Passing badly typed uniform or vertex data to OpenGL can cause some drivers to crash. We need to do sufficient checks to prevent that from happening. For instance, passing a vertexAttribPointer as UNSIGNED_BYTE with 3 values when the value is actually FLOAT with 2 values will crash some hardware and not others. likewise, passing UNSIGNED_BYTE with 3 values to a vertexAttrib of type vec4 will crash some hardware.
These tests written against the Firefox GL canvas might be helpful: http://github.com/kig/canvas3d-tests
I think after all the dependency patches land, the only thing left unchecked is vertexArreibPointer()'s "type". GL_FIXED is a valid enum for type in GLES2, but it's not supported in GL. I think we should add in the spec that FIXED is not allowed in WebGL.
The WebGL spec has been updated to explicitly state that the GL_FIXED data type is not supported.
Dean - I think we can close this based on the specification change.
Closing this old bug. WebKit's ANGLE backend, which is a conformant ES 2.0 / 3.0 implementation, has conclusively fixed this.