Maybe Fission related. (DOMFissionEnabled=1)

Hit this crash on this page - https://imgur.com/gallery/Dxq5rlu

Crash report: https://crash-stats.mozilla.org/report/index/e1234c92-97e1-4383-8d48-87fcb0200925

Top 10 frames of crashing thread:

0 libgallium_dri.so <name omitted> ../src/gallium/auxiliary/util/u_transfer_helper.c:494
1 libgbm.so.1 gbm_dri_bo_unmap ../src/gbm/backends/dri/gbm_dri.c:1251
2 libxul.so DMABufSurfaceYUV::UpdateYUVData widget/gtk/DMABufSurface.cpp:802
3 libxul.so mozilla::FFmpegVideoDecoder<58>::CreateImageDMABuf dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp:800
4 libxul.so mozilla::FFmpegVideoDecoder<58>::DoDecode dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp:504
5 libxul.so mozilla::FFmpegDataDecoder<58>::DoDecode dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp:181
6 libxul.so mozilla::FFmpegDataDecoder<58>::ProcessDecode dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp:137
7 libxul.so mozilla::detail::ProxyRunnable<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true>, RefPtr<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true> >  xpcom/threads/MozPromise.h:1457
8 libxul.so mozilla::TaskQueue::Runner::Run xpcom/threads/TaskQueue.cpp:158
9 libxul.so nsThreadPool::Run xpcom/threads/nsThreadPool.cpp:299

3 libxul.so mozilla::FFmpegVideoDecoder<58>::CreateImageDMABuf dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp:800

It looks like this is software decoding to dmabuf (bug 1629788).

FWIW, I have media.ffmpeg.dmabuf-textures.enabled set to false (the default).

media.ffmpeg.low-latency.enabled and media.ffmpeg.vaapi.enabled are set to true, though.

media.ffmpeg.vaapi.enabled implies media.ffmpeg.dmabuf-textures.enabled. Both enable UseDMABufVideoTextures.

Closing because no crashes reported for 12 weeks.