I have the same issue, but in an iOS app that creates its own JSContext. Worked fine in iOS 10.0 and 10.1 breaks badly on 10.2. This occurs when the JSContext is being deallocated.
Thread 0 name: Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0 JavaScriptCore 0x0000000191d8b0bc ***::CrashOnOverflow::crash() + 0
1 JavaScriptCore 0x0000000191d8b0bc ***::CrashOnOverflow::crash() + 0
2 JavaScriptCore 0x0000000191d18794 JSC::CodeBlock::RareData::~RareData() + 0
3 JavaScriptCore 0x0000000191f42f78 JSC::CodeBlockSet::lastChanceToFinalize() + 200
4 JavaScriptCore 0x00000001921c47b0 JSC::Heap::lastChanceToFinalize() + 120
5 JavaScriptCore 0x00000001924a82f0 JSC::VM::~VM() + 220
6 JavaScriptCore 0x0000000191c6e364 JSC::JSLockHolder::~JSLockHolder() + 84
7 JavaScriptCore 0x000000019221b7ac Inspector::InspectorHeapAgent::disable(***::String&) + 328
8 JavaScriptCore 0x000000019221b498 Inspector::InspectorHeapAgent::willDestroyFrontendAndBackend(Inspector::DisconnectReason) + 128
9 JavaScriptCore 0x00000001921d6870 Inspector::AgentRegistry::willDestroyFrontendAndBackend(Inspector::DisconnectReason) + 56
10 JavaScriptCore 0x00000001922c5d54 Inspector::JSGlobalObjectInspectorController::globalObjectDestroyed() + 28
11 JavaScriptCore 0x0000000191d196cc JSC::JSGlobalObject::~JSGlobalObject() + 36
12 JavaScriptCore 0x0000000191d19690 JSC::Heap::FinalizerOwner::finalize(JSC::Handle<JSC::Unknown>, void*) + 24
13 JavaScriptCore 0x00000001924fefc0 JSC::WeakBlock::lastChanceToFinalize() + 80
14 JavaScriptCore 0x0000000192393e94 JSC::MarkedBlock::lastChanceToFinalize() + 40
15 JavaScriptCore 0x00000001923932c8 JSC::MarkedAllocator::lastChanceToFinalize() + 96
16 JavaScriptCore 0x0000000192394650 void JSC::MarkedSpace::forEachAllocator<JSC::LastChanceToFinalize>() + 92
17 JavaScriptCore 0x00000001921c47b8 JSC::Heap::lastChanceToFinalize() + 128
18 JavaScriptCore 0x00000001924a82f0 JSC::VM::~VM() + 220
19 JavaScriptCore 0x0000000191c6e364 JSC::JSLockHolder::~JSLockHolder() + 84
20 JavaScriptCore 0x0000000192298624 JSContextGroupRelease + 80
21 JavaScriptCore 0x00000001923438b0 -[JSVirtualMachine dealloc] + 36
22 JavaScriptCore 0x0000000192297934 -[JSContext dealloc] + 140
23 JavaScriptCore 0x0000000192340c0c -[JSValue(Internal) dealloc] + 76
24 libobjc.A.dylib 0x000000018c7b9fe0 (anonymous namespace)::AutoreleasePoolPage::pop(void*) + 704
25 CoreFoundation 0x000000018dc42028 _CFAutoreleasePoolPop + 28
26 UIKit 0x0000000193e9aae8 _prepareForCAFlush + 596
27 UIKit 0x0000000193c0a13c _afterCACommitHandler + 304
28 CoreFoundation 0x000000018dd160c0 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 32
29 CoreFoundation 0x000000018dd13cf0 __CFRunLoopDoObservers + 372
30 CoreFoundation 0x000000018dd14180 __CFRunLoopRun + 1024
31 CoreFoundation 0x000000018dc422b8 CFRunLoopRunSpecific + 444
32 GraphicsServices 0x000000018f6f6198 GSEventRunModal + 180
33 UIKit 0x0000000193c827fc -[UIApplication _run] + 684
34 UIKit 0x0000000193c7d534 UIApplicationMain + 208
35 LocusOTG_UAT 0x00000001000e7ff0 main (main.m:16)
36 libdyld.dylib 0x000000018cc255b8 start + 4
