Hmm. I'm not sure if https://codereview.chromium.org/2556893003 is a culprit since there are also a spike at 54.0.2840.98 and 54.0.2840.71.

I'd like to wait for the next version and see if the spike remains.

Just to update other variants of this magic signature on Mac and Windows canary(57.0.2952.0) spiked from last canary(57.0.2951.0).

Mac canary(57.0.2952.0 - live for 4 hours)
============================================
>base::internal::Dispatcher<content::ServiceWorkerContextObserver, void (content::ServiceWorkerContextObserver::*)(long long, content::EmbeddedWorkerStatus)>::Run 
>base::ObserverListThreadSafe<content::ServiceWorkerContextObserver>::NotifyWrapper
>base::internal::Dispatcher<content::ServiceWorkerContextObserver, void (content::ServiceWorkerContextObserver::*)(long long, int, int)>::Run

Windows canary(57.0.2952.0 - live for 2 hours)
================================================
>base::ObserverListThreadSafe<content::GpuDataManagerObserver>::NotifyWrapper
>base::ObserverListThreadSafe<media::UserInputMonitor::MouseEventListener>::NotifyWrapper

nhiroki@: Could this be related to https://codereview.chromium.org/2466513002 for the MessageEvent related changes from the spike range.

Users experienced this crash on the following builds:

Mac Canary 57.0.2952.0 -  27.81 CPM, 25 reports, 23 clients (signature base::internal::Dispatcher<content::ServiceWorkerContextObserver, void (content::ServiceWorkerContextObserver::*)(long long, content::EmbeddedWorkerStatus)>::Run)
Mac Canary 57.0.2952.0 -  27.27 CPM, 25 reports, 24 clients (signature base::ObserverListThreadSafe<content::ServiceWorkerContextObserver>::NotifyWrapper)
Mac Canary 57.0.2952.0 -  103.62 CPM, 95 reports, 82 clients (signature base::internal::Dispatcher<content::ServiceWorkerContextObserver, void (content::ServiceWorkerContextObserver::*)(long long, GURL const&)>::Run)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

 Issue 674471  has been merged into this issue.

Bisected this as per the test steps of the duped  Issue 674471  on Mac OS 10.11.6.

Last good build: 57.0.2951.0
First bad build: 57.0.2952.0

Changelog:
==========
https://chromium.googlesource.com/chromium/src/+log/0d69452813c95ee10e53b8e83eaceea23a2b1780..b41d221cb138f0f5e3824229f12bf794172e106f

dgozman@: Could you please take a look at these crashes.

As per steps in  issue 674471 , I am able to repro this issue reliably under Windows, Mac and Linux, with:
1. Open a tab.
2. Inspect the page with Developer Tools.
3. Close the tab.
4. Open a new tab.

Under Mac we reliably get ServiceWorkerContextObserver signatures as noted above. FWIW, Mac 32-bit crashes I checked all had a null-deref, whereas 64-bit ones are all hitting bad addresses whose top 32-bits are null.

Under Windows we get a variety of other signatures, mainly GpuDataManagerObserver and Histogram::AddCount. The bogus addresses being access seem more random on Windows, though all the crashes I generated locally were dereferencing 0x10000000000000000.

Under Linux I repro'd the issue in a debug build and got the following:

Program received signal SIGTRAP, Trace/breakpoint trap.
[Switching to Thread 0x7fffc5240700 (LWP 32122)]
base::debug::(anonymous namespace)::DebugBreak () at ../../base/debug/debugger_posix.cc:232
232	}
(gdb) where
#0  base::debug::(anonymous namespace)::DebugBreak () at ../../base/debug/debugger_posix.cc:232
#1  0x00007ffff77623b8 in base::debug::BreakDebugger () at ../../base/debug/debugger_posix.cc:251
#2  0x00007ffff77d38b2 in logging::LogMessage::~LogMessage (this=0x7fffc523ce08) at ../../base/logging.cc:759
#3  0x00007ffff46e8d22 in PrefNotifierImpl::RemovePrefObserver (this=0x3d303681d120, path="alternate_error_pages.enabled", obs=0x3d3037edeac8)
    at ../../components/prefs/pref_notifier_impl.cc:53
#4  0x00007ffff46fa7d4 in PrefService::RemovePrefObserver (this=0x3d3036ef6da0, path="alternate_error_pages.enabled", obs=0x3d3037edeac8)
    at ../../components/prefs/pref_service.cc:361
#5  0x00007ffff46e007b in PrefChangeRegistrar::RemoveAll (this=0x3d3037edeac8) at ../../components/prefs/pref_change_registrar.cc:54
#6  0x00007ffff46dff87 in PrefChangeRegistrar::~PrefChangeRegistrar (this=0x3d3037edeac8) at ../../components/prefs/pref_change_registrar.cc:18
#7  0x000055555940376f in NavigationCorrectionTabObserver::~NavigationCorrectionTabObserver (this=0x3d3037edeaa0)
    at ../../chrome/browser/ui/navigation_correction_tab_observer.cc:53
#8  0x00005555594037f9 in NavigationCorrectionTabObserver::~NavigationCorrectionTabObserver (this=0x3d3037edeaa0)
    at ../../chrome/browser/ui/navigation_correction_tab_observer.cc:52
#9  0x00007ffff1674457 in base::internal::Dispatcher<content::ServiceWorkerContextObserver, void (content::ServiceWorkerContextObserver::*)(long, std::string const&, int, int, content::ServiceWorkerProviderType)>::Run (m=&virtual table offset 64, params=content::SERVICE_WORKER_PROVIDER_FOR_WINDOW, 
    params=content::SERVICE_WORKER_PROVIDER_FOR_WINDOW, params=content::SERVICE_WORKER_PROVIDER_FOR_WINDOW, params=content::SERVICE_WORKER_PROVIDER_FOR_WINDOW, 
    params=content::SERVICE_WORKER_PROVIDER_FOR_WINDOW, obj=0x3d3037edeaa0) at ../../base/observer_list_threadsafe.h:67
#10 0x00007ffff1674a6d in base::internal::FunctorTraits<void (*)(void (content::ServiceWorkerContextObserver::*)(long, std::string const&, int, int, content::ServiceWorkerProviderType), long, std::string const&, int, int, content::ServiceWorkerProviderType, content::ServiceWorkerContextObserver*), void>::Invoke<void (content::ServiceWorkerContextObserver::* const&)(long, std::string const&, int, int, content::ServiceWorkerProviderType), long const&, std::string const&, int const&, int const&, content::ServiceWorkerProviderType const&, content::ServiceWorkerContextObserver*>(void (*)(void (content::ServiceWorkerContextObserver::*)(long, std::string const&, int, int, content::ServiceWorkerProviderType), long, std::string const&, int, int, content::ServiceWorkerProviderType, content::ServiceWorkerContextObserver*), void (content::ServiceWorkerContextObserver::* const&)(long, std::string const&, int, int, content::ServiceWorkerProviderType), long const&, std::string const&, int const&, int const&, content::ServiceWorkerProviderType const&, content::ServiceWorkerContextObserver*&&) (
    function=0x7ffff1674360 <base::internal::Dispatcher<content::ServiceWorkerContextObserver, void (content::ServiceWorkerContextObserver::*)(long, std::string const&, int, int, content::ServiceWorkerProviderType)>::Run(void (content::ServiceWorkerContextObserver::*)(long, std::string const&, int, int, content::ServiceWorkerProviderType), long, std::string const&, int, int, content::ServiceWorkerProviderType, content::ServiceWorkerContextObserver*)>, 
    ...

I'm currently looking into this.

Reverting both https://codereview.chromium.org/2574843003/ and https://codereview.chromium.org/2573993003/ locally helps. Proceeding with reverts for now.

 Issue 674428  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5

commit 2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5
Author: dgozman <dgozman@chromium.org>
Date: Thu Dec 15 22:53:05 2016

Revert of [DevTools] Migrate ServiceWorker domain to new generator. (patchset #2 id:20001 of https://codereview.chromium.org/2573993003/ )

Reason for revert:
Crashes.
BUG= 674474 

Original issue's description:
> [DevTools] Migrate ServiceWorker domain to new generator.
>
> BUG= 664683 
> TBR=pfeldman
>
> Committed: https://crrev.com/b41d221cb138f0f5e3824229f12bf794172e106f
> Cr-Commit-Position: refs/heads/master@{#438676}

TBR=caseq@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 664683 

Review-Url: https://codereview.chromium.org/2577233002
Cr-Commit-Position: refs/heads/master@{#438942}

[modify] https://crrev.com/2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5/content/browser/BUILD.gn
[modify] https://crrev.com/2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5/content/browser/devtools/BUILD.gn
[modify] https://crrev.com/2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5/content/browser/devtools/protocol/devtools_protocol_handler_generator.py
[modify] https://crrev.com/2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5/content/browser/devtools/protocol/service_worker_handler.cc
[modify] https://crrev.com/2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5/content/browser/devtools/protocol/service_worker_handler.h
[modify] https://crrev.com/2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5/content/browser/devtools/protocol_config.json
[modify] https://crrev.com/2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5/content/browser/devtools/render_frame_devtools_agent_host.cc
[modify] https://crrev.com/2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5/content/browser/devtools/render_frame_devtools_agent_host.h

For the record: second revert is https://codereview.chromium.org/2577233002/, landed as https://crrev.com/2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5.

Issue 674761 has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6ac97c212042cc7f4f3b7c3033c8ef4392a133ed

commit 6ac97c212042cc7f4f3b7c3033c8ef4392a133ed
Author: dgozman <dgozman@chromium.org>
Date: Fri Dec 16 03:36:29 2016

[DevTools] Call InnerDetach instead of NotifyDetached in DTAHI::HostClosed.

InnerDetach destroyes the current session and domain handlers, as opposite to
NotifyDetached, which prevents stale pointers and inconsistent state at the time
of DTAHI destruction.

BUG= 674474 

Review-Url: https://codereview.chromium.org/2579923002
Cr-Commit-Position: refs/heads/master@{#439003}

[modify] https://crrev.com/6ac97c212042cc7f4f3b7c3033c8ef4392a133ed/content/browser/devtools/devtools_agent_host_impl.cc
[modify] https://crrev.com/6ac97c212042cc7f4f3b7c3033c8ef4392a133ed/content/shell/browser/shell_devtools_frontend.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b31e7730c9167a6395b702e42fb931002acaca0a

commit b31e7730c9167a6395b702e42fb931002acaca0a
Author: dgozman <dgozman@chromium.org>
Date: Fri Dec 16 04:08:39 2016

Reland of [DevTools] Migrate ServiceWorker domain to new generator. (patchset #1 id:1 of https://codereview.chromium.org/2577233002/ )

Reason for revert:
Fixed crash reason in https://codereview.chromium.org/2579923002/

Original issue's description:
> Revert of [DevTools] Migrate ServiceWorker domain to new generator. (patchset #2 id:20001 of https://codereview.chromium.org/2573993003/ )
>
> Reason for revert:
> Crashes.
> BUG= 674474 
>
> Original issue's description:
> > [DevTools] Migrate ServiceWorker domain to new generator.
> >
> > BUG= 664683 
> > TBR=pfeldman
> >
> > Committed: https://crrev.com/b41d221cb138f0f5e3824229f12bf794172e106f
> > Cr-Commit-Position: refs/heads/master@{#438676}
>
> TBR=caseq@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG= 664683 
>
> Committed: https://crrev.com/2cbd54ce7ac7c807af2c9065a6eedd81ac97a3c5
> Cr-Commit-Position: refs/heads/master@{#438942}

TBR=caseq@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 674474 

Review-Url: https://codereview.chromium.org/2580833004
Cr-Commit-Position: refs/heads/master@{#439015}

[modify] https://crrev.com/b31e7730c9167a6395b702e42fb931002acaca0a/content/browser/BUILD.gn
[modify] https://crrev.com/b31e7730c9167a6395b702e42fb931002acaca0a/content/browser/devtools/BUILD.gn
[modify] https://crrev.com/b31e7730c9167a6395b702e42fb931002acaca0a/content/browser/devtools/protocol/devtools_protocol_handler_generator.py
[modify] https://crrev.com/b31e7730c9167a6395b702e42fb931002acaca0a/content/browser/devtools/protocol/service_worker_handler.cc
[modify] https://crrev.com/b31e7730c9167a6395b702e42fb931002acaca0a/content/browser/devtools/protocol/service_worker_handler.h
[modify] https://crrev.com/b31e7730c9167a6395b702e42fb931002acaca0a/content/browser/devtools/protocol_config.json
[modify] https://crrev.com/b31e7730c9167a6395b702e42fb931002acaca0a/content/browser/devtools/render_frame_devtools_agent_host.cc
[modify] https://crrev.com/b31e7730c9167a6395b702e42fb931002acaca0a/content/browser/devtools/render_frame_devtools_agent_host.h

Verified the revert(C#13) on the latest canary(57.0.2953.0) as per the manual steps from  Issue 674471  and didn't encounter any crash. Revert from C#13 works fine on Windows-10, Mac OS 10.12.2 and Linux Ubuntu 14.04.


Will verify the CLs from C#16(Fix) and C#17(Reland of reverted CL) in next canary as they missed today's canary. 

I've tried to recreate as I've reported on 674471 and is not crashing anymore.

Issue 765137 has been merged into this issue.