Bug 635666 - part 2/3 - WebGL crash [@mozilla::WebGLContext::CopyTexSubImage2D] - r=jrmuizel, a=joe

content/canvas/src/WebGLContext.h

@@ -882,6 +882,10 @@ public:
         return const_cast<WebGLTexture*>(this)->ImageInfoAt(level, face);
     }
 
+    static size_t FaceForTarget(WebGLenum target) {
+        return target == LOCAL_GL_TEXTURE_2D ? 0 : target - LOCAL_GL_TEXTURE_CUBE_MAP_POSITIVE_X;
+    }
+
 protected:
 
     WebGLenum mTarget;
@@ -972,14 +976,12 @@ public:
 
     void SetImageInfo(WebGLenum aTarget, WebGLint aLevel,
                       WebGLsizei aWidth, WebGLsizei aHeight,
-                      WebGLenum aFormat = 0, WebGLenum aType = 0) {
-        size_t face = 0;
-        if (aTarget == LOCAL_GL_TEXTURE_2D) {
-            if (mTarget != LOCAL_GL_TEXTURE_2D) return;
-        } else {
-            if (mTarget == LOCAL_GL_TEXTURE_2D) return;
-            face = aTarget - LOCAL_GL_TEXTURE_CUBE_MAP_POSITIVE_X;
-        }
+                      WebGLenum aFormat = 0, WebGLenum aType = 0)
+    {
+        if ( (aTarget == LOCAL_GL_TEXTURE_2D) != (mTarget == LOCAL_GL_TEXTURE_2D) )
+            return;
+
+        size_t face = FaceForTarget(aTarget);
 
         EnsureMaxLevelWithCustomImagesAtLeast(aLevel);
 

content/canvas/src/WebGLContextGL.cpp

@@ -808,8 +808,9 @@ WebGLContext::CopyTexSubImage2D(WebGLenum target,
     if (!tex)
         return ErrorInvalidOperation("copyTexSubImage2D: no texture bound to this target");
 
-    WebGLsizei texWidth = tex->ImageInfoAt(level,0).mWidth;
-    WebGLsizei texHeight = tex->ImageInfoAt(level,0).mHeight;
+    WebGLint face = WebGLTexture::FaceForTarget(target);
+    WebGLsizei texWidth = tex->ImageInfoAt(level, face).mWidth;
+    WebGLsizei texHeight = tex->ImageInfoAt(level, face).mHeight;
 
     if (xoffset + width > texWidth || xoffset + width < 0)
       return ErrorInvalidValue("copyTexSubImage2D: xoffset+width is too large");
@@ -817,7 +818,7 @@ WebGLContext::CopyTexSubImage2D(WebGLenum target,
     if (yoffset + height > texHeight || yoffset + height < 0)
       return ErrorInvalidValue("copyTexSubImage2D: yoffset+height is too large");
 
-    WebGLenum format = tex->ImageInfoAt(level,0).mFormat;
+    WebGLenum format = tex->ImageInfoAt(level, face).mFormat;
     PRBool texFormatRequiresAlpha = format == LOCAL_GL_RGBA ||
                                     format == LOCAL_GL_ALPHA ||
                                     format == LOCAL_GL_LUMINANCE_ALPHA;