st/mesa: fix glCopyTexSubImage crash

Fixes a WebGL crash.  The dest texture image is at level 2 and is of
size 1x1 texel.  The st texture image is a stand-alone resource, not
a pointer into a complete mipmap.  So the resource has one level and
trying to write to level 2 blows up.

Fixes http://bugs.freedesktop.org/show_bug.cgi?id=53314
and http://bugs.freedesktop.org/show_bug.cgi?id=53319

Note: This is a candidate for the 8.0 branch.

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>

diff --git a/src/mesa/state_tracker/st_cb_texture.c b/src/mesa/state_tracker/st_cb_texture.c
index a7f57b96f2713f121b8ae7ef8eb02bcea8eb877c..92ce3fa2073e63d355b716961a0b17d381a1659d 100644 (file)
--- a/src/mesa/state_tracker/st_cb_texture.c
+++ b/src/mesa/state_tracker/st_cb_texture.c
@@ -1004,14 +1004,22 @@ st_CopyTexSubImage(struct gl_context *ctx, GLuint dims,
        !do_flip) {
       /* use surface_copy() / blit */
       struct pipe_box src_box;
+      unsigned dstLevel;
+
       u_box_2d_zslice(srcX, srcY, strb->surface->u.tex.first_layer,
                       width, height, &src_box);
 
+      /* If stImage->pt is an independent image (not a pointer into a full
+       * mipmap) stImage->pt.last_level will be zero and we need to use that
+       * as the dest level.
+       */
+      dstLevel = MIN2(stImage->base.Level, stImage->pt->last_level);
+
       /* for resource_copy_region(), y=0=top, always */
       pipe->resource_copy_region(pipe,
                                  /* dest */
                                  stImage->pt,
-                                 stImage->base.Level,
+                                 dstLevel,
                                  destX, destY, destZ + stImage->base.Face,
                                  /* src */
                                  strb->texture,