboard.mozilla.org/r/122204/#review125176

::: dom/canvas/WebGLFramebuffer.cpp:1496
(Diff revision 3)
>  
>      if (level < 0)
>          return mContext->ErrorInvalidValue("%s: `level` must be >= 0.", funcName);
>  
> +    // `texImageTarget`
> +    GLenum texImageTarget = tex->Target().get();

`tex` might be null.

::: dom/canvas/WebGLFramebuffer.cpp:1497
(Diff revision 3)
> +    if (texImageTarget != LOCAL_GL_TEXTURE_2D &&
> +        (texImageTarget < LOCAL_GL_TEXTURE_CUBE_MAP_POSITIVE_X ||
> +         texImageTarget > LOCAL_GL_TEXTURE_CUBE_MAP_NEGATIVE_Z))

Non-null textures passed to this function must be of type 3D or 2D_ARRAY. (see switch below)

Comment 15

[Daosheng Mu[:daoshengmu]]

Comment on attachment 8849438 [details]
Bug 1348382 - Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/122204/diff/3-4/

Comment 16

[Daosheng Mu[:daoshengmu]]

glFramebufferTextureLayer only support 3D texture and 2D array texture...

"If texture is a 3D texture, then level must be greater than or equal to zero and less than or equal to log2 of the value of GL_MAX_3D_TEXTURE_SIZE. If texture is a 2D array texture, level must be greater than or equal to zero and no larger than log2 of the value of GL_MAX_TEXTURE_SIZE."

https://www.khronos.org/registry/OpenGL-Refpages/es3.0/html/glFramebufferTextureLayer.xhtml

Comment 17

[Kelsey Gilbert [:jgilbert]]

Comment on attachment 8849438 [details]
Bug 1348382 - Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer;

https://reviewboard.mozilla.org/r/122204/#review125496

::: dom/canvas/WebGLFramebuffer.cpp:1509
(Diff revision 4)
> -        switch (texImageTarget.get()) {
> +        if (texImageTarget != LOCAL_GL_TEXTURE_3D &&
> +            texImageTarget != LOCAL_GL_TEXTURE_2D_ARRAY)
> +        {
> +            mContext->ErrorInvalidOperation("%s: `texture` must be a TEXTURE_3D or"
> +                                            " TEXTURE_2D_ARRAY.",
> +                                            funcName);
> +            return;
> +        }

This is already validated at [1].

::: dom/canvas/WebGLFramebuffer.cpp:1547
(Diff revision 4)
>          default:
>              mContext->ErrorInvalidOperation("%s: `texture` must be a TEXTURE_3D or"
>                                              " TEXTURE_2D_ARRAY.",
>                                              funcName);
>              return;

[1]

Comment 18

[Daosheng Mu[:daoshengmu]]

Comment on attachment 8849438 [details]
Bug 1348382 - Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/122204/diff/4-5/

Comment 19

[Kelsey Gilbert [:jgilbert]]

Comment on attachment 8849438 [details]
Bug 1348382 - Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer;

https://reviewboard.mozilla.org/r/122204/#review127030

::: dom/canvas/WebGLFramebuffer.cpp:1507
(Diff revision 5)
>              mContext->ErrorInvalidOperation("%s: `texture` has never been bound.",
>                                              funcName);
>              return;
>          }
>  
> +        // `texImageTarget`

Drop this comment. The comments are to show where validation for various arguments takes place. There isn't a texImageTarget argument.

Comment 20

[Daosheng Mu[:daoshengmu]]

Comment on attachment 8849438 [details]
Bug 1348382 - Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/122204/diff/5-6/

Comment 21

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1045911050af
Only allow 3D or 2D_ARRAY texture at FramebufferTextureLayer; r=ethlin,jgilbert

Comment 22

[(PTO June 19-July 7) Ryan VanderMeulen]

https://hg.mozilla.org/mozilla-central/rev/1045911050af

Comment 23

[(PTO June 19-July 7) Ryan VanderMeulen]

wontfix on backporting given comment 6