--- a/dom/canvas/WebGLBuffer.cpp
+++ b/dom/canvas/WebGLBuffer.cpp
@@ -153,16 +153,35 @@ WebGLBuffer::BufferData(GLenum target, s
 
     // Warning: Possibly shared memory.  See bug 1225033.
     if (!ElementArrayCacheBufferData(data, size)) {
         mByteLength = 0;
         mContext->ErrorOutOfMemory("%s: Failed update index buffer cache.", funcName);
     }
 }
 
+bool
+WebGLBuffer::ValidateRange(const char* funcName, size_t byteOffset, size_t byteLen) const
+{
+    auto availLength = mByteLength;
+    if (byteOffset > availLength) {
+        mContext->ErrorInvalidValue("%s: Offset passes the end of the buffer.", funcName);
+        return false;
+    }
+    availLength -= byteOffset;
+
+    if (byteLen > availLength) {
+        mContext->ErrorInvalidValue("%s: Offset+size passes the end of the buffer.",
+                                    funcName);
+        return false;
+    }
+
+    return true;
+}
+
 ////////////////////////////////////////
 
 bool
 WebGLBuffer::ElementArrayCacheBufferData(const void* ptr,
                                          size_t bufferSizeInBytes)
 {
     if (mContent == Kind::ElementArray)
         return mCache->BufferData(ptr, bufferSizeInBytes);

--- a/dom/canvas/WebGLBuffer.h
+++ b/dom/canvas/WebGLBuffer.h
@@ -49,16 +49,17 @@ public:
     size_t ByteLength() const { return mByteLength; }
 
     bool ElementArrayCacheBufferData(const void* ptr, size_t bufferSizeInBytes);
 
     void ElementArrayCacheBufferSubData(size_t pos, const void* ptr,
                                         size_t updateSizeInBytes);
 
     bool Validate(GLenum type, uint32_t max_allowed, size_t first, size_t count) const;
+    bool ValidateRange(const char* funcName, size_t byteOffset, size_t byteLen) const;
 
     bool IsElementArrayUsedWithMultipleTypes() const;
 
     WebGLContext* GetParentObject() const {
         return mContext;
     }
 
     virtual JSObject* WrapObject(JSContext* cx, JS::Handle<JSObject*> givenProto) override;