A few stacks:

[ RUN      ] MediaStreamDevicesControllerTest.RequestAndAllowCam
Backtrace:
	MediaStreamDevicesController::RequestPermissionsWithDelegate [0x0211693E+1200]
	MediaStreamDevicesControllerTest_RequestAndAllowCam_Test::RunTestOnMainThread [0x00464996+214]
	InProcessBrowserTest::RunTestOnMainThreadLoop [0x0196C9A4+180]
	content::BrowserTestBase::ProxyRunTestOnMainThreadLoop [0x01A353F8+232]
	ChromeBrowserMainParts::PreMainMessageLoopRunImpl [0x0213FF8D+3745]
	ChromeBrowserMainParts::PreMainMessageLoopRun [0x0213F0AC+268]
	content::BrowserMainLoop::PreMainMessageLoopRun [0x00CAA5BC+188]
	content::StartupTaskRunner::RunAllTasksNow [0x00EC1080+34]
	content::BrowserMainLoop::CreateStartupTasks [0x00CA9305+629]
	content::BrowserMainRunnerImpl::Initialize [0x00CAC5EC+700]
	content::BrowserMain [0x00CA79AC+172]


[ RUN      ] MediaStreamPermissionTest.TestDenyingUserMedia
[5300:6052:0420/032940.078:INFO:CONSOLE(71)] "This appears to be Chrome", source: http://127.0.0.1:56387/webrtc/adapter.js (71)
[5300:6052:0420/032940.125:INFO:CONSOLE(13)] "Requesting doGetUserMedia: constraints: {"audio":true,"video":true}", source: http://127.0.0.1:56387/webrtc/test_functions.js (13)
[5300:4672:0420/032940.129:WARNING:embedded_test_server.cc(219)] Request not handled. Returning 404: /favicon.ico
Backtrace:
	MediaStreamDevicesController::RequestPermissionsWithDelegate [0x02FB693E+1200]
	MediaStreamDevicesController::RequestPermissions [0x02FB647E+38]
	PermissionBubbleMediaAccessHandler::ProcessQueuedAccessRequest [0x02FD8326+166]
	PermissionBubbleMediaAccessHandler::HandleRequest [0x02FD81E2+114]
	Browser::RequestMediaAccessPermission [0x03E01EFB+43]
	content::WebContentsImpl::RequestMediaAccessPermission [0x01D8054D+45]
	content::MediaStreamUIProxy::Core::RequestAccess [0x01CCCC56+182]
	base::internal::FunctorTraits<void (__thiscall DomainReliabilityInternalsUI::*)(std::unique_ptr<base::Value,std::default_delete<base::Value> >)const ,void>::Invoke<DomainReliabilityInternalsUI const *,std::unique_ptr<base::Value,std::default_delete<base:: [0x0147C799+41]
	base::internal::Invoker<base::internal::BindState<void (__thiscall content::MediaStreamUIProxy::Core::*)(std::unique_ptr<content::MediaStreamRequest,std::default_delete<content::MediaStreamRequest> >),base::internal::UnretainedWrapper<content::MediaStream [0x01CCD952+82]
	base::debug::TaskAnnotator::RunTask [0x027D9CA4+468]
	base::MessageLoop::RunTask [0x02772729+633]

[ RUN      ] MediaStreamPermissionTest.TestDismissIsNotSticky
[3236:4776:0420/032837.836:INFO:CONSOLE(71)] "This appears to be Chrome", source: http://127.0.0.1:61627/webrtc/adapter.js (71)
[3236:4776:0420/032837.866:INFO:CONSOLE(13)] "Requesting doGetUserMedia: constraints: {"audio":true,"video":true}", source: http://127.0.0.1:61627/webrtc/test_functions.js (13)
[3236:1544:0420/032837.868:WARNING:embedded_test_server.cc(219)] Request not handled. Returning 404: /favicon.ico
Backtrace:
	MediaStreamDevicesController::RequestPermissionsWithDelegate [0x0201693E+1200]
	MediaStreamDevicesController::RequestPermissions [0x0201647E+38]
	PermissionBubbleMediaAccessHandler::ProcessQueuedAccessRequest [0x02038326+166]
	PermissionBubbleMediaAccessHandler::HandleRequest [0x020381E2+114]
	Browser::RequestMediaAccessPermission [0x02E61EFB+43]
	content::WebContentsImpl::RequestMediaAccessPermission [0x00DE054D+45]
	content::MediaStreamUIProxy::Core::RequestAccess [0x00D2CC56+182]
	base::internal::FunctorTraits<void (__thiscall DomainReliabilityInternalsUI::*)(std::unique_ptr<base::Value,std::default_delete<base::Value> >)const ,void>::Invoke<DomainReliabilityInternalsUI const *,std::unique_ptr<base::Value,std::default_delete<base:: [0x004DC799+41]
	base::internal::Invoker<base::internal::BindState<void (__thiscall content::MediaStreamUIProxy::Core::*)(std::unique_ptr<content::MediaStreamRequest,std::default_delete<content::MediaStreamRequest> >),base::internal::UnretainedWrapper<content::MediaStream [0x00D2D952+82]
	base::debug::TaskAnnotator::RunTask [0x01839CA4+468]
	base::MessageLoop::RunTask [0x017D2729+633]
	base::MessageLoop::DeferOrRunPendingTask [0x017D29F5+37]
	base::MessageLoop::DoWork [0x017D2DF5+277]


https://codereview.chromium.org/2811913002 did touch RequestPermissionsWithDelegate

Hm, t/26453728 is making it harder for me to investigate :-/

This looks like a null dereference due to use-after-move in this code:

 Profile* profile =
     Profile::FromBrowserContext(web_contents->GetBrowserContext());
 delegate->ShowPrompt(
     request.user_gesture, web_contents,
     base::MakeUnique<MediaStreamDevicesController::Request>(
         profile, controller->IsAskingForAudio(),
         controller->IsAskingForVideo(), request.security_origin,
         base::Bind(&MediaStreamDevicesController::PromptAnswered,
                    base::Passed(&controller))));

We evaluate right-to-left and do more aggressive copy elision, so 'base::Passed(&controller)' is evaluated first, nulling out controller, leading to a crash. I'll send a quick fix.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/27ae42407b0effd81dd43d7542305f5cc1aa1d58

commit 27ae42407b0effd81dd43d7542305f5cc1aa1d58
Author: rnk <rnk@chromium.org>
Date: Mon Apr 24 23:59:26 2017

Fix use-after-move in media/webrtc permission prompting code

Accessing a unique_ptr in the same call expression that moves it is
generally not safe, since different compilers evaluate have different
orders of evaluation.

BUG= 714609 
TBR=raymes@chromium.org,thakis@chromium.org

Review-Url: https://codereview.chromium.org/2842493003
Cr-Commit-Position: refs/heads/master@{#466830}

[modify] https://crrev.com/27ae42407b0effd81dd43d7542305f5cc1aa1d58/chrome/browser/media/webrtc/media_stream_devices_controller.cc

Thanks so much for the fix and sorry for breaking this.