Reduced with m-c:
BuildID=20190904094319
SourceStamp=174361d152923aea2b24226a57cde3099509ed6a

==57241==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000001c (pc 0x7f18aeace92b bp 0x7fff23fc06d0 sp 0x7fff23fc0500 T0)
==57241==The signal is caused by a READ memory access.
==57241==Hint: address points to the zero page.
    #0 0x7f18aeace92a in mozilla::HTMLEditor::InsertBRElementIfHardLineIsEmptyAndEndsWithBlockBoundary(mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&) src/editor/libeditor/HTMLEditRules.cpp
    #1 0x7f18aeacb987 in mozilla::HTMLEditRules::AfterEditInner() src/editor/libeditor/HTMLEditRules.cpp:487:16
    #2 0x7f18aeacaa23 in mozilla::HTMLEditRules::AfterEdit() src/editor/libeditor/HTMLEditRules.cpp:385:17
    #3 0x7f18aebc7de1 in mozilla::HTMLEditor::OnEndHandlingTopLevelEditSubAction() src/editor/libeditor/HTMLEditor.cpp:3653:43
    #4 0x7f18aec73949 in ~AutoEditSubActionNotifier src/obj-firefox/dist/include/mozilla/EditorBase.h:2468:36
    #5 0x7f18aec73949 in mozilla::TextEditor::DeleteSelectionAsSubAction(short, short) src/editor/libeditor/TextEditor.cpp:677
    #6 0x7f18aec7b540 in mozilla::TextEditor::DeleteSelectionAsAction(short, short, nsIPrincipal*) src/editor/libeditor/TextEditor.cpp:636:17
    #7 0x7f18a95f56c1 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) src/dom/base/Document.cpp:4633:26
    #8 0x7f18ab7727d7 in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Document*, JSJitMethodCallArgs const&) src/obj-firefox/dom/bindings/DocumentBinding.cpp:3579:36
    #9 0x7f18abec481d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3168:13
    #10 0x7f18b2aa1e17 in CallJSNative src/js/src/vm/Interpreter.cpp:447:13
    #11 0x7f18b2aa1e17 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:539
    #12 0x7f18b2a8a0bc in CallFromStack src/js/src/vm/Interpreter.cpp:598:10
    #13 0x7f18b2a8a0bc in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3084
    #14 0x7f18b2a6b75f in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:424:10
    #15 0x7f18b2aa291f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:567:13
    #16 0x7f18b2aa4b42 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:610:8
    #17 0x7f18b360d738 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2723:10
    #18 0x7f18ab729d44 in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:267:37
    #19 0x7f18ac698661 in Call<nsCOMPtr<mozilla::dom::EventTarget> > src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:363:12
    #20 0x7f18ac698661 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) src/dom/events/JSEventHandler.cpp:205
    #21 0x7f18ac65b33c in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1041:22
    #22 0x7f18ac65cd80 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1233:17
    #23 0x7f18ac6437fa in HandleEvent src/obj-firefox/dist/include/mozilla/EventListenerManager.h:353:5
    #24 0x7f18ac6437fa in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:349
    #25 0x7f18ac642012 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:551:16
    #26 0x7f18ac6479db in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1047:11
    #27 0x7f18aefe83f4 in nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1170:7
    #28 0x7f18b1c2e501 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:6541:20
    #29 0x7f18b1c2d77e in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:6319:7
    #30 0x7f18b1c323bf in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
    #31 0x7f18a7f304dc in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1333:3
    #32 0x7f18a7f2f57c in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:892:14
    #33 0x7f18a7f2b19b in nsDocLoader::DocLoaderIsEmpty(bool) src/uriloader/base/nsDocLoader.cpp:726:9
    #34 0x7f18a7f2dff6 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:614:5
    #35 0x7f18a7f2f15c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp
    #36 0x7f18a5751b40 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:568:22
    #37 0x7f18a95e6ef8 in DoUnblockOnload src/dom/base/Document.cpp:10692:18
    #38 0x7f18a95e6ef8 in mozilla::dom::Document::UnblockOnload(bool) src/dom/base/Document.cpp:10624
    #39 0x7f18a96128a4 in mozilla::dom::Document::DispatchContentLoadedEvents() src/dom/base/Document.cpp:7186:3
    #40 0x7f18a96f8014 in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> src/obj-firefox/dist/include/nsThreadUtils.h:1124:12
    #41 0x7f18a96f8014 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> src/obj-firefox/dist/include/nsThreadUtils.h:1130
    #42 0x7f18a96f8014 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() src/obj-firefox/dist/include/nsThreadUtils.h:1176
    #43 0x7f18a5492121 in mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:295:32
    #44 0x7f18a54c3b86 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1225:14
    #45 0x7f18a54c9a88 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
    #46 0x7f18a66ce04f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
    #47 0x7f18a65cae72 in RunInternal src/ipc/chromium/src/base/message_loop.cc:315:10
    #48 0x7f18a65cae72 in RunHandler src/ipc/chromium/src/base/message_loop.cc:308
    #49 0x7f18a65cae72 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290
    #50 0x7f18ae8f6539 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
    #51 0x7f18b27eaa7f in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:934:20
    #52 0x7f18a65cae72 in RunInternal src/ipc/chromium/src/base/message_loop.cc:315:10
    #53 0x7f18a65cae72 in RunHandler src/ipc/chromium/src/base/message_loop.cc:308
    #54 0x7f18a65cae72 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290
    #55 0x7f18b27ea326 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:769:34
    #56 0x5607a5302d5a in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #57 0x5607a5302d5a in main src/browser/app/nsBrowserApp.cpp:272

A Pernosco session is available here: https://pernos.co/debug/AcUEcGWERV_abcSnmOgfmA/index.html

I cannot reproduce this crash anymore. According to the status flags, the method accessed reference of aPointToInsert.GetContainer() without null-check:
https://searchfox.org/mozilla-central/rev/b07bd373e8d1bf672354e350a82b6eb84478f347/editor/libeditor/HTMLEditSubActionHandler.cpp#3429,3433

However, it's now checked:
https://searchfox.org/mozilla-central/rev/c938c7416c633639a5c8ce4412be586eefb48005/editor/libeditor/HTMLEditSubActionHandler.cpp#2248

The check was added by bug 1627175 (part 1):
https://searchfox.org/mozilla-central/diff/7ae8033ee1038160616d55183462e7499f176fc9/editor/libeditor/HTMLEditSubActionHandler.cpp#3542

So, we should just add the testcase into the tree.

https://hg.mozilla.org/mozilla-central/rev/1afe4bcb269b