Reduced with m-c 20200218-5f2e62175414
Test case requires layout.css.constructable-stylesheets.enabled=true

#0 MOZ_Crash(char const*, int, char const*) src/obj-firefox/dist/include/mozilla/Assertions.h:331:3
#1 RustMozCrash src/mozglue/static/rust/wrappers.cpp:17:3
#2 mozglue_static::panic_hook::hfb0ed382a16f67d7 src/mozglue/static/rust/lib.rs:89:8
#3 core::ops::function::Fn::call::hc4969999b3cfd320 /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/ops/function.rs:72:4
#4 std::panicking::rust_panic_with_hook::h787d7f532b084b9a /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libstd/panicking.rs:475:16
#5 rust_begin_unwind /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libstd/panicking.rs:375:4
#6 core::panicking::panic_fmt::h76b979c035808e69 /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/panicking.rs:84:13
#7 core::option::expect_failed::h7475be656707bdc0 /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/option.rs:1188:4
#8 core::option::Option$LT$T$GT$::expect::h91464a7feeb0e9c0 /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/option.rs:348:20
#9 style::stylesheet_set::SheetCollection$LT$S$GT$::insert_before::hfce488414762e7f6 src/servo/components/style/stylesheet_set.rs:325:20
#10 style::stylesheet_set::AuthorStylesheetSet$LT$S$GT$::insert_stylesheet_before::had63b2aace01e598 src/servo/components/style/stylesheet_set.rs:422:12
#11 Servo_AuthorStyles_InsertStyleSheetBefore src/servo/ports/geckolib/glue.rs:1671:4
#12 mozilla::dom::ShadowRoot::InsertSheetIntoAuthorData(unsigned long, mozilla::StyleSheet&, nsTArray<RefPtr<mozilla::StyleSheet> > const&) src/dom/base/ShadowRoot.cpp:407:5
#13 mozilla::dom::ShadowRoot::StyleSheetApplicableStateChanged(mozilla::StyleSheet&) src/dom/base/ShadowRoot.cpp:438:5
#14 mozilla::StyleSheet::ApplicableStateChanged(bool) src/layout/style/StyleSheet.cpp:294:5
#15 mozilla::StyleSheet::SetDisabled(bool) src/layout/style/StyleSheet.cpp:314:5
#16 mozilla::dom::StyleSheet_Binding::set_disabled(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs) src/obj-firefox/dom/bindings/StyleSheetBinding.cpp:330:24
#17 bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3118:8
#18 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:477:13
#19 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:569:12
#20 InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:632:10
#21 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:649:8
#22 js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) src/js/src/vm/Interpreter.cpp:787:10
#23 SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyResult>, JS::ObjectOpResult&) src/js/src/vm/NativeObject.cpp:2956:8
#24 bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) src/js/src/vm/NativeObject.cpp:2985:14
#25 js::SetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) src/js/src/vm/ObjectOperations-inl.h:283:10
#26 SetPropertyOperation(JSContext*, JSOp, JS::Handle<JS::Value>, int, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>) src/js/src/vm/Interpreter.cpp:272:10
#27 Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:2806:12
#28 js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:449:10
#29 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:604:13
#30 InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:632:10
#31 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:649:8
#32 JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2797:10
#33 mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventListenerBinding.cpp:52:8
#34 void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12
#35 mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1073:43
#36 mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1271:17
#37 mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:356:17
#38 mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:558:16
#39 mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1055:11
#40 nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1144:7
#41 nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:6102:20
#42 nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:5885:7
#43 non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
#44 nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1348:3
#45 nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:907:14
#46 nsDocLoader::DocLoaderIsEmpty(bool) src/uriloader/base/nsDocLoader.cpp:727:9
#47 nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:615:5
#48 non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp
#49 mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) src/netwerk/base/nsLoadGroup.cpp:604:22
#50 mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:511:10
#51 mozilla::dom::Document::DoUnblockOnload() src/dom/base/Document.cpp:10737:18
#52 mozilla::dom::Document::UnblockOnload(bool) src/dom/base/Document.cpp:10669:9
#53 mozilla::dom::Document::DispatchContentLoadedEvents() src/dom/base/Document.cpp:7357:3
#54 mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() src/obj-firefox/dist/include/nsThreadUtils.h:1212:13
#55 mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:282:20
#56 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1220:14
#57 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:481:10
#58 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:87:21
#59 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#60 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#61 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#62 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:943:20
#63 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:237:9
#64 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#65 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#66 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:778:34
#67 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#68 main src/browser/app/nsBrowserApp.cpp:303:18

Sorry Erik, you were somehow already assigned to the bug? huh

Fixed in Bug 1617746
Added crash test: https://searchfox.org/mozilla-central/source/layout/style/crashtests/1616433.html