Mostly when flinging, but I've also see it happen when just dragging around. Here's a stack: Nexus 4: Program received signal SIGSEGV, Segmentation fault. 0xb6d991ba in pthread_mutex_lock () from /home/fabrice/dev/jimdb/jimdb-arm/lib/0032368996570d05/system/lib/libc.so (gdb) bt #0 0xb6d991ba in pthread_mutex_lock () from /home/fabrice/dev/jimdb/jimdb-arm/lib/0032368996570d05/system/lib/libc.so #1 0x982220e0 in Lock (this=0xc8) at /home/fabrice/dev/b2g-inbound/ipc/chromium/src/base/lock_impl_posix.cc:41 #2 Acquire (this=0xc8) at /home/fabrice/dev/b2g-inbound/ipc/chromium/src/base/lock.h:16 #3 AutoLock (lock=..., this=0xbee6aa04) at /home/fabrice/dev/b2g-inbound/ipc/chromium/src/base/lock.h:43 #4 MessageLoop::PostTask_Helper (this=0x0, from_here=..., task=0x84be3f90, delay_ms=499, nestable=nestable@entry=true) at /home/fabrice/dev/b2g-inbound/ipc/chromium/src/base/message_loop.cc:326 #5 0x98222128 in MessageLoop::PostDelayedTask (this=<optimized out>, from_here=..., task=<optimized out>, delay_ms=<optimized out>) at /home/fabrice/dev/b2g-inbound/ipc/chromium/src/base/message_loop.cc:272 #6 0x9858cfc6 in mozilla::layers::TaskThrottler::PostTask (this=this@entry=0x7e236960, aLocation=..., aTask=..., aTimeStamp=...) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/TaskThrottler.cpp:53 #7 0x9858d1f0 in mozilla::layers::AsyncPanZoomController::RequestContentRepaint (this=this@entry=0x858e8e00, aFrameMetrics=..., aThrottled=aThrottled@entry=true) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/AsyncPanZoomController.cpp:2732 #8 0x9858d240 in mozilla::layers::AsyncPanZoomController::RequestContentRepaint (this=this@entry=0x858e8e00) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/AsyncPanZoomController.cpp:2697 #9 0x9858e04e in mozilla::layers::AsyncPanZoomController::FlushRepaintForOverscrollHandoff (this=0x858e8e00) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/AsyncPanZoomController.cpp:2637 #10 0x985885f8 in operator()<> (this=<optimized out>) at ../../dist/include/mozilla/RefPtr.h:295 #11 mozilla::layers::OverscrollHandoffChain::ForEachApzc (this=0x7de12f50, aMethod= (void (mozilla::layers::AsyncPanZoomController::*)(mozilla::layers::AsyncPanZoomController * const)) 0x9858e037 <mozilla::layers::AsyncPanZoomController::FlushRepaintForOverscrollHandoff()>) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/OverscrollHandoffState.cpp:67 #12 0x9858865c in mozilla::layers::OverscrollHandoffChain::FlushRepaints (this=<optimized out>) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/OverscrollHandoffState.cpp:86 #13 0x9858cadc in mozilla::layers::AsyncPanZoomController::OnTouchEnd (this=this@entry=0x83079000, aEvent=...) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/AsyncPanZoomController.cpp:1322 #14 0x985911a6 in mozilla::layers::AsyncPanZoomController::HandleInputEvent (this=0x83079000, aEvent=..., aTransformToApzc=...) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/AsyncPanZoomController.cpp:1069 #15 0x98590e4a in mozilla::layers::InputQueue::MaybeHandleCurrentBlock (this=0x85c383b0, block=0x7e2c0350, aEvent=...) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/InputQueue.cpp:73 #16 0x9859141c in mozilla::layers::InputQueue::ReceiveTouchInput (this=this@entry=0x85c383b0, aTarget=..., aTargetConfirmed=aTargetConfirmed@entry=false, aEvent=..., aOutInputBlockId=aOutInputBlockId@entry=0xbee6b058) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/InputQueue.cpp:159 #17 0x9859178c in mozilla::layers::InputQueue::ReceiveInputEvent (this=0x85c383b0, aTarget=..., aTargetConfirmed=<optimized out>, aEvent=..., aOutInputBlockId=0xbee6b058) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/InputQueue.cpp:40 #18 0x98591978 in mozilla::layers::APZCTreeManager::ProcessTouchInput (this=this@entry=0x872675c0, aInput=..., aOutTargetGuid=aOutTargetGuid@entry=0xbee6b060, aOutInputBlockId=aOutInputBlockId@entry=0xbee6b058) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/APZCTreeManager.cpp:932 #19 0x98591a44 in mozilla::layers::APZCTreeManager::ReceiveInputEvent (this=0x872675c0, aEvent=..., aOutTargetGuid=0xbee6b060, aOutInputBlockId=0xbee6b058) at /home/fabrice/dev/b2g-inbound/gfx/layers/apz/src/APZCTreeManager.cpp:691 #20 0x98dbfad6 in Java_org_mozilla_gecko_gfx_NativePanZoomController_handleTouchEvent (env=<optimized out>, instance=<optimized out>, event=<optimized out>) at /home/fabrice/dev/b2g-inbound/widget/android/AndroidJNI.cpp:372 #21 0xa408022c in ?? () #22 0xa408022c in ?? () Backtrace stopped: previous frame identical to this frame (corrupt stack?) (gdb)

Botond, I haven't backed out yet, but I suspect Bug 1213273

Yep, confirmed that backing out bug 1213273 fixes the issue.