The ScriptValue m_detail in the CustomEvent class is initialized to null (rather than jsNull()) which can lead to a null deref if it is access before calling initCustomEvent.
It does, it does! Repro crash -> P1
Created attachment 99737 [details]
Committed r90405: <http://trac.webkit.org/changeset/90405>