Fix crash from state management cleanup

third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/webgl/WebGL2RenderingContextBase.h"
 
 #include "bindings/modules/v8/WebGLAny.h"
 #include "core/frame/ImageBitmap.h"
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/HTMLImageElement.h"
@@ skipping 3520 matching lines @@
       m_readFramebufferBinding = nullptr;
     } else {
       target = GL_DRAW_FRAMEBUFFER;
       m_framebufferBinding = nullptr;
     }
   } else if (framebuffer == m_readFramebufferBinding) {
     target = GL_READ_FRAMEBUFFER;
     m_readFramebufferBinding = nullptr;
   }
   if (target) {
-    drawingBuffer()->setFramebufferBinding(target, 0);
     // Have to call drawingBuffer()->bind() here to bind back to internal fbo.
     drawingBuffer()->bind(target);
   }
 }
 
 ScriptValue WebGL2RenderingContextBase::getParameter(ScriptState* scriptState,
                                                      GLenum pname) {
   if (isContextLost())
     return ScriptValue::createNull(scriptState);
   switch (pname) {
@@ skipping 952 matching lines @@
   params.rowLength = m_unpackRowLength;
   params.skipPixels = m_unpackSkipPixels;
   params.skipRows = m_unpackSkipRows;
   if (dimension == Tex3D) {
     params.imageHeight = m_unpackImageHeight;
     params.skipImages = m_unpackSkipImages;
   }
   return params;
 }
 
+void WebGL2RenderingContextBase::
+    DrawingBufferClientRestorePixelUnpackBufferBinding() {
+  if (!contextGL())
+    return;
+  contextGL()->BindBuffer(GL_PIXEL_UNPACK_BUFFER,
+                          objectOrZero(m_boundPixelUnpackBuffer.get()));
+}
+
 }  // namespace blink