Segfault in mpv's VO thread due to --opengl-pbo

mpv version and platform

mpv 0.27.0-235-g47b1390 on OSX 10.11 and yes, this is likely a OSX problem

Reproduction steps

Start a video with mpv --no-config --opengl-pbo=yes --fs and let it play without interaction roughly to the 2 min mark (a bit before that actually).
In case certain interactions were made (e.g. leave and re-enter fullscreen or small seeks) the crash occurs a bit later. Note that --fs is not needed from the start, it's enough to enter fullscreen before playback happens.

Expected behavior

No segfault

Actual behavior

Segfault

Log file

It segfaults roughly at 95 seconds and there's no log entry around that time.
Logfile: https://gist.github.com/Argon-/38d6c331576383ee97a291d9a5763fdc
OSX stack trace: https://gist.github.com/Argon-/786b82970e63307f55f3552430fa19c1

Sample files

So far, I've only seen one video file that leads to this crash (within the first 2 minutes). I tried to cut the first 2 min of the video but the sample doesn't exhibit this problem. I guess videos that trigger this are rare as nobody noticed this so far (or my system is botched).
The original file is around 25GB in size and basically impossible for me to upload.
I created the unaffected/useless sample using ffmpeg -i video.mkv -ss 0 -t 120 -c copy sample.mkv. Let me know in case someone has a better idea how to produce a sample.

I have bisected the problem and the first bad commit is https://github.com/mpv-player/mpv/commit/46d86da6300ebcd2134996c76b9238fcf8e0fb6e

Start by reviewing commit 46d86da6300ebcd2134996c76b9238fc... and the linked macOS stack trace, focusing on mpv's VO thread and --opengl-pbo path. Reproduce with mpv --no-config --opengl-pbo=yes --fs if a triggering video is available, then use the log and stack trace to narrow the crash. Done means playback no longer segfaults under the reported conditions.