No conclusions, just some notes.
This is a NULL Value* dereference, looking at its tag_ field (the crash address is 0x4. tag_ is at 0x5, but it'd be loading the full 32 bits and masking.) It happens while scanning the Value buffer (of type MonoTypeBuffer<ValueEdge>). That is supposed to contain a set of pointers to Values that we update when tenuring, and for some reason, on of those pointers is null here.
C++ code goes through put() at https://searchfox.org/mozilla-central/source/js/src/gc/StoreBuffer.h#94 to store these pointers. There is a 1-element cache (last_) in front of the actual buffer storage, which just happens to serve as a null-check. (Because nullptr is the same as having that cache empty, it will never pass through the null value.) Which leaves underlying buffer manipulations, the JIT, or bad values making it into that last_ cache slot. The initialization and clearing of last_ is pretty straightforward. The underlying buffer is a HashSet, which is rather particular about keeping things valid.
I'm not sure what to look for in the JIT. There is some jitted store buffer manipulation. The scariest would probably be the stuff used for nursery strings (bug 1442481), but that looks like it's not until Firefox 67. But if this is a bug with ARM JIT code for storebuffer insertion, I'm not going to be able to spot it.
Maybe someone familiar with ARM code could look at the minidump and at least see if we're tracing last_ and if not, how far through the buffer we made it? Not that there's an easy way to see that. I believe we are probably crashing in https://hg.mozilla.org/mozilla-central/annotate/34e99cf78401ab40f6217e0b445e93aa86518d86/js/src/gc/Marking.cpp#l2899 when it does deref(), specifically when it tests isGCThing(). The calling code is https://hg.mozilla.org/mozilla-central/annotate/34e99cf78401ab40f6217e0b445e93aa86518d86/js/src/gc/Marking.cpp#l2746 or https://hg.mozilla.org/mozilla-central/annotate/34e99cf78401ab40f6217e0b445e93aa86518d86/js/src/gc/Marking.cpp#l2749
sdetar, who is the right ARM JIT person here?
jonco, needinfo'ing you just in case you recognize the symptom of a null edge in the store buffer. Unlikely, but I thought I'd ask.