This little bit of code:
function crash() {
buf = gl.createBuffer();
gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, buf);
gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, 16, gl.DYNAMIC_DRAW);
gl.bufferSubData(gl.ELEMENT_ARRAY_BUFFER,
-20, new Uint16Array([1,2,3,4]));
}
seem to crash chrome tab in about 1 out of 3 tries on average.
After a few such crashes webgl stops working altogether but restarting the chrome from scratch starts a clean slate.
using chrome 9.0.597.83 on Windows Vista 32bit with an nVidia card
filed a bug here
Haven't checked firefox yet since for some reason WebGL doesn't work for me there as of yesterday.