My most stable test case is unfortunately the Mathematica welcome screen. After
some 5 mins of work in Chrome followed by a couple of Mathematica restarts,
like 5-10, the lockup or segfault happens. Geeqie didn't do anything for me.

I haven't made any good progress with bisecting other than reconfirming that 

http://cgit.freedesktop.org/mesa/mesa/commit/?id=cb4ad1368551b64756c7b6e2007588e34739b188

fixes a segfault. This fix uncovers the lockup behavior.

Maybe apitrace is a way forward to generate something more testable.

Marek: Can you provide more information on the other known problem?