Yes, and there's nothing much to do here after the fact since you've now got inconsistent data in the history DB - I'm not really the right owner for this since I'm not involved in the history code (I wrote the history sync code in a previous life, and added some data-consistency checks to help track down problems I was seeing in sync).

Could this happen if sync inserts a url with no visits?

I suppose it's possible sync could insert invalid data. The way the code here is written, it seems to think that sync can only get into a bad state if the model type logic here is in a bad state. Looking at https://cs.chromium.org/chromium/src/components/history/core/browser/typed_url_syncable_service.cc?l=938 it seems if you're running a mix of with DCHECKs and without DCHECKs you could have this happen if the model type is buggy.

I am however significantly confused how this logic works with various thresholds and expiration mechanisms, guaranteeing that there's at least one typed visit seems pretty strong, and I don't understand why it'd be true.

grt@, if you provide the account this happened to and written consent I can look into the server side data, to see if anything has been successfully committed that looks suspicious.

Also, when you say it crashes on startup, if you just let it sit there and don't use the browser, doesn't it crash ~9 seconds after initial launch? This would be when Sync starts up if it isn't flared for early, which would probably mean it's in the middle of a merge. Or does it crash significantly earlier, which would mean it was a history driven event that triggered this. Though a stack trace would be even better to have.

Also, if you wanted to attach your History db file I could poke around that as well.

Looks like this is actually the same as  issue 686775 , do you think you could respond there to my questions, grt@?