The most dominant crashes are:

	cras_tm_call_callbacks-c15fb7e9          53.85%
	profile_switch_delay_cb-2d4746a0         33.33%

This seems to be
https://chromium-review.googlesource.com/344123
which add a cras_tm_create_timer which calls profile_switch_delay_cb.

Another CL in R52 related to profile switch might be related too:
https://chromium-review.googlesource.com/354793

Other crashes are similar to R51 and far less than above two.

Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

We've still got enough time to fix this crash before 53.  Shut up, sheriffbot.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/adhd/+/9328255777f233fa007da1375edfa3f416a0c231

commit 9328255777f233fa007da1375edfa3f416a0c231
Author: Hsin-Yu Chao <hychao@chromium.org>
Date: Tue Aug 02 11:21:45 2016

CRAS: bt_device - Free timer when device destroyed

In some scenario bluetoothd could ask CRAS to reset bt device
objects, when a scheduled timer later access the freed memory
CRAS would crash. This change tries to fix this the crash by
tracking the profile switch timer and free it when device is
going to destroy.

BUG= chromium:632429 
TEST=Manual test with BT headset, switch between A2DP and HFP.

Change-Id: Iabd722ffabc887248a34a93ab3d04c74157f834e
Reviewed-on: https://chromium-review.googlesource.com/365506
Commit-Ready: Hsinyu Chao <hychao@chromium.org>
Tested-by: Hsinyu Chao <hychao@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>

[modify] https://crrev.com/9328255777f233fa007da1375edfa3f416a0c231/cras/src/server/cras_bt_device.c

Your change meets the bar and is auto-approved for M53 (branch: 2785)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/adhd/+/e894c9e88a293222a30299c871d63fb86e358cc6

commit e894c9e88a293222a30299c871d63fb86e358cc6
Author: Hsin-Yu Chao <hychao@chromium.org>
Date: Tue Aug 02 11:21:45 2016

CRAS: bt_device - Free timer when device destroyed

In some scenario bluetoothd could ask CRAS to reset bt device
objects, when a scheduled timer later access the freed memory
CRAS would crash. This change tries to fix this the crash by
tracking the profile switch timer and free it when device is
going to destroy.

BUG= chromium:632429 
TEST=Manual test with BT headset, switch between A2DP and HFP.

Change-Id: Iabd722ffabc887248a34a93ab3d04c74157f834e
Reviewed-on: https://chromium-review.googlesource.com/365506
Commit-Ready: Hsinyu Chao <hychao@chromium.org>
Tested-by: Hsinyu Chao <hychao@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
(cherry picked from commit 9328255777f233fa007da1375edfa3f416a0c231)
Reviewed-on: https://chromium-review.googlesource.com/367303
Tested-by: Dylan Reid <dgreid@chromium.org>

[modify] https://crrev.com/e894c9e88a293222a30299c871d63fb86e358cc6/cras/src/server/cras_bt_device.c

Will this fix the majority of the crashes showing up on the crash server?

Yes I believe so. Since this timer was added since M52 which corresponds to when the crash started.
I'll watch for one more week to see if the crash still happen.

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I will do the verify work to see if the crash still happen.

Close this as the profile_switch_delay_cb-2d4746a0 crash disappears.
However there's still crash around cras_tm_call_callback, will use a different issue to track.