To repro:

1. Build content shell at ToT.
2. Open with no url, hence www.google.com
3. Type 'chicken' (anything, really) into query box, hit return.
4. Wait until below happens.

It usually crashes for me, but once in a while it does not. Possible it depends on state of caret blinking. Trying 5 times I expect you'll be able to repro at least a couple of times.

wkorman@lemur:~/chrome$ ./out/Debug/content_shell --enable-slimming-paint-v2
[1:1:0517/105840.904641:775835793962:FATAL:PaintController.cpp(522)] Check failed: (!new_paint_chunks_.LastChunk().id && !cached_chunk->id) || new_paint_chunks_.LastChunk().Matches(*cached_chunk). 
#0 0x7f9a2175d1fb base::debug::StackTrace::StackTrace()
#1 0x7f9a2175befc base::debug::StackTrace::StackTrace()
#2 0x7f9a217cfa83 logging::LogMessage::~LogMessage()
#3 0x7f9a173cb9e9 blink::PaintController::CopyCachedSubsequence()
#4 0x7f9a173cb0cd blink::PaintController::UseCachedSubsequenceIfPossible()
#5 0x7f9a19b45b35 blink::SubsequenceRecorder::UseCachedSubsequenceIfPossible()
#6 0x7f9a19b41f7e blink::PaintLayerPainter::PaintLayerContents()
#7 0x7f9a19b418ff blink::PaintLayerPainter::PaintLayerContentsCompositingAllPhases()
#8 0x7f9a19b40d5b blink::PaintLayerPainter::Paint()
#9 0x7f9a19b43d6e blink::PaintLayerPainter::PaintChildren()
#10 0x7f9a19b42ff7 blink::PaintLayerPainter::PaintLayerContents()
#11 0x7f9a19b418ff blink::PaintLayerPainter::PaintLayerContentsCompositingAllPhases()
#12 0x7f9a19b40d5b blink::PaintLayerPainter::Paint()
#13 0x7f9a19b43d6e blink::PaintLayerPainter::PaintChildren()
#14 0x7f9a19b42ff7 blink::PaintLayerPainter::PaintLayerContents()
#15 0x7f9a19b418ff blink::PaintLayerPainter::PaintLayerContentsCompositingAllPhases()
#16 0x7f9a19b40d5b blink::PaintLayerPainter::Paint()
#17 0x7f9a19b40a7e blink::PaintLayerPainter::Paint()
#18 0x7f9a19af97a4 blink::FramePainter::PaintContents()
#19 0x7f9a19af8cae blink::FramePainter::Paint()
#20 0x7f9a191ba3bb blink::FrameView::Paint()
#21 0x7f9a191b4699 blink::FrameView::Paint()
#22 0x7f9a191b3a52 blink::FrameView::PaintTree()
#23 0x7f9a191b1fa4 blink::FrameView::UpdateLifecyclePhasesInternal()
#24 0x7f9a191b1812 blink::FrameView::UpdateAllLifecyclePhases()
#25 0x7f9a19a8e8eb blink::PageAnimator::UpdateAllLifecyclePhases()
#26 0x7f9a152dae65 blink::PageWidgetDelegate::UpdateAllLifecyclePhases()
#27 0x7f9a153b1514 blink::WebViewImpl::UpdateAllLifecyclePhases()
#28 0x7f9a153a7cd2 blink::WebViewFrameWidget::UpdateAllLifecyclePhases()
#29 0x7f9a249e853b content::RenderWidget::UpdateVisualState()
#30 0x7f9a2480fbea content::RenderWidgetCompositor::UpdateLayerTreeHost()
#31 0x7f9a1d0f872d cc::LayerTreeHost::RequestMainFrameUpdate()
#32 0x7f9a1d1d74dc cc::ProxyMain::BeginMainFrame()
#33 0x7f9a1d1d43cc _ZN4base8internal13FunctorTraitsIMN2cc9ProxyMainEFvSt10unique_ptrINS2_28BeginMainFrameAndCommitStateESt14default_deleteIS5_EEEvE6InvokeINS_7WeakPtrIS3_EEJS8_EEEvSA_OT_DpOT0_
#34 0x7f9a1d1d426f _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIMN2cc9ProxyMainEFvSt10unique_ptrINS4_28BeginMainFrameAndCommitStateESt14default_deleteIS7_EEENS_7WeakPtrIS5_EEJSA_EEEvOT_OT0_DpOT1_
#35 0x7f9a1d1d41d8 _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvSt10unique_ptrINS3_28BeginMainFrameAndCommitStateESt14default_deleteIS6_EEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperIS9_EEEEEFvvEE7RunImplISB_St5tupleIJSD_SF_EEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#36 0x7f9a1d1d40ee _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvSt10unique_ptrINS3_28BeginMainFrameAndCommitStateESt14default_deleteIS6_EEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperIS9_EEEEEFvvEE7RunOnceEPNS0_13BindStateBaseE
#37 0x7f9a217189de _ZNO4base8CallbackIFvvELNS_8internal8CopyModeE0ELNS2_10RepeatModeE0EE3RunEv
#38 0x7f9a21762e4e base::debug::TaskAnnotator::RunTask()
#39 0x7f9a1747f6ee blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue()
#40 0x7f9a1747c676 blink::scheduler::TaskQueueManager::DoWork()
#41 0x7f9a17487ca4 _ZN4base8internal13FunctorTraitsIMN5blink9scheduler16TaskQueueManagerEFvbEvE6InvokeIRKNS_7WeakPtrIS4_EEJRKbEEEvS6_OT_DpOT0_
#42 0x7f9a17487baf _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN5blink9scheduler16TaskQueueManagerEFvbERKNS_7WeakPtrIS6_EEJRKbEEEvOT_OT0_DpOT1_
#43 0x7f9a17487b23 _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE7RunImplIRKS7_RKSt5tupleIJS9_bEEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#44 0x7f9a17487a3c _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE3RunEPNS0_13BindStateBaseE
#45 0x7f9a217189de _ZNO4base8CallbackIFvvELNS_8internal8CopyModeE0ELNS2_10RepeatModeE0EE3RunEv
#46 0x7f9a21762e4e base::debug::TaskAnnotator::RunTask()
#47 0x7f9a217f574d base::MessageLoop::RunTask()
#48 0x7f9a217f59d0 base::MessageLoop::DeferOrRunPendingTask()
#49 0x7f9a217f5c04 base::MessageLoop::DoWork()
#50 0x7f9a21807d28 base::MessagePumpDefault::Run()
#51 0x7f9a217f52e2 base::MessageLoop::RunHandler()
#52 0x7f9a2189ce3a base::RunLoop::Run()
#53 0x7f9a24a1db0d content::RendererMain()
#54 0x7f9a24e5fa5d content::RunZygote()
#55 0x7f9a24e5fe10 content::RunNamedProcessTypeMain()
#56 0x7f9a24e620ed content::ContentMainRunnerImpl::Run()
#57 0x7f9a24e5e85a content::ContentServiceManagerMainDelegate::RunEmbedderProcess()
#58 0x7f9a11d86f91 service_manager::Main()
#59 0x7f9a24e5f80f content::ContentMain()
#60 0x0000004b04f1 main
#61 0x7f9a12af5f45 __libc_start_main