mesa: Don't call driver RenderTexture for invalid zoffset

This fixes the segfault in the 'invalid slice of 3D texture' and
'invalid layer of an array texture' subtests of piglit's fbo-incomplete
test.

The 'invalid layer of an array texture' subtest still fails.

v2: Fix off-by-one comparison error noticed by Chris Forbes.  Also,
1D_ARRAY textures have Depth == 1.  Instead, compare against Height.

Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Kenneth Graunke <kenneth@whitecape.org> [v1]
Cc: "9.1 9.2" mesa-stable@lists.freedesktop.org

src/mesa/main/fbobject.c

@@ -355,6 +355,12 @@ driver_RenderTexture_is_safe(const struct gl_renderbuffer_attachment *att)
    if (texImage->Width == 0 || texImage->Height == 0 || texImage->Depth == 0)
       return false;
 
+   if ((texImage->TexObject->Target == GL_TEXTURE_1D_ARRAY
+        && att->Zoffset >= texImage->Height)
+       || (texImage->TexObject->Target != GL_TEXTURE_1D_ARRAY
+           && att->Zoffset >= texImage->Depth))
+      return false;
+
    return true;
 }