Assigning to the concern owner from Predator results --
The result is a list of CLs that change the crashed files. 

Author: jbroman@chromium.org
Project: chromium-blink
Changelist: https://chromium.googlesource.com/chromium/blink.git/+/7f688524727f7c105af53a61654e9bb83525dfac
Time: Tue Jul 14 17:56:30 2015
File HarfBuzzShaper.cpp is changed in this cl (and is part of stack frame #3, "blink::"; frame #4, "blink::HarfBuzzShaper::shapeSegment"; frame #5, "blink::HarfBuzzShaper::shape"; frame #6, "blink::HarfBuzzShaper::shape")
Minimum distance from crash line to modified line: 8. (file: HarfBuzzShaper.cpp, crashed on: 718, modified: 726). 

Author: eae@chromium.org
Project: chromium-blink
Changelist: https://chromium.googlesource.com/chromium/blink.git/+/438098ac6cf2fdc1b7caff1cd47f02e0606f1920
Time: Tue Jul 14 18:37:19 2015
File HarfBuzzShaper.cpp is changed in this cl (and is part of stack frame #3, "blink::"; frame #4, "blink::HarfBuzzShaper::shapeSegment"; frame #5, "blink::HarfBuzzShaper::shape"; frame #6, "blink::HarfBuzzShaper::shape")
Minimum distance from crash line to modified line: 75. (file: HarfBuzzShaper.cpp, crashed on: 144, modified: 69).

@jbroman -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

The repro uses the extension font API to clear the default font, it then hits an assert where no default font is available. This is to be expected.