WebKit JavaScriptCore - CodeBlock Dangling Watchpoints Use-After-Free

WebKit JavaScriptCore - CodeBlock Dangling Watchpoints Use-After-Free / While fuzzing JavaScriptCore, I encountered the following simplified and commented JavaScript program which crashes jsc from current HEAD and release: / function v9 // Some watchpoint on the LexicalEnvironment is triggered he...