Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/3b96c7da-e00e-4fc3-91cd-e0ee30201012

Reason: SIGSEGV /SEGV_MAPERR

Top 1 frames of crashing thread:

0 libxul.so {virtual override thunk} 

The stack is pretty useless but I was printing selection when this happened so I'll look into it.

Gabriele, do you know what's the reason for this stack? I've seen another similar crash recently.

On a debug build, I get:

[Child 11533, Main Thread] ###!!! ASSERTION: How did we end up with a presshell if our parent doesn't have one?: '!parent || mDocument->IsStaticDocument() || parent->GetPresShell()', file /home/emilio/src/moz/gecko-3/layout/base/nsPresContext.cpp:672
Assertion failure: aDoc.IsStaticDocument(), at /home/emilio/src/moz/gecko-3/layout/printing/nsPrintJob.cpp:1958

STR for that stack in case it's useful is opening the "Crash data" section above, select across the frame, right click, print selection.

I've only repro'd with Fission so might be a fission-only bug, but it may also not be.

(In reply to Emilio Cobos Álvarez (:emilio) from comment #3)

I've only repro'd with Fission so might be a fission-only bug, but it may also not be.

(Narrator: it is)

Otherwise we end up creating an in-process docshell and an initial,
non-static subdocument. This usually won't cause badness, but is wrong
and can cause badness when printing selection etc.

The assertion I added is hit on existing tests and would've caught this.

The minidump lacks the stack contents for the thread that crashed the stack. It's very odd because all the other threads' stacks have been recorded correctly in the minidump. I'll open a crash reporting bug with this STR to investigate the issue.

https://hg.mozilla.org/mozilla-central/rev/f25c913ea72d