Bug 785734 - reject certain rare, but legal, texImage2D calls to work around a driver bug - r=jgilbert

content/canvas/src/WebGLContextGL.cpp

@@ -672,6 +672,29 @@ WebGLContext::CopyTexSubImage2D_base(WebGLenum target,
 
     MakeContextCurrent();
 
+    WebGLTexture *tex = activeBoundTextureForTarget(target);
+
+    if (!tex)
+        return ErrorInvalidOperation("%s: no texture is bound to this target");
+
+#ifdef MOZ_X11
+    // bug 785734
+    if (gl->WorkAroundDriverBugs() &&
+        mIsMesa &&
+        level > 0 &&
+        !sub)
+    {
+        size_t face = WebGLTexture::FaceForTarget(target);
+        if (!tex->HasImageInfoAt(0, face) ||
+            tex->ImageInfoAt(0, face).Width() <= width)
+        {
+            return  ErrorInvalidOperation("%s: rejecting valid call to avoid Mesa driver crash. "
+                                          "See Mozilla bug 785734",
+                                          info);
+        }
+    }
+#endif
+
     if (CanvasUtils::CheckSaneSubrectSize(x, y, width, height, framebufferWidth, framebufferHeight)) {
         if (sub)
             gl->fCopyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
@@ -4666,7 +4689,6 @@ WebGLContext::TexImage2D_base(WebGLenum target, WebGLint level, WebGLenum intern
     if (border != 0)
         return ErrorInvalidValue("texImage2D: border must be 0");
 
-
     if (format == LOCAL_GL_DEPTH_COMPONENT || format == LOCAL_GL_DEPTH_STENCIL) {
         if (IsExtensionEnabled(WEBGL_depth_texture)) {
             if (target != LOCAL_GL_TEXTURE_2D || data != NULL || level != 0)
@@ -4717,6 +4739,22 @@ WebGLContext::TexImage2D_base(WebGLenum target, WebGLint level, WebGLenum intern
     // format == internalformat, as checked above and as required by ES.
     internalformat = InternalFormatForFormatAndType(format, type, gl->IsGLES2());
 
+#ifdef MOZ_X11
+    // bug 785734
+    if (gl->WorkAroundDriverBugs() &&
+        mIsMesa &&
+        level > 0)
+    {
+        size_t face = WebGLTexture::FaceForTarget(target);
+        if (!tex->HasImageInfoAt(0, face) ||
+            tex->ImageInfoAt(0, face).Width() <= width)
+        {
+            return  ErrorInvalidOperation("texImage2D: rejecting valid call to avoid Mesa driver crash. "
+                                          "See Mozilla bug 785734");
+        }
+    }
+#endif
+
     GLenum error = LOCAL_GL_NO_ERROR;
 
     if (byteLength) {