Rubber stamped already by Mark Lam. The bug here is multiple VMs can be running concurrently to one another in the same process. They may each ref/deref something that isn't ThreadSafeRefCounted
Created attachment 340664 [details] patch for landing
landed in: https://trac.webkit.org/changeset/231930/webkit
<rdar://problem/40349098>