The compositor thread in WebKitGTK+ might alter a FilterOperation object's reference count variable at the same time as the main thread. Then the reference count corruption might lead to a use-after-free condition.
bbe17996fb172c1e4eed3095e053f8ed01eb9b918fe81e18dabc0807d4a6f3b7