I get the below renderer crash when opening Chrome settings with Chromevox on (Lois TTS). Should be easy for someone to repro (100% here)

Linux, debug build.



[1:1:0203/084926.994134:FATAL:FlatTreeTraversal.h(127)] Check failed: !node.needsDistributionRecalc(). 
#0 0x7fa05f77c3fb base::debug::StackTrace::StackTrace()
#1 0x7fa05f77aa3c base::debug::StackTrace::StackTrace()
#2 0x7fa05f7e56ff logging::LogMessage::~LogMessage()
#3 0x7fa045548de7 blink::FlatTreeTraversal::assertPrecondition()
#4 0x7fa045548d09 blink::FlatTreeTraversal::parent()
#5 0x7fa045791536 blink::LayoutTreeBuilderTraversal::parent()
#6 0x7fa0455fc4d9 blink::ElementResolveContext::ElementResolveContext()
#7 0x7fa0456351da blink::StyleResolver::styleForElement()
#8 0x7fa043d03b9c blink::AXObject::isHiddenForTextAlternativeCalculation()
#9 0x7fa043cf106a blink::AXNodeObject::nameFromLabelElement()
#10 0x7fa043ce70fe blink::AXNodeObject::computeAccessibilityIsIgnored()
#11 0x7fa043d0263c blink::AXObject::updateCachedAttributeValuesIfNeeded()
#12 0x7fa043d024c9 blink::AXObject::accessibilityIsIgnored()
#13 0x7fa043d13390 blink::AXObjectCacheImpl::getOrCreate()
#14 0x7fa043cf17de blink::AXNodeObject::computeParent()
#15 0x7fa043d030fa blink::AXObject::parentObject()
#16 0x7fa043d031b8 blink::AXObject::ariaHiddenRoot()
#17 0x7fa043d028d6 blink::AXObject::computeIsInertOrAriaHidden()
#18 0x7fa043d02560 blink::AXObject::updateCachedAttributeValuesIfNeeded()
#19 0x7fa043d024c9 blink::AXObject::accessibilityIsIgnored()
#20 0x7fa043d13390 blink::AXObjectCacheImpl::getOrCreate()
#21 0x7fa043cf17de blink::AXNodeObject::computeParent()
#22 0x7fa043d030fa blink::AXObject::parentObject()
#23 0x7fa043d031b8 blink::AXObject::ariaHiddenRoot()
#24 0x7fa043d028d6 blink::AXObject::computeIsInertOrAriaHidden()
#25 0x7fa043d02560 blink::AXObject::updateCachedAttributeValuesIfNeeded()
#26 0x7fa043d024c9 blink::AXObject::accessibilityIsIgnored()
#27 0x7fa043d13390 blink::AXObjectCacheImpl::getOrCreate()
#28 0x7fa043d16b7f blink::AXObjectCacheImpl::handleAriaRoleChanged()
#29 0x7fa043d16c19 blink::AXObjectCacheImpl::handleAttributeChanged()
#30 0x7fa045736190 blink::Element::attributeChanged()
#31 0x7fa045bcab57 blink::HTMLElement::attributeChanged()
#32 0x7fa045b98fa7 blink::HTMLAnchorElement::attributeChanged()
#33 0x7fa04573d8e3 blink::Element::didAddAttribute()
#34 0x7fa04573d825 blink::Element::appendAttributeInternal()
#35 0x7fa045746956 blink::Element::setAttributeInternal()
#36 0x7fa045735c38 blink::Element::setAttribute()
#37 0x7fa046852196 blink::ElementV8Internal::setAttributeMethod()
#38 0x7fa046851c82 blink::V8Element::setAttributeMethodCallback()
#39 0x7fa0504b412b v8::internal::FunctionCallbackArguments::Call()
#40 0x7fa0505830a3 v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
#41 0x7fa050581be0 v8::internal::Builtin_Impl_HandleApiCall()
#42 0x1fd0aa28420e <unknown>

Received signal 6
#0 0x7fa05f77c3fb base::debug::StackTrace::StackTrace()
#1 0x7fa05f77aa3c base::debug::StackTrace::StackTrace()
#2 0x7fa05f77bf0f base::debug::(anonymous namespace)::StackDumpSignalHandler()
#3 0x7fa05fbe3330 <unknown>
#4 0x7fa04b98dc37 gsignal
#5 0x7fa04b991028 abort
#6 0x7fa05f7787b6 base::debug::(anonymous namespace)::DebugBreak()
#7 0x7fa05f778798 base::debug::BreakDebugger()
#8 0x7fa05f7e5a96 logging::LogMessage::~LogMessage()
#9 0x7fa045548de7 blink::FlatTreeTraversal::assertPrecondition()
#10 0x7fa045548d09 blink::FlatTreeTraversal::parent()
#11 0x7fa045791536 blink::LayoutTreeBuilderTraversal::parent()
#12 0x7fa0455fc4d9 blink::ElementResolveContext::ElementResolveContext()
#13 0x7fa0456351da blink::StyleResolver::styleForElement()
#14 0x7fa043d03b9c blink::AXObject::isHiddenForTextAlternativeCalculation()
#15 0x7fa043cf106a blink::AXNodeObject::nameFromLabelElement()
#16 0x7fa043ce70fe blink::AXNodeObject::computeAccessibilityIsIgnored()
#17 0x7fa043d0263c blink::AXObject::updateCachedAttributeValuesIfNeeded()
#18 0x7fa043d024c9 blink::AXObject::accessibilityIsIgnored()
#19 0x7fa043d13390 blink::AXObjectCacheImpl::getOrCreate()
#20 0x7fa043cf17de blink::AXNodeObject::computeParent()
#21 0x7fa043d030fa blink::AXObject::parentObject()
#22 0x7fa043d031b8 blink::AXObject::ariaHiddenRoot()
#23 0x7fa043d028d6 blink::AXObject::computeIsInertOrAriaHidden()
#24 0x7fa043d02560 blink::AXObject::updateCachedAttributeValuesIfNeeded()
#25 0x7fa043d024c9 blink::AXObject::accessibilityIsIgnored()
#26 0x7fa043d13390 blink::AXObjectCacheImpl::getOrCreate()
#27 0x7fa043cf17de blink::AXNodeObject::computeParent()
#28 0x7fa043d030fa blink::AXObject::parentObject()
#29 0x7fa043d031b8 blink::AXObject::ariaHiddenRoot()
#30 0x7fa043d028d6 blink::AXObject::computeIsInertOrAriaHidden()
#31 0x7fa043d02560 blink::AXObject::updateCachedAttributeValuesIfNeeded()
#32 0x7fa043d024c9 blink::AXObject::accessibilityIsIgnored()
#33 0x7fa043d13390 blink::AXObjectCacheImpl::getOrCreate()
#34 0x7fa043d16b7f blink::AXObjectCacheImpl::handleAriaRoleChanged()
#35 0x7fa043d16c19 blink::AXObjectCacheImpl::handleAttributeChanged()
#36 0x7fa045736190 blink::Element::attributeChanged()
#37 0x7fa045bcab57 blink::HTMLElement::attributeChanged()
#38 0x7fa045b98fa7 blink::HTMLAnchorElement::attributeChanged()
#39 0x7fa04573d8e3 blink::Element::didAddAttribute()
#40 0x7fa04573d825 blink::Element::appendAttributeInternal()
#41 0x7fa045746956 blink::Element::setAttributeInternal()
#42 0x7fa045735c38 blink::Element::setAttribute()
#43 0x7fa046852196 blink::ElementV8Internal::setAttributeMethod()
#44 0x7fa046851c82 blink::V8Element::setAttributeMethodCallback()
#45 0x7fa0504b412b v8::internal::FunctionCallbackArguments::Call()
#46 0x7fa0505830a3 v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
#47 0x7fa050581be0 v8::internal::Builtin_Impl_HandleApiCall()
#48 0x1fd0aa28420e <unknown>
  r8: 00007ffd3f569a90  r9: 00007fa04baa7a00 r10: 0000000000000008 r11: 0000000000000202
 r12: 0000000000000000 r13: 00007ffd3f56d688 r14: 000036153d08b020 r15: 00007fa046851c50
  di: 0000000000000001  si: 0000000000000001  bp: 00007ffd3f569e80  bx: 00007ffd3f56d600
  dx: 0000000000000006  ax: 0000000000000000  cx: ffffffffffffffff  sp: 00007ffd3f569d48
  ip: 00007fa04b98dc37 efl: 0000000000000202 cgf: 0000000000000033 erf: 0000000000000000
 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]