Comment 10 for bug 1556735

Also seen with sugar-browse-activity package.

(gdb) bt
#0 JSC::JSCell::getPrimitiveNumber (this=this@entry=0x0, exec=exec@entry=0x7f8e28d43ab0,
    number=@0x7ffdcedc13e0: 9.8813129168249309e-324, value=...) at ../Source/JavaScriptCore/runtime/JSCell.cpp:134
#1 0x00007f8e85accbdc in JSC::JSValue::getPrimitiveNumber (value=..., number=@0x7ffdcedc13e0: 9.8813129168249309e-324,
    exec=0x7f8e28d43ab0, this=<synthetic pointer>) at ../Source/JavaScriptCore/runtime/JSCJSValueInlines.h:599
#2 JSC::jsLess<true> (v2=..., v1=..., callFrame=0x7f8e28d43ab0) at ../Source/JavaScriptCore/runtime/Operations.h:136
#3 JSC::slow_path_less (exec=0x7f8e28d43ab0, pc=0x7f8e0024a290) at ../Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:295
#4 0x00007f8e337cf4b2 in ?? ()
#5 0x0000000000000000 in ?? ()

Same backtrace, matched by function names and line numbers, reported in other bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1315708
https://bugzilla.redhat.com/show_bug.cgi?id=1305994
https://bugs.webkit.org/show_bug.cgi?id=154905 (comment 4, wontfix)
https://bugs.webkit.org/show_bug.cgi?id=153938