webbrowser-app crashed with SIGSEGV in pushbuf_kref()

[nicobel]

On my system the web browser can surf web pages but in a few seconds it crashes the app and sometimes my hole system, making it unresponsive and I have to switch off power (maybe kernel panic?). This happens the same with snap and debian versions. The crash file generated in /var/crash is attached below.

And here is what it displays in the terminal when crashing (There are a few sentences in spanish):

user@machine:~$ webbrowser-app
could not open containers config file "/home/miguel/.local/share/libertine/ContainersConfig.json"
Input device added: "Power Button" "/dev/input/event1" QFlags(0x1)
Input device added: "Power Button" "/dev/input/event0" QFlags(0x1)
Input device added: "Logitech USB Optical Mouse" "/dev/input/event3" QFlags(0x2)
Input device added: "HDA Intel Line Out Side" "/dev/input/event10" QFlags(0x20)
Input device added: "HDA Intel Front Headphone" "/dev/input/event11" QFlags(0x20)
Input device added: "HDA Intel Front Mic" "/dev/input/event4" QFlags(0x20)
Input device added: "HDA Intel Rear Mic" "/dev/input/event5" QFlags(0x20)
Input device added: "HDA Intel Line" "/dev/input/event6" QFlags(0x20)
Input device added: "HDA Intel Line Out Front" "/dev/input/event7" QFlags(0x20)
Input device added: "HDA Intel Line Out Surround" "/dev/input/event8" QFlags(0x20)
Input device added: "HDA Intel Line Out CLFE" "/dev/input/event9" QFlags(0x20)
Input device added: "AT Translated Set 2 keyboard" "/dev/input/event2" QFlags(0x1|0x10)
shm_open() failed: Permiso denegado
qml: Loaded 5 UA override(s) from file:///usr/lib/x86_64-linux-gnu/qt5/qml/Ubuntu/Web/ua-overrides-desktop.js
TouchSelectionController::active is deprecated, use TouchSelectionController::status instead
[PERFORMANCE]: Last frame took 55 ms to render.
[1010/141119:ERROR:layer_tree_host_impl.cc(2250)] Forcing zero-copy tile initialization as worker context is missing
QNetworkManagerInterface::QNetworkManagerInterface(QObject*) propsReply "An AppArmor policy prevents this sender from sending this message to this recipient; type=\"method_call\", sender=\":1.79\" (uid=1000 pid=2828 comm=\"webbrowser-app \") interface=\"org.freedesktop.DBus.Properties\" member=\"GetAll\" error name=\"(unset)\" requested_reply=\"0\" destination=\"org.freedesktop.NetworkManager\" (uid=0 pid=920 comm=\"/usr/sbin/NetworkManager --no-daemon \")"
QNetworkManagerInterface::QNetworkManagerInterface(QObject*) nmReply "An AppArmor policy prevents this sender from sending this message to this recipient; type=\"method_call\", sender=\":1.79\" (uid=1000 pid=2828 comm=\"webbrowser-app \") interface=\"org.freedesktop.NetworkManager\" member=\"GetDevices\" error name=\"(unset)\" requested_reply=\"0\" destination=\"org.freedesktop.NetworkManager\" (uid=0 pid=920 comm=\"/usr/sbin/NetworkManager --no-daemon \")"
"Object path cannot be empty"
Violación de segmento (`core' generado)

[Olivier Tilloy (osomon)]

I’ve been able to partially retrace the attached crash in a xenial VM.
The top of the stacktrace looks like this:

#0 0x00007f34785ad06c in pushbuf_kref (push=push@entry=0x5562e3e8adc0, bo=0x0, flags=<optimized out>) at ../../nouveau/pushbuf.c:167
#1 0x0007f34785ad709 in pushbuf_validate (push=0x5562e3e8adc0, retry=<optimized out>) at ../../nouveau/pushbuf.c:506
#2 0x0007f34737a8926 in ?? ()
   from /usr/lib/x86_64-linux-gnu/dri/nouveau_dri.so