Since 318915@main (bug 190546), the GPU process queries EGL_CONTEXT_MEMORY_USAGE_ANGLE after the WebGL calls that change memory use. Context::getMemoryUsage() walks the buffer, texture and renderbuffer resource maps. glGen* reserves a name by storing a null object in the resource map until the name is first bound. The ResourceMap iterator skips these null objects in its flat arrays, but returns them for names stored in its hash map, and getTotalMemorySize() dereferences them. WebKit's ANGLE stores names from 0x3000 up in the hash map. To reproduce: generate more than 0x3000 buffer, texture or renderbuffer names without binding them, then query EGL_CONTEXT_MEMORY_USAGE_ANGLE. The query crashes in gl::Buffer::getMemorySize() (or the texture or renderbuffer equivalent) with a null object.