Found with m-c 20200922-fa0bf905d4cb

==21714==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f5388312792 bp 0x7ffd5d53ee30 sp 0x7ffd5d53ed80 T0)
==21714==The signal is caused by a READ memory access.
==21714==Hint: address points to the zero page.
    #0 0x7f5388312792 in operator() src/layout/base/nsDocumentViewer.cpp:1222:27
    #1 0x7f5388312792 in std::_Function_handler<void (mozilla::dom::BrowsingContext*), nsDocumentViewer::PermitUnload(nsIContentViewer::PermitUnloadAction, bool*)::$_21>::_M_invoke(std::_Any_data const&, mozilla::dom::BrowsingContext*&&) /builds/worker/fetches/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/7.4.0/../../../../include/c++/7.4.0/bits/std_function.h:316:2
    #2 0x7f538ae4d863 in operator() /builds/worker/fetches/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/7.4.0/../../../../include/c++/7.4.0/bits/std_function.h:706:14
    #3 0x7f538ae4d863 in mozilla::dom::BrowsingContext::PreOrderWalk(std::function<void (mozilla::dom::BrowsingContext*)> const&) src/docshell/base/BrowsingContext.cpp:848:3
    #4 0x7f538ae4da07 in mozilla::dom::BrowsingContext::PreOrderWalk(std::function<void (mozilla::dom::BrowsingContext*)> const&) src/docshell/base/BrowsingContext.cpp:854:12
    #5 0x7f5388290e63 in nsDocumentViewer::PermitUnload(nsIContentViewer::PermitUnloadAction, bool*) src/layout/base/nsDocumentViewer.cpp:1219:7
    #6 0x7f5383239cc2 in PermitUnload /builds/worker/workspace/obj-build/dist/include/nsIContentViewer.h:91:14
    #7 0x7f5383239cc2 in nsGlobalWindowOuter::CanClose() src/dom/base/nsGlobalWindowOuter.cpp:6263:23
    #8 0x7f538323a469 in nsGlobalWindowOuter::CloseOuter(bool) src/dom/base/nsGlobalWindowOuter.cpp:6321:35
    #9 0x7f538497019e in mozilla::dom::Window_Binding::close(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:1924:24
    #10 0x7f53851b2c33 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::CrossOriginThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3229:13
    #11 0x7f538bbcf154 in CallJSNative src/js/src/vm/Interpreter.cpp:508:13
    #12 0x7f538bbcf154 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:600:12
    #13 0x7f538bbd152e in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:665:10
    #14 0x7f538bbd18b0 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:682:8
    #15 0x7f538bd624c2 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2821:10
    #16 0x7f5384e664f4 in mozilla::dom::Function::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/FunctionBinding.cpp:45:8
    #17 0x7f53835bbcaa in void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject> >(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:73:12
    #18 0x7f53835bb913 in mozilla::dom::CallbackTimeoutHandler::Call(char const*) src/dom/base/TimeoutHandler.cpp:167:29
    #19 0x7f53831e8ab3 in nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*) src/dom/base/nsGlobalWindowInner.cpp:6091:38
    #20 0x7f53835b6d9a in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) src/dom/base/TimeoutManager.cpp:916:44
    #21 0x7f53835b5925 in mozilla::dom::TimeoutExecutor::MaybeExecute() src/dom/base/TimeoutExecutor.cpp:179:11
    #22 0x7f53835b94a6 in Notify src/dom/base/TimeoutExecutor.cpp:246:5
    #23 0x7f53835b94a6 in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) src/dom/base/TimeoutExecutor.cpp
    #24 0x7f537fd0e7d9 in nsTimerImpl::Fire(int) src/xpcom/threads/nsTimerImpl.cpp:565:39
    #25 0x7f537fd0dfbd in nsTimerEvent::Run() src/xpcom/threads/TimerThread.cpp:251:11
    #26 0x7f537fd4af53 in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() src/xpcom/threads/ThrottledEventQueue.cpp:254:22
    #27 0x7f537fd3df4f in mozilla::ThrottledEventQueue::Inner::Executor::Run() src/xpcom/threads/ThrottledEventQueue.cpp:81:15
    #28 0x7f537fd3f6b9 in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:244:16
    #29 0x7f537fcfe553 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:514:26
    #30 0x7f537fcfbf37 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:373:15
    #31 0x7f537fcfc38d in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:170:36
    #32 0x7f537fd4d284 in operator() src/xpcom/threads/TaskController.cpp:87:37
    #33 0x7f537fd4d284 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
    #34 0x7f537fd21963 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1234:14
    #35 0x7f537fd2ba5c in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:513:10
    #36 0x7f5380ff5024 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:109:5
    #37 0x7f5380ef95a1 in RunInternal src/ipc/chromium/src/base/message_loop.cc:334:10
    #38 0x7f5380ef95a1 in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
    #39 0x7f5380ef95a1 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
    #40 0x7f5387c5fe07 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
    #41 0x7f538b968f1f in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #42 0x7f5380ef95a1 in RunInternal src/ipc/chromium/src/base/message_loop.cc:334:10
    #43 0x7f5380ef95a1 in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
    #44 0x7f5380ef95a1 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
    #45 0x7f538b9684bc in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #46 0x5615d55bf01d in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #47 0x5615d55bf457 in main src/browser/app/nsBrowserApp.cpp:304:18

This looks like a similar stack to bug 1667334, which is a crash we're seeing on Nightly.

From the stack, I'm guessing that this might be a regression from bug 1655866.

A Pernosco session is available here: https://pernos.co/debug/t7WcYxvKr8szb_5PQFhkig/index.html

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200925214743-b7717ee20ba9.
The bug appears to have been introduced in the following build range:

Start: e90b3bde17b8f3464d8761673b86c38fc22ef34f (20200922002028)
End: 091a4043d78af274fd5639829f17e4195d262e4a (20200922010000)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=e90b3bde17b8f3464d8761673b86c38fc22ef34f&tochange=091a4043d78af274fd5639829f17e4195d262e4a

Comment 4 confirms my guess.

Set release status flags based on info from the regressing bug 1655866

Tracking for Fission M6c since we're tracking related bug 1667334 for M6c.

Backed out for perma failures.

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&selectedTaskRun=QyCtayFVQsWqTSuQb7u40g.0&resultStatus=testfailed%2Cbusted%2Cexception&revision=ad32c3d92002462d311ddd1bfddb408316d5cc7d

Log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=317120464&repo=autoland&lineNumber=1924

Backout: https://hg.mozilla.org/integration/autoland/rev/39c270b3813f8f5b0756ef734f82524075474785

https://hg.mozilla.org/mozilla-central/rev/4054397df437

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20201001094020-ba35799faec2.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.