[wpe-2.28] Redirecting from page with google tags manager script causes rare crash

[laurence-ejraee]

Crash seen on wpewebkit 2.28 on our brcm STBs.
Attached is crashing test case, note the crash is rare - sometimes seen after ~100 retries (counter on testcase), sometimes seen after >800 tries. Obviously this makes debugging frustrating.
Note the google tags manager code/ID used is not mine, it is a demo I found online (which also crashes like ours) in order to share the issue here.

Test steps
Load basic html page with google tags manager code imported in header using <script src="..."> line.
In body of page navigate to another html page after 2s.
On the new html page, no google tags manager code, just a simple page, and navigates back to index.html after some time (e.g. 200ms).
Allow navigation to loop until a crash.

Findings
After extensive testing, it seems the crash is not seen if the html <script> line importing the google tags manager code is placed in both html pages (index.html and page navigated to).
Also seems the crash is not seen on wpewebkit-2.22.

I feel like the issue might be related to the google tags JS being unloaded suddenly when webkit navigates, but the JS was in the middle of executing something which triggers a crash in webkit.

Any help with this is really appreciated.
Thank you.

WEBKIT_DEBUG=all Crash with testcase.log
gtags-failcase.zip

[laurence-ejraee]

Further info: running with JSC_useConcurrentGC=false seems to fix the crash.
Update: But running with JSC_useStochasticMutatorScheduler=false still crashes, suggesting the issue is from the creation of both StochasticSpaceTimeMutatorScheduler or SpaceTimeMutatorScheduler - from Heap.cpp Heap::Heap() ~330.