To reproduce:

$ git checkout 56.0.2924.87
$ gclient sync
$ git cherry-pick 4401e3859fcf83be0129b269c1a8186dd98634d1
$ git cherry-pick efd3d8ba87ec8266ab1b5c34cfee31c1121f45ca
$ # build chrome
$ tools/perf/run_benchmark v8.browsing_desktop_turbo --story-filter=pinterest --browser=release --extra-browser-args='--no-sandbox --renderer-cmd-prefix="xterm -e gdb -ex r --args"'

Call stack after in breaking renderer (not always exactly here):

0x00007ffff3d82903 in v8::internal::compiler::VirtualState::UpdateFrom(v8::internal::compiler::VirtualState*, v8::internal::Zone*) ()
   from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
(gdb) bt
#0  0x00007ffff3d82903 in v8::internal::compiler::VirtualState::UpdateFrom(v8::internal::compiler::VirtualState*, v8::internal::Zone*) ()
   from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
#1  0x00007ffff3d85d5f in v8::internal::compiler::EscapeAnalysis::ForwardVirtualState(v8::internal::compiler::Node*) ()
   from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
#2  0x00007ffff3d857d6 in v8::internal::compiler::EscapeAnalysis::Process(v8::internal::compiler::Node*) ()
   from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
#3  0x00007ffff3d8517b in v8::internal::compiler::EscapeAnalysis::RunObjectAnalysis() () from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
#4  0x00007ffff3d842f5 in v8::internal::compiler::EscapeAnalysis::Run() ()
   from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
#5  0x00007ffff3e148b1 in v8::internal::compiler::EscapeAnalysisPhase::Run(v8::internal::compiler::PipelineData*, v8::internal::Zone*) ()
   from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
#6  0x00007ffff3e0def9 in v8::internal::compiler::PipelineImpl::CreateGraph()
    () from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
#7  0x00007ffff3e0d598 in v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl() ()
   from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
#8  0x00007ffff3d2efee in v8::internal::CompilationJob::PrepareJob() ()
   from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
---Type <return> to continue, or q <return> to quit---
#9  0x00007ffff3d3171f in v8::internal::(anonymous namespace)::GetOptimizedCode(v8::internal::Handle<v8::internal::JSFunction>, v8::internal::Compiler::ConcurrencyMode, v8::internal::BailoutId, v8::internal::JavaScriptFrame*) ()
   from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
#10 0x00007ffff3d308b3 in v8::internal::Compiler::CompileOptimized(v8::internal::Handle<v8::internal::JSFunction>, v8::internal::Compiler::ConcurrencyMode) ()
   from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
#11 0x00007ffff415f181 in v8::internal::Runtime_CompileOptimized_Concurrent(int, v8::internal::Object**, v8::internal::Isolate*) ()
   from /usr/local/google/code3/chromium/src/out_linux/Release/./libv8.so
#12 0x000039c619e843a7 in ?? ()
#13 0x0000315e00e8d111 in ?? ()