We don't have a GPU-based implementation of GenerateMipmaps for 3D textures, so we're falling back to the CPU-based one here.

I'm not yet sure why MapTextureImage is getting a NULL mt.  Looking into it...

Oh, it isn't 3D that's the problem.

It seems to be calling glGenerateMipmaps on a 2D RGBA32F texture with width/height = 0.

A basic bisect says this happened at:

commit b3c5df3ca4ca69006114565bf5d6d01c7b8b2934
Author: Kenneth Graunke <kenneth@whitecape.org>
Date:   Thu Jul 7 11:50:44 2016 -0700

    mesa: Mark R*32F formats as filterable when an extension is present.

But there's got to be some other commit that caused 0-width/height textures to behave differently.

Hi, Kenneth, 
We reproduce this issue in below scene, crash happens in the second generateMipmap.
  tex = gl.createTexture();
  gl.bindTexture(gl.TEXTURE_2D, tex);
    gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA8, 8, 8, 0, gl.RGBA, gl.UNSIGNED_BYTE, new Uint8Array(8 * 8 * 4));
  gl.generateMipmap(gl.TEXTURE_2D);
  wtu.glErrorShouldBe(gl, gl.NO_ERROR, "generateMipmap should succeed");
  if (gl.getExtension('EXT_color_buffer_float') && gl.getExtension('OES_texture_float_linear')) {
    gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA32F, 0, 0, 0, gl.RGBA, gl.FLOAT, null);
    gl.generateMipmap(gl.TEXTURE_2D);
    wtu.glErrorShouldBe(gl, gl.NO_ERROR, "generateMipmap should succeed for zero-size texture");
  }

Well, I'm not sure how it ever worked before, but it's easy enough to fix.  Patch on the mailing list:

http://mid.gmane.org/20160722180411.25464-1-kenneth@whitecape.org

Fixed on Mesa master by:

commit f80bea2d8066d228e78a1744d036f69a0265116e
Author: Kenneth Graunke <kenneth@whitecape.org>
Date:   Thu Jul 21 22:13:38 2016 -0700

    mesa: Don't call GenerateMipmap if Width or Height == 0.
    
    One of the WebGL 2.0 conformance tests is trying to call
    glGenerateMipmaps with a width and height of 0.  With the meta
    implementation, this generates a "framebuffer attachment incomplete"
    status, and falls back to the CPU path, calling MapTextureImage.
    
    Except that there's no actual texture to map, and we assert fail.
    
    There's no work to do in this case.  The test expects it to succeed,
    so just return early with no error and avoid hassling the driver.
    
    Cc: mesa-stable@lists.freedesktop.org
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96911
    Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
    Reviewed-by: Anuj Phogat <anuj.phogat@gmail.com>

Thank you very much for the fix, and I verified it works well. 
Currently we're using the latest stable release 12.0 to test WebGL 2.0. Is it possible to cherry pick this patch to 12.0 branch? As this is a crash case, and it will break all the rest tests, so it's critical. And it's the only crash case AFAIK, so I don't foresee other request like this.

Sorry, just hold the cherry pick a bit while, and let me sync with Google to see if they may apply patches locally.

I've marked it for stable, so Emil (as the release maintainer) should pick it up for the next 12.0.x release.

Thanks a lot!