The compositor thread in WebKitGTK+ might alter a FilterOperation object's reference count variable at the same time as the main thread. Then the reference count corruption might lead to a use-after-free condition.
MD5 | 7cf03baad452fd88cc65c2145f359558
