webgl: Protect against GL error on glBindRenderbuffer(deleted rbo).

On a GLES or compatibility underlying GL context, we were fine because
an underlying renderbuffer object would just get re-created, and
nothing too bad happened because we aren't tracking the currently
bound renderbuffer at the DOM level.  However, on a desktop GL core
context, binding non-genned or deleted names is an error.

Fixes a crash in object-deletion-behavior.html.

1 files changed, 13 insertions, 7 deletions

diff --git a/components/script/dom/webglrenderingcontext.rs b/components/script/dom/webglrenderingcontext.rs
index 059c6941bc1..cd336e02e50 100644
--- a/components/script/dom/webglrenderingcontext.rs
+++ b/components/script/dom/webglrenderingcontext.rs
@@ -705,13 +705,19 @@ impl WebGLRenderingContextMethods for WebGLRenderingContext {
             return self.webgl_error(InvalidEnum);
         }
 
-        if let Some(renderbuffer) = renderbuffer {
-            renderbuffer.bind(target)
-        } else {
-            // Unbind the currently bound renderbuffer
-            self.ipc_renderer
-                .send(CanvasMsg::WebGL(WebGLCommand::BindRenderbuffer(target, None)))
-                .unwrap()
+        match renderbuffer {
+            // Implementations differ on what to do in the deleted
+            // case: Chromium currently unbinds, and Gecko silently
+            // returns.  The conformance tests don't cover this case.
+            Some(renderbuffer) if !renderbuffer.is_deleted() => {
+                renderbuffer.bind(target)
+            }
+            _ => {
+                // Unbind the currently bound renderbuffer
+                self.ipc_renderer
+                    .send(CanvasMsg::WebGL(WebGLCommand::BindRenderbuffer(target, None)))
+                    .unwrap()
+            }
         }
     }