Test Platform: Windows 10 with Intel HD4000 Step to Reproduce: Go to this website https://www.khronos.org/registry/webgl/sdk/tests/deqp/functional/gles3/texturespecification/texsubimage2d_pbo_params.html?webglVersion=2&quiet=0

Here is crash stack, the crash point seems to be in driver dll file. ig7icd32.dll!5866c4a0() Unknown [Frames below may be incorrect and/or missing, no symbols loaded for ig7icd32.dll] [External Code] xul.dll!mozilla::gl::GLContext::fTexSubImage2D(unsigned int target, int level, int xoffset, int yoffset, int width, int height, unsigned int format, unsigned int type, const void * pixels) Line 1645 C++ xul.dll!mozilla::DoTexSubImage(mozilla::gl::GLContext * gl, StrongGLenum<TexImageTargetDetails> target, int level, int xOffset, int yOffset, int zOffset, int width, int height, int depth, const mozilla::webgl::PackingInfo & pi, const void * data) Line 833 C++ xul.dll!mozilla::webgl::DoTexOrSubImage(bool isSubImage, mozilla::gl::GLContext * gl, StrongGLenum<TexImageTargetDetails> target, int level, const mozilla::webgl::DriverUnpackInfo * dui, int xOffset, int yOffset, int zOffset, int width, int height, int depth, const void * data) Line 402 C++ xul.dll!mozilla::webgl::TexUnpackBytes::TexOrSubImage(bool isSubImage, bool needsRespec, const char * funcName, mozilla::WebGLTexture * tex, StrongGLenum<TexImageTargetDetails> target, int level, const mozilla::webgl::DriverUnpackInfo * dui, int xOffset, int yOffset, int zOffset, unsigned int * const out_error) Line 478 C++ xul.dll!mozilla::WebGLTexture::TexSubImage(const char * funcName, StrongGLenum<TexImageTargetDetails> target, int level, int xOffset, int yOffset, int zOffset, const mozilla::webgl::PackingInfo & pi, const mozilla::webgl::TexUnpackBlob * blob) Line 1332 C++ xul.dll!mozilla::WebGLTexture::TexSubImage(const char * funcName, StrongGLenum<TexImageTargetDetails> target, int level, int xOffset, int yOffset, int zOffset, int width, int height, int depth, const mozilla::webgl::PackingInfo & pi, const mozilla::TexImageSource & src) Line 448 C++ xul.dll!mozilla::WebGLContext::TexSubImage(const char * funcName, unsigned char funcDims, unsigned int rawTarget, int level, int xOffset, int yOffset, int zOffset, int width, int height, int depth, unsigned int unpackFormat, unsigned int unpackType, const mozilla::TexImageSource & src) Line 415 C++ xul.dll!mozilla::WebGLContext::TexSubImage2D(unsigned int target, int level, int xOffset, int yOffset, int width, int height, unsigned int unpackFormat, unsigned int unpackType, const mozilla::TexImageSource & src) Line 1180 C++ xul.dll!mozilla::WebGLContext::TexSubImage2D<__int64>(unsigned int target, int level, int xOffset, int yOffset, int width, int height, unsigned int unpackFormat, unsigned int unpackType, const __int64 & anySrc, mozilla::ErrorResult & out_error) Line 1157 C++ xul.dll!mozilla::dom::WebGL2RenderingContextBinding::texSubImage2D(JSContext * cx, JS::Handle<JSObject *> obj, mozilla::WebGL2Context * self, const JSJitMethodCallArgs & args) Line 2032 C++ xul.dll!mozilla::dom::GenericBindingMethod(JSContext * cx, unsigned int argc, JS::Value * vp) Line 2886 C++ xul.dll!js::CallJSNative(JSContext * cx, bool(*)(JSContext *, unsigned int, JS::Value *) native, const JS::CallArgs & args) Line 239 C++ xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct) Line 457 C++ xul.dll!InternalCall(JSContext * cx, const js::AnyInvokeArgs & args) Line 502 C++ xul.dll!js::Call(JSContext * cx, JS::Handle<JS::Value> fval, JS::Handle<JS::Value> thisv, const js::AnyInvokeArgs & args, JS::MutableHandle<JS::Value> rval) Line 521 C++ xul.dll!js::fun_apply(JSContext * cx, unsigned int argc, JS::Value * vp) Line 1223 C++ xul.dll!js::CallJSNative(JSContext * cx, bool(*)(JSContext *, unsigned int, JS::Value *) native, const JS::CallArgs & args) Line 239 C++ xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct) Line 457 C++ xul.dll!InternalCall(JSContext * cx, const js::AnyInvokeArgs & args) Line 502 C++ xul.dll!js::CallFromStack(JSContext * cx, const JS::CallArgs & args) Line 508 C++ xul.dll!js::jit::DoCallFallback(JSContext * cx, js::jit::BaselineFrame * frame, js::jit::ICCall_Fallback * stub_, unsigned int argc, JS::Value * vp, JS::MutableHandle<JS::Value> res) Line 4733 C++ [External Code]

Latest Chromium is OK, maybe they have some workaround code to prevent the crash.

We're probably doing validation different than the driver. It's worth looking at what we're asking the driver to do here exactly. (unpack param state, buffer length, and texImage args)

Comment on attachment 8818765 [details] Bug 1323363 - Fix non-paranoid PBO uploads. - https://reviewboard.mozilla.org/r/98706/#review99226

Pushed by jgilbert@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/9555007ca062 Fix non-paranoid PBO uploads. - r=ethlin

Comment on attachment 8818765 [details] Bug 1323363 - Fix non-paranoid PBO uploads. - Approval Request Comment [Feature/Bug causing the regression]: webgl2 [User impact if declined]: [Is this code covered by automated tests?]: [Has the fix been verified in Nightly?]: [Needs manual test from QE? If yes, steps to reproduce]: [List of other uplifts needed for the feature/fix]: [Is the change risky?]: [Why is the change risky/not risky?]: [String changes made/needed]:

Comment on attachment 8818765 [details] Bug 1323363 - Fix non-paranoid PBO uploads. - Fix a WebGL 2 related issue. Beta51+ and Aurora52+. Should be in 51 beta 10.