Validate that transform feedback buffers are not mapped.

Mapping a buffer that is bound for active transform feedback or starting
transform feedback on a mapped buffer is undefined behaviour under
section 2.10.3.2 of the ES 3.0 spec "Effects of Mapping Buffers on Other
GL Commands".  The spec suggests that an error is generated in this
case.

TEST=ES3MapBufferRangeTest.TransformFeedback

BUG=754000

Change-Id: I613defd07cc1a4348682d992cda61cc898936720
Reviewed-on: https://chromium-review.googlesource.com/614483
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Geoff Lang <geofflang@chromium.org>
diff --git a/src/libANGLE/validationES3.cpp b/src/libANGLE/validationES3.cpp
index 3a97b17..e7c95ff 100644
--- a/src/libANGLE/validationES3.cpp
+++ b/src/libANGLE/validationES3.cpp
@@ -2089,6 +2089,17 @@
         context->handleError(InvalidOperation() << "Transform feedback is already active.");
         return false;
     }
+
+    for (size_t i = 0; i < transformFeedback->getIndexedBufferCount(); i++)
+    {
+        const auto &buffer = transformFeedback->getIndexedBuffer(i);
+        if (buffer.get() && buffer->isMapped())
+        {
+            context->handleError(InvalidOperation() << "Transform feedback has a mapped buffer.");
+            return false;
+        }
+    }
+
     return true;
 }