@tott, r401058, linux

Start chromium, open a tab to chrome://chrome-signin
Open settings in a new tab by visiting chrome://settings, then Languages -> Language and Input settings.

I have two languages listed there:
Select one and toggle the checkbox "Use this language for spell checking", observe chrome-signin renderer/tab crash [1]. If you reload the signin tab, it crashes entire browser [2].

Speculatively also adding browser-tag label cause it seems webview related.

[1]
[39931:39931:0621/132804:FATAL:WebRemoteFrameImpl.cpp(402)] Check failed: false. 
#0 0x7f702db9ddbe base::debug::StackTrace::StackTrace()
#1 0x7f702dbbe6fb logging::LogMessage::~LogMessage()
#2 0x7f70283062f5 blink::WebRemoteFrameImpl::removeSpellingMarkers()
#3 0x7f702fa446cc SpellCheckProvider::SpellCheckProvider()
#4 0x7f702fa00f00 ChromeContentRendererClient::RenderViewCreated()
#5 0x7f702bd9dd7a content::RenderViewImpl::Initialize()
#6 0x7f702bd9ffbe content::RenderViewImpl::Create()
#7 0x7f702bd98c9e _ZN3IPC8MessageTI16ViewMsg_New_MetaSt5tupleIJ18ViewMsg_New_ParamsEEvE8DispatchIN7content16RenderThreadImplES8_vMS8_FvRKS3_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#8 0x7f702bd98321 content::RenderThreadImpl::OnControlMessageReceived()
#9 0x7f702b254acb content::ChildThreadImpl::OnMessageReceived()
#10 0x7f702a97dbb5 IPC::ChannelProxy::Context::OnDispatchMessage()
#11 0x7f702db9eff9 base::debug::TaskAnnotator::RunTask()
#12 0x7f7023be8947 scheduler::TaskQueueManager::ProcessTaskFromWorkQueue()
#13 0x7f7023be76c5 scheduler::TaskQueueManager::DoWork()
#14 0x7f702db9eff9 base::debug::TaskAnnotator::RunTask()
#15 0x7f702dbc8ff5 base::MessageLoop::RunTask()
#16 0x7f702dbc9328 base::MessageLoop::DeferOrRunPendingTask()
#17 0x7f702dbc96bb base::MessageLoop::DoWork()
#18 0x7f702dbcafee base::MessagePumpDefault::Run()
#19 0x7f702dbc8ae1 base::MessageLoop::RunHandler()
#20 0x7f702dbf7c00 base::RunLoop::Run()
#21 0x7f702dbc7b10 base::MessageLoop::Run()
#22 0x7f702bdc0f5c content::RendererMain()
#23 0x7f702bed51be content::RunZygote()
#24 0x7f702bed5a62 content::RunNamedProcessTypeMain()
#25 0x7f702bed64b3 content::ContentMainRunnerImpl::Run()
#26 0x7f702bed4d80 content::ContentMain()
#27 0x7f702e3c31bb ChromeMain
#28 0x7f702484ff45 __libc_start_main
#29 0x7f702e3c3099 <unknown>


[2]
#0 0x7fdb68001dbe base::debug::StackTrace::StackTrace()
#1 0x7fdb680226fb logging::LogMessage::~LogMessage()
#2 0x7fdb68ebe2b0 extensions::(anonymous namespace)::KillBadMessageSender()
#3 0x7fdb68ebe15b extensions::(anonymous namespace)::CommonResponseCallback()
#4 0x7fdb68ebce16 extensions::(anonymous namespace)::IOThreadResponseCallback()
#5 0x7fdb68ebed66 _ZN4base8internal7InvokerINS_13IndexSequenceIJLm0ELm1ELm2EEEENS0_9BindStateINS0_15RunnableAdapterIPFvRKNS_7WeakPtrIN10extensions30IOThreadExtensionMessageFilterEEEiiN17ExtensionFunction12ResponseTypeERKNS_9ListValueERKSsNS7_9functions14HistogramValueEEEESL_JRS9_RiRKiEEELb0EFvSD_SG_SI_SK_EE3RunEPNS0_13BindStateBaseEOSD_SG_SI_OSK_
#6 0x7fdb68ebb32b ExtensionFunction::SendResponseImpl()
#7 0x7fdb68ebbf58 IOThreadExtensionFunction::SendResponse()
#8 0x7fdb68ebc6d2 (anonymous namespace)::RespondNowAction::Execute()
#9 0x7fdb68ebcaf0 extensions::ExtensionFunctionDispatcher::DispatchOnIOThread()
#10 0x7fdb68efbc84 extensions::IOThreadExtensionMessageFilter::OnExtensionRequestForIOThread()
#11 0x7fdb68efba91 _ZN3IPC8MessageTI40ExtensionHostMsg_RequestForIOThread_MetaSt5tupleIJi31ExtensionHostMsg_Request_ParamsEEvE8DispatchIN10extensions30IOThreadExtensionMessageFilterES8_vMS8_FviRKS3_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#12 0x7fdb68efb455 extensions::IOThreadExtensionMessageFilter::OnMessageReceived()
#13 0x7fdb6567d137 content::BrowserMessageFilter::Internal::DispatchMessage()
#14 0x7fdb6567d01e content::BrowserMessageFilter::Internal::OnMessageReceived()
#15 0x7fdb64df091d IPC::MessageFilterRouter::TryFilters()
#16 0x7fdb64de196f IPC::ChannelProxy::Context::TryFilters()
#17 0x7fdb64de1a8f IPC::ChannelProxy::Context::OnMessageReceived()
#18 0x7fdb5df46fc5 IPC::ChannelMojo::OnMessageReceived()
#19 0x7fdb5df49a7b IPC::internal::MessagePipeReader::Receive()
#20 0x7fdb5df5b1ca IPC::mojom::ChannelStub::Accept()
#21 0x7fdb5df4e500 mojo::internal::InterfaceEndpointClient::HandleValidatedMessage()
#22 0x7fdb5df5b631 IPC::mojom::ChannelRequestValidator::Accept()
#23 0x7fdb5df4f42c mojo::internal::InterfaceEndpointClient::HandleIncomingMessage()
#24 0x7fdb5df544b8 mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#25 0x7fdb5df53f66 mojo::internal::MultiplexRouter::Accept()
#26 0x7fdb5df516a1 mojo::internal::MessageHeaderValidator::Accept()
#27 0x7fdb5df4d595 mojo::internal::Connector::ReadSingleMessage()
#28 0x7fdb5df4da34 mojo::internal::Connector::OnHandleReadyInternal()
#29 0x7fdb5df5decc mojo::Watcher::OnHandleReady()
#30 0x7fdb63421acf mojo::edk::Watcher::MaybeInvokeCallback()
#31 0x7fdb6341be33 mojo::edk::RequestContext::~RequestContext()
#32 0x7fdb6340ffc4 mojo::edk::NodeChannel::OnChannelMessage()
#33 0x7fdb633fc855 mojo::edk::Channel::OnReadComplete()
#34 0x7fdb633fdb78 mojo::edk::(anonymous namespace)::ChannelPosix::OnFileCanReadWithoutBlocking()
#35 0x7fdb6803043b base::MessagePumpLibevent::OnLibeventNotification()
#36 0x7fdb680c8907 event_base_loop
#37 0x7fdb68030726 base::MessagePumpLibevent::Run()
#38 0x7fdb6802cae1 base::MessageLoop::RunHandler()
#39 0x7fdb6805bc00 base::RunLoop::Run()
#40 0x7fdb6802bb10 base::MessageLoop::Run()
#41 0x7fdb6598c7b6 content::BrowserThreadImpl::IOThreadRun()
#42 0x7fdb6598c9c1 content::BrowserThreadImpl::Run()
#43 0x7fdb68090b2b base::Thread::ThreadMain()
#44 0x7fdb6808a475 base::(anonymous namespace)::ThreadFunc()
#45 0x7fdb602fe184 start_thread
#46 0x7fdb5ed8c37d clone