Another crash on 57.0.2952.0 canary (64-bit)

rax=000000000b6cda01 rbx=0000021a2f7219c8 rcx=0000000003bce9a8
rdx=0000021a2f77ef48 rsi=0000000000000001 rdi=000002f2fdb40900
rip=000007feefa22823 rsp=000000000b6cda10 rbp=000000000b6cda60
 r8=000000017f5d4330  r9=000002052f6fee08 r10=000007feedfb9df8
r11=000000000b6cda60 r12=0000000000000000 r13=000007feedd76774
r14=0000021a2f7219c8 r15=00000000000000e8
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=0000  ds=0000  es=0000  fs=0053  gs=002b             efl=00010206
*** WARNING: Unable to verify checksum for chrome_child.dll
chrome_child!blink::TraceTrait<blink::FetchEvent>::trace+0x157:
000007fe`efa22823 498b4008        mov     rax,qword ptr [r8+8] ds:00000001`7f5d4338=????????????????
0:014> k
  *** Stack trace for last set context - .thread/.cxr resets it
Child-SP          RetAddr           Call Site
00000000`0b6cda10 000007fe`efa21db7 chrome_child!blink::TraceTrait<blink::FetchEvent>::trace+0x157 [c:\b\build\slave\win64-pgo\build\src\third_party\webkit\source\platform\heap\tracetraits.h @ 236]
00000000`0b6cda80 000007fe`edbdb4f0 chrome_child!blink::VisitorHelper<blink::Visitor>::mark<blink::FetchEvent>+0x53 [c:\b\build\slave\win64-pgo\build\src\third_party\webkit\source\platform\heap\visitor.h @ 152]
00000000`0b6cdab0 000007fe`edbdb36a chrome_child!v8::internal::GlobalHandles::IterateAllRootsWithClassIds+0x180 [c:\b\build\slave\win64-pgo\build\src\v8\src\global-handles.cc @ 1122]
00000000`0b6cdf30 000007fe`edbdb33f chrome_child!v8::Isolate::VisitHandlesWithClassIds+0x26 [c:\b\build\slave\win64-pgo\build\src\v8\src\api.cc @ 8551]
00000000`0b6cdf70 000007fe`edbdb2e7 chrome_child!blink::V8GCController::traceDOMWrappers+0x1f [c:\b\build\slave\win64-pgo\build\src\third_party\webkit\source\bindings\core\v8\v8gccontroller.cpp @ 490]
00000000`0b6cdfb0 000007fe`edbdc977 chrome_child!blink::ThreadState::visitPersistents+0x5f [c:\b\build\slave\win64-pgo\build\src\third_party\webkit\source\platform\heap\threadstate.cpp @ 462]
00000000`0b6ce020 000007fe`edbde25a chrome_child!blink::ThreadHeap::visitPersistentRoots+0x7f [c:\b\build\slave\win64-pgo\build\src\third_party\webkit\source\platform\heap\heap.cpp @ 622]
00000000`0b6ce0a0 000007fe`edc47483 chrome_child!blink::ThreadState::collectGarbage+0x13e [c:\b\build\slave\win64-pgo\build\src\third_party\webkit\source\platform\heap\threadstate.cpp @ 1772]
00000000`0b6ce1a0 000007fe`edc45510 chrome_child!blink::NormalPageArena::outOfLineAllocate+0x8b [c:\b\build\slave\win64-pgo\build\src\third_party\webkit\source\platform\heap\heappage.cpp @ 958]
00000000`0b6ce1d0 000007fe`ee06a4ef chrome_child!blink::ThreadHeap::allocateOnArenaIndex+0xa0 [c:\b\build\slave\win64-pgo\build\src\third_party\webkit\source\platform\heap\heap.h @ 632]
00000000`0b6ce200 000007fe`f03489b9 chrome_child!blink::ScriptPromisePropertyBase::operator new+0x47 [c:\b\build\slave\win64-pgo\build\src\third_party\webkit\source\bindings\core\v8\scriptpromisepropertybase.h @ 29]
00000000`0b6ce240 000007fe`f025d0a2 chrome_child!blink::FetchEvent::FetchEvent+0x51 [c:\b\build\slave\win64-pgo\build\src\third_party\webkit\source\modules\serviceworkers\fetchevent.cpp @ 75]
00000000`0b6ce2b0 000007fe`efb45709 chrome_child!blink::ServiceWorkerGlobalScopeProxy::dispatchFetchEvent+0x25e [c:\b\build\slave\win64-pgo\build\src\third_party\webkit\source\web\serviceworkerglobalscopeproxy.cpp @ 183]
00000000`0b6ce570 000007fe`eeae4fae chrome_child!content::ServiceWorkerContextClient::DispatchFetchEvent+0x449 [c:\b\build\slave\win64-pgo\build\src\content\renderer\service_worker\service_worker_context_client.cc @ 1032]
00000000`0b6cea30 000007fe`edd113cf chrome_child!content::mojom::ServiceWorkerEventDispatcherStubDispatch::AcceptWithResponder+0x49a [c:\b\build\slave\win64-pgo\build\src\out\release_x64\gen\content\common\service_worker\service_worker_event_dispatcher.mojom.cc @ 693]
00000000`0b6cedc0 000007fe`edd09baa chrome_child!mojo::InterfaceEndpointClient::HandleValidatedMessage+0x16b [c:\b\build\slave\win64-pgo\build\src\mojo\public\cpp\bindings\lib\interface_endpoint_client.cc @ 314]
00000000`0b6cee40 000007fe`edf95d2a chrome_child!mojo::FilterChain::Accept+0x7a [c:\b\build\slave\win64-pgo\build\src\mojo\public\cpp\bindings\lib\filter_chain.cc @ 40]
00000000`0b6cee70 000007fe`ee007668 chrome_child!mojo::internal::MultiplexRouter::ProcessIncomingMessage+0xb2 [c:\b\build\slave\win64-pgo\build\src\mojo\public\cpp\bindings\lib\multiplex_router.cc @ 838]
00000000`0b6ceeb0 000007fe`edd09b8c chrome_child!mojo::internal::MultiplexRouter::Accept+0x64 [c:\b\build\slave\win64-pgo\build\src\mojo\public\cpp\bindings\lib\multiplex_router.cc @ 547]
00000000`0b6cef00 000007fe`edcc898b chrome_child!mojo::FilterChain::Accept+0x5c [c:\b\build\slave\win64-pgo\build\src\mojo\public\cpp\bindings\lib\filter_chain.cc @ 41]

Crash ID 77e928ea-0f48-4741-9a25-1f3e4e426125 (Server ID: 66f9d50080000000).

Crash log suggests maybe the same root cause as  Issue 655926 

Thanks for the report. A dump alone is much less useful for us to make progress than some kind of reproduction case, but it may still be helpful. As noted in c#3, this does look like a dup of  issue 655926 .

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot