Oh Snooooorlax, I've got a present! ( If it actually contains anything useful! ) I've managed to get apitrace's of the crash (5 times over to be sure). So I've got every GL call EVE makes up until boom.
Quote:481798 memcpy(dest = 0x7fa6e000, src = blob(22464), n = 22464)
481799 glFlushMappedBufferRangeAPPLE(target = GL_ELEMENT_ARRAY_BUFFER, offset = 0, size = 22464)
481801 glUnmapBuffer(target = GL_ELEMENT_ARRAY_BUFFER) = GL_TRUE
481802 glBindTexture(target = GL_TEXTURE_2D, texture = 19)
481818 glProgramEnvParameters4fvEXT(target = GL_VERTEX_PROGRAM_ARB, index = 0, count = 1, params = {1600, 1000, 1, 1})
481819 glProgramEnvParameters4fvEXT(target = GL_VERTEX_PROGRAM_ARB, index = 5, count = 128, params = {1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1})
481820 glProgramEnvParameters4fvEXT(target = GL_FRAGMENT_PROGRAM_ARB, index = 0, count = 2, params = {0.0078125, 0.0078125, 0, 0, 0.5870461, -0.5870461, 0.5574533, 1})
481821 glProgramEnvParameters4fvEXT(target = GL_VERTEX_PROGRAM_ARB, index = 1, count = 1, params = {16, 0, 0, 0})
481822 glProgramEnvParameters4fvEXT(target = GL_VERTEX_PROGRAM_ARB, index = 2, count = 1, params = {4, 1, 0, -0.5})
481823 glProgramEnvParameters4fvEXT(target = GL_VERTEX_PROGRAM_ARB, index = 3, count = 1, params = {2, -1, -2, 1})
481824 glProgramEnvParameters4fvEXT(target = GL_VERTEX_PROGRAM_ARB, index = 4, count = 1, params = {-1, -2, -3, 9})
481826 glDrawRangeElements(mode = GL_TRIANGLES, start = 0, end = 5, count = 6, type = GL_UNSIGNED_INT, indices = NULL)
481829 glBufferData(target = GL_ARRAY_BUFFER, size = 262176, data = NULL, usage = GL_STATIC_DRAW)
481830 glMapBuffer(target = GL_ARRAY_BUFFER, access = GL_WRITE_ONLY) = 0x7fbf8000
Now these are huge - the replayable traces are about a gig, and the text dumps about 100 megs. Hopefully, replaying the dump with apitrace will trigger the bug again. Instant repo. Not tried that yet, was assuming my only test case was about to get patched out of existance!
You'll need to get me an email address, or better, some space on a server I can upload them to if you want them.