I can reliably cause Emacs to segfault with my current config and
installed packages with the following steps specific to my system:

0. C-x p p (project-switch-project)
1. Select a checkout of https://github.com/kyleam/bog,
   using Ivy completion.
2. m (magit-project-status)

This tries to pop up a new frame (I have pop-up-frames non-nil) with
some recently introduced warning about bug-reference-bug-regexp.  I know
this is what it tries to do only because Emacs didn't segfault the first
time it happened, whereas now the segfault happens every time, before I
get a chance to read the warning.

I think there was some work on Magit recently relating to
bug-reference-mode, but I haven't updated my packages in a few days, so
it is possible that the warning has already been fixed upstream.  I will
therefore hold off on updating my packages until this segfault is fixed.

The attached GDB log for this session shows that the assertion that the
face cache (of the frame displaying Magit) is nonempty is tripped.

I have to run now, but I'll keep GDB running, and I'd be grateful for
help debugging this.

Thanks,

-- 
Basil