Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/5dfc948c-b928-487e-a58e-6b8810220120

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(!IsDoc())

Top 10 frames of crashing thread:

0 xul.dll mozilla::a11y::RemoteAccessibleBase<mozilla::a11y::RemoteAccessible>::Shutdown accessible/ipc/RemoteAccessibleBase.cpp:41
1 xul.dll mozilla::a11y::DocAccessibleParent::ShutdownOrPrepareForMove accessible/ipc/DocAccessibleParent.cpp:185
2 xul.dll mozilla::a11y::DocAccessibleParent::ShutdownOrPrepareForMove accessible/ipc/DocAccessibleParent.cpp:194
3 xul.dll mozilla::a11y::DocAccessibleParent::ShutdownOrPrepareForMove accessible/ipc/DocAccessibleParent.cpp:194
4 xul.dll mozilla::a11y::DocAccessibleParent::ShutdownOrPrepareForMove accessible/ipc/DocAccessibleParent.cpp:194
5 xul.dll mozilla::a11y::DocAccessibleParent::ShutdownOrPrepareForMove accessible/ipc/DocAccessibleParent.cpp:194
6 xul.dll mozilla::a11y::DocAccessibleParent::ShutdownOrPrepareForMove accessible/ipc/DocAccessibleParent.cpp:194
7 xul.dll mozilla::a11y::DocAccessibleParent::ShutdownOrPrepareForMove accessible/ipc/DocAccessibleParent.cpp:194
8 xul.dll mozilla::a11y::DocAccessibleParent::RecvHideEvent accessible/ipc/DocAccessibleParent.cpp:244
9 xul.dll mozilla::a11y::PDocAccessibleParent::OnMessageReceived ipc/ipdl/PDocAccessibleParent.cpp:348

There are 106 crashes (from 42 installations) in nightly 98 starting with buildid 20220120100401. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1748878.

[1] https://hg.mozilla.org/mozilla-central/rev?node=6c3a672524b7

I'm pretty sure this is due to bug 1748450, not bug 1748878.

Not sure if this is helpful, but I'm getting this crash 100% consistently when I open a message in ProtonMail.

un-ni?ing me since after chatting with Jamie this seems unrelated to my work
:Jamie lemme know if/how I should go about relanding my patch on bug 1748878 :)

Note that bug 1748450 has been backed out, which should fix this.