Comment 10 for bug 1613602

https://code.launchpad.net/~morphis/tangxi-midori/+git/platform_frameworks_native/+merge/296205
I found it's related to android side libEGL. When stepping in _IO_vfscanf_internal, sometimes variable curnumeric is assigned a value that falls in libEGL memory pages.