After discussion on the public_webgl mailing list, the WebGL spec and conformance test conformance/buffers/index-validation.html was just updated to require that an INVALID_VALUE error be generated when a large negative offset is passed to vertexAttribPointer. The test is now failing on all WebKit ports because the IDL does not correctly describe the argument as a signed 64-bit quantity, so it is being truncated to 32 bits and considered as a signed, in-range value. I haven't yet found an example in the IDL which passes a 64-bit integer from JavaScript to C++ (understanding fully that JavaScript's numbers can only describe integer values between -(2^53 - 1) and (2^53 - 1)). The code generators will probably need to be enhanced to support this.
I accidentally filed this one twice. Closing as duplicate. *** This bug has been marked as a duplicate of bug 85117 ***