Chrome Version: 57.0.2952.0/9090.0.0 Falco,Paine and Gnawty
OS: Chrome

What steps will reproduce the problem?
(1)Sign into User -> select ChromeVox(spoken feedback) option from 'Accessibility' at uber Tray
(2)Now Click on 'Sign out' button at Uber Tray -> Now again Sign in and observe Browser Crash (Please refer Video)

Below is the Crash Id:
674e2b0080000000

Expected: No Crash should be seen
Actual: Instead Browser Crash is seen on clicking 'Sign out' button 

This is Regression Issue as same is working fine in 56.0.2924.27/9000.28.0 Beta channel Peppy.

@tbuckley- Please confirm the Issue.

Stack Trace:

Thread 0 CRASHED [SIGABRT @ 0x000003e800000dad ] MAGIC SIGNATURE THREAD
Stack Quality98%Show frame trust levels

0x00007fa9731c4b82	(libc-2.19.so -raise.c:56)	raise
0x00007fa9731c689f	(libc-2.19.so -abort.c:89)	abort
0x00007fa973ac3624	(libstdc++.so.6.0.20 -vterminate.cc:95)	__gnu_cxx::__verbose_terminate_handler()
0x00007fa973ac1365	(libstdc++.so.6.0.20 -eh_terminate.cc:47)	__cxxabiv1::__terminate(void (*)())
0x00007fa973ac13b0	(libstdc++.so.6.0.20 -eh_terminate.cc:57)	std::terminate()
0x00007fa973ac1620	(libstdc++.so.6.0.20 -eh_throw.cc:87)	__cxxabiv1::__cxa_throw
0x00007fa973b1e5d0	(libstdc++.so.6.0.20 -functexcept.cc:101)	std::__throw_out_of_range_fmt(char const*, ...)
0x00007fa978cab868	(chrome -stl_vector.h:898)	BrowserView::GetAccessibleWindowTitle() const
0x00007fa9783f805e	(chrome -root_view.cc:599)	views::internal::RootView::GetAccessibleNodeData(ui::AXNodeData*)
0x00007fa97a7e8550	(chrome -ax_view_obj_wrapper.cc:50)	views::AXViewObjWrapper::Serialize(ui::AXNodeData*)
0x00007fa978ce8dc8	(chrome -ax_tree_source_aura.cc:119)	AXTreeSourceAura::SerializeNode(views::AXAuraObjWrapper*, ui::AXNodeData*) const
0x00007fa978ce76d5	(chrome -ax_tree_serializer.h:496)	ui::AXTreeSerializer<views::AXAuraObjWrapper*, ui::AXNodeData, ui::AXTreeData>::SerializeChangedNodes(views::AXAuraObjWrapper*, ui::AXTreeUpdateBase<ui::AXNodeData, ui::AXTreeData>*)
0x00007fa978ce80e3	(chrome -ax_tree_serializer.h:382)	ui::AXTreeSerializer<views::AXAuraObjWrapper*, ui::AXNodeData, ui::AXTreeData>::SerializeChanges(views::AXAuraObjWrapper*, ui::AXTreeUpdateBase<ui::AXNodeData, ui::AXTreeData>*)
0x00007fa978ce8351	(chrome -automation_manager_aura.cc:187)	AutomationManagerAura::SendEvent(content::BrowserContext*, views::AXAuraObjWrapper*, ui::AXEvent)
0x00007fa97a7e79e9	(chrome -ax_aura_obj_cache.cc:84)	views::AXAuraObjCache::Remove(aura::Window*, aura::Window*)
0x00007fa97807bff4	(chrome -window.cc:956)	aura::Window::NotifyWindowHierarchyChangeAtReceiver(aura::WindowObserver::HierarchyChangeParams const&)
0x00007fa97807c0f7	(chrome -window.cc:931)	aura::Window::NotifyWindowHierarchyChangeDown(aura::WindowObserver::HierarchyChangeParams const&)
0x00007fa97807c152	(chrome -window.cc:916)	aura::Window::NotifyWindowHierarchyChange(aura::WindowObserver::HierarchyChangeParams const&)
0x00007fa97807c7c1	(chrome -window.cc:402)	aura::Window::RemoveChild(aura::Window*)
0x00007fa97807d036	(chrome -window.cc:114)	aura::Window::~Window()
0x00007fa97807d2e0	(chrome -window.cc:140)	aura::Window::~Window()
0x00007fa9767ca370	(chrome -render_widget_host_impl.cc:1682)	content::RenderWidgetHostImpl::Destroy(bool)
0x00007fa9767bf469	(chrome -render_view_host_impl.cc:803)	content::RenderViewHostImpl::ShutdownAndDestroy()
0x00007fa976669084	(chrome -frame_tree.cc:365)	content::FrameTree::ReleaseRenderViewHostRef(content::RenderViewHostImpl*)
0x00007fa97668e059	(chrome -render_frame_host_impl.cc:439)	content::RenderFrameHostImpl::~RenderFrameHostImpl()
0x00007fa97668e420	(chrome -render_frame_host_impl.cc:440)	content::RenderFrameHostImpl::~RenderFrameHostImpl()
0x00007fa976694e65	(chrome -unique_ptr.h:76)	content::RenderFrameHostManager::~RenderFrameHostManager()
0x00007fa97666ad15	(chrome -frame_tree_node.cc:121)	content::FrameTreeNode::~FrameTreeNode()
0x00007fa97666811a	(chrome -frame_tree.cc:116)	content::FrameTree::~FrameTree()
0x00007fa9768802f8	(chrome -web_contents_impl.cc:477)	content::WebContentsImpl::~WebContentsImpl()
0x00007fa976880510	(chrome -web_contents_impl.cc:576)	content::WebContentsImpl::~WebContentsImpl()
0x00007fa97708a0f9	(chrome -browser_close_manager.cc:179)	BrowserCloseManager::CloseBrowsers()
0x00007fa976f9c326	(chrome -application_lifetime.cc:156)	chrome::CloseAllBrowsers()
0x00007fa976f9b9bf	(chrome -application_lifetime.cc:112)	chrome::AttemptExitInternal(bool)
0x00007fa976f9ba77	(chrome -application_lifetime.cc:281)	chrome::ExitCleanly()
0x00007fa97707e0da	(chrome -chrome_browser_main_posix.cc:156)	ExitHandler::ExitWhenPossibleOnUIThread
0x00007fa97593c03c	(chrome -callback.h:68)	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x00007fa975923de1	(chrome -message_loop.cc:413)	base::MessageLoop::DoWork()
0x00007fa975924ab2	(chrome -message_pump_libevent.cc:218)	base::MessagePumpLibevent::Run(base::MessagePump::Delegate*)
0x00007fa97728b627	(chrome -run_loop.cc:37)	base::RunLoop::Run()
0x00007fa976f71c05	(chrome -chrome_browser_main.cc:1974)	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x00007fa9765ccc0a	(chrome -browser_main_loop.cc:1086)	content::BrowserMainLoop::RunMainMessageLoopParts()
0x00007fa9765cf874	(chrome -browser_main_runner.cc:141)	content::BrowserMainRunnerImpl::Run()
0x00007fa9765c9a9b	(chrome -browser_main.cc:46)	content::BrowserMain(content::MainFunctionParams const&)
0x00007fa976f12849	(chrome -content_main_runner.cc:793)	content::ContentMainRunnerImpl::Run()
0x00007fa976f114ea	(chrome -content_main.cc:20)	content::ContentMain(content::ContentMainParams const&)
0x00007fa975bb437a	(chrome -chrome_main.cc:109)	ChromeMain
0x00007fa9731affb5	(libc-2.19.so -libc-start.c:292)	__libc_start_main
0x00007fa975bb4190	(chrome+ 0x01243190)	_start
0x00007ffde3af5097	

 

Deleted: Actual_BrowserCrash.mp4 8.8 MB

	Actual_BrowserCrash.mp4 8.8 MB View Download