I tracked this down to a patch in bug 1514869 causing us to erroneously free Fontconfig data that we should not be freeing... Oops.
Bug 1553228 Comment 7 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
I tracked this down to a patch in bug 1514869 causing us to erroneously free Fontconfig data that we should not be freeing... Oops. This will cause us to crash pretty badly on any Fontconfig version < 2.9.