Mozilla: Incorrect JITting of arguments led to use-after-free during garbage collection

The Mozilla Foundation Security Advisory describes this flaw as: The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garbage collection...