I don't have a reliable repro. I'm developing DevTools-in-DevTools with a hosted mode, and hosted
devtools occasionally crash every once in a while.

This is the stack i get in the terminal:

#
# Fatal error in , line 0
# unreachable code
#
#0 0x7efe1e416f67 base::debug::StackTrace::StackTrace()
#1 0x7efe19c42455 gin::(anonymous namespace)::PrintStackTrace()
#2 0x7efe0fa9962d V8_Fatal
#3 0x7efe1954ec10 v8::internal::TranslatedState::MaterializeCapturedObjectAt()
#4 0x7efe195489bf v8::internal::TranslatedValue::GetValue()
#5 0x7efe19548849 v8::internal::Deoptimizer::MaterializeHeapObjects()
#6 0x7efe197c4340 v8::internal::Runtime_NotifyDeoptimized()
#7 0x19bca8d8463d <unknown>
Received signal 4 ILL_ILLOPN 7efe0fa9a6af
Received signal 11 SEGV_MAPERR 003000000018
[couldn't handle instance type JS_GENERATOR_OBJECT_TYPE]


Hosted mode could be run like this: 
1. Start a static server in the src/third_party/WebKit/Source/devtools folder on port 8090.
2. Run chrome with --remote-debugging-port=9222 --custom-devtools-frontend="http://localhost:8090/front_end/"
3. Open tab http://google.com
4. Open another tab http://localhost:9222/#custom=true&experiments=true. One of the inspectable targets will be google.com, navigate to it's inspect url
5. The step (4) will open a devtools front-end inspecting the google.com. The front-end would be served from the endpoint we started at (1). We call this
   "hosted" devtools.
6. Open devtools on "hosted" devtools.

Let me know if I can provide any details