surf crashed with SIGSEGV in JSC::JSCell::getPrimitiveNumber()

(I actually posted this hoping that lp would give me a fuller stack trace as I don't have all the debug symbol packages locally)

StacktraceTop:
 JSC::JSCell::getPrimitiveNumber (this=0x0, exec=0x7fdedde7eb30, number=@0x7ffff5fd3a20: 6.9463366493883692e-310, value=...) at ../Source/JavaScriptCore/runtime/JSCell.cpp:134
 JSC::JSValue::getPrimitiveNumber (this=this@entry=0x7ffff5fd39f0, exec=exec@entry=0x7fdedde7eb30, number=@0x7ffff5fd3a20: 6.9463366493883692e-310, value=...) at ../Source/JavaScriptCore/runtime/JSCJSValueInlines.h:599
 jsLess<true> (v2=..., v1=..., callFrame=0x7fdedde7eb30) at ../Source/JavaScriptCore/runtime/Operations.h:136
 JSC::operationCompareLess (exec=0x7fdedde7eb30, encodedOp1=<optimized out>, encodedOp2=<optimized out>) at ../Source/JavaScriptCore/jit/JITOperations.cpp:829
 ?? ()

Status changed to 'Confirmed' because the bug affects multiple users.

I'm having similar issue with Eclipse, which crashed after the following exception:

#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00007f88441d39c0, pid=7412, tid=140228481140480
#
# JRE version: OpenJDK Runtime Environment (8.0_91-b14) (build 1.8.0_91-8u91-b14-3ubuntu1~16.04.1-b14)
# Java VM: OpenJDK 64-Bit Server VM (25.91-b14 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# C [libjavascriptcoregtk-3.0.so.0+0x4629c0] JSC::JSCell::getPrimitiveNumber(JSC::ExecState*, double&, JSC::JSValue&) const+0x0

[...]

Stack: [0x00007f897cbe4000,0x00007f897cce5000], sp=0x00007f897cce2138, free space=1016k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libjavascriptcoregtk-3.0.so.0+0x4629c0] JSC::JSCell::getPrimitiveNumber(JSC::ExecState*, double&, JSC::JSValue&) const+0x0
C 0x00007f87fe5ea4e8

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
J 8160 org.eclipse.swt.internal.gtk.OS._g_main_context_iteration(JZ)Z (0 bytes) @ 0x00007f8966704084 [0x00007f8966704040+0x44]
J 11091 C2 org.eclipse.swt.widgets.Display.readAndDispatch()Z (71 bytes) @ 0x00007f896656a890 [0x00007f896656a5c0+0x2d0]
J 11110% C2 org.eclipse.jface.window.Window.runEventLoop(Lorg/eclipse/swt/widgets/Shell;)V (70 bytes) @ 0x00007f8966abf310 [0x00007f8966abf240+0xd0]
j org.eclipse.jface.window.Window.open()I+49
j org.python.pydev.editor.PydevShowBrowserMessage$1.run()V+32
j org.eclipse.swt.widgets.RunnableLock.run()V+11
j org.eclipse.swt.widgets.Synchronizer.runAsyncMessages(Z)Z+37
j org.eclipse.swt.widgets.Display.runAsyncMessages(Z)Z+5
j org.eclipse.swt.widgets.Display.readAndDispatch()Z+61
j org.eclipse.e4.ui.internal.workbench.swt.PartRenderingEngine$4.run()V+530
j org.eclipse.core.databinding.observable.Realm.runWithDefault(Lorg/eclipse/core/databinding/observable/Realm;Ljava/lang/Runnable;)V+12
j org.eclipse.e4.ui.internal.workbench.swt.PartRenderingEngine.run(Lorg/eclipse/e4/ui/model/application/MApplicationElement;Lorg/eclipse/e4/core/contexts/IEclipseContext;)Ljava/lang/Object;+57
j org.eclipse.e4.ui.internal.workbench.E4Workbench.createAndRunUI(Lorg/eclipse/e4/ui/model/application/MApplicationElement;)V+20
j org.eclipse.ui.internal.Workbench$5.run()V+436
j org.eclipse.core.databinding.observable.Realm.runWithDefault(Lorg/eclipse/core/databinding/observable/Realm;Ljava/lang/Runnable;)V+12
j org.eclipse.ui.internal.Workbench.createAndRunWorkbench(Lorg/eclipse/swt/widgets/Display;Lorg/eclipse/ui/application/WorkbenchAdvisor;)I+18
j org.eclipse.ui.PlatformUI.createAndRunWorkbench(Lorg/eclipse/swt/widgets/Display;Lorg/eclipse/ui/application/WorkbenchAdvisor;)I+2
j org.eclipse.ui.internal.ide.application.IDEApplication.start(Lorg/eclipse/equinox/app/IApplicationContext;)Ljava/lang/Object;+105
j org.eclipse.equinox.internal.app.EclipseAppHandle.run(Ljava/lang/Object;)Ljava/lang/Object;+135
j org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.runApplication(Ljava/lang/Object;)Ljava/lang/Object;+85
j org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.start(Ljava/lang/Object;)Ljava/lang/Object;+82
j org.eclipse.core.runtime.adaptor...

Also seen with sugar-browse-activity package.

(gdb) bt
#0 JSC::JSCell::getPrimitiveNumber (this=this@entry=0x0, exec=exec@entry=0x7f8e28d43ab0,
    number=@0x7ffdcedc13e0: 9.8813129168249309e-324, value=...) at ../Source/JavaScriptCore/runtime/JSCell.cpp:134
#1 0x00007f8e85accbdc in JSC::JSValue::getPrimitiveNumber (value=..., number=@0x7ffdcedc13e0: 9.8813129168249309e-324,
    exec=0x7f8e28d43ab0, this=<synthetic pointer>) at ../Source/JavaScriptCore/runtime/JSCJSValueInlines.h:599
#2 JSC::jsLess<true> (v2=..., v1=..., callFrame=0x7f8e28d43ab0) at ../Source/JavaScriptCore/runtime/Operations.h:136
#3 JSC::slow_path_less (exec=0x7f8e28d43ab0, pc=0x7f8e0024a290) at ../Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:295
#4 0x00007f8e337cf4b2 in ?? ()
#5 0x0000000000000000 in ?? ()

Same backtrace, matched by function names and line numbers, reported in other bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1315708
https://bugzilla.redhat.com/show_bug.cgi?id=1305994
https://bugs.webkit.org/show_bug.cgi?id=154905 (comment 4, wontfix)
https://bugs.webkit.org/show_bug.cgi?id=153938