Comment 12 for bug 1794033

One of the tests that seems to reproduce this more often than others:

dEQP-GLES31.functional.debug.negative_coverage.get_error.vertex_array.draw_arrays_instanced_incomplete_primitive

produces on stderr:
  corrupted size vs. prev_size
or
  corrupted double-linked list

Seen on bxt, bdw, bsw, ivb