Original CL https://codereview.chromium.org/2911293003/
Stack trace examples:

[ RUN      ] PasswordProtectionServiceTest.TestCacheUnfamiliarLoginVerdicts
Received signal 11 SEGV_MAPERR 000000000008
#0 0x0000037d9987 base::debug::StackTrace::StackTrace()
#1 0x0000037d94ff base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f7c2638f330 <unknown>
#3 0x000003240d1e base::internal::flat_tree<>::equal_range()
#4 0x000003845961 base::DictionaryValue::HasKey()
#5 0x000003752345 safe_browsing::PasswordProtectionService::CacheVerdict()
#6 0x0000024e7e45 safe_browsing::PasswordProtectionServiceTest_TestCacheUnfamiliarLoginVerdicts_Test::TestBody()
#7 0x0000028ece36 testing::Test::Run()
#8 0x0000028ed850 testing::TestInfo::Run()
#9 0x0000028edd77 testing::TestCase::Run()
#10 0x0000028f4ed7 testing::internal::UnitTestImpl::RunAllTests()
#11 0x0000028f4b67 testing::UnitTest::Run()
#12 0x0000047924d1 base::TestSuite::Run()
#13 0x000004794b9a base::(anonymous namespace)::LaunchUnitTestsInternal()
#14 0x000004794a64 base::LaunchUnitTests()
#15 0x0000007426ac main
#16 0x7f7c1ffbef45 __libc_start_main
#17 0x0000007425ad <unknown>
  r8: 0000000006837d21  r9: 000000000683ad40 r10: 000000000683ae40 r11: 00007f7c20126cf0
 r12: 00007ffdcca3c180 r13: 00001af5f2c03480 r14: 0000000000000000 r15: 00007ffdcca3c2c8
  di: 0000000000000008  si: 00007ffdcca3c110  bp: 0000000000000000  bx: 0000000000000008
  dx: 000000000000000c  ax: 00001af5f2c4f3d8  cx: 00001af5f2c4f3d8  sp: 00007ffdcca3c0a0
  ip: 0000000003240d1e efl: 0000000000010206 cgf: 0000000000000033 erf: 0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000008
[end of stack trace]
Calling _exit(1). Core file will not be generated.

+raymes@, as you're the expert in content settings related code. 
My code passed all try bots but failed in waterfall. I couldn't reproduce locally either. 
It seems the failing point is inside base::DictionaryValue::HasKey(), have you encounter similar situation?  Do you know what leads to the different behaviors on try bots/local v.s. the water fall build bots. 

Thank you so much for helping out!

Sorry jialiul@ I had a look but I'm not sure what the problem is. It looks like memory corruption of some kind that may not be consistently reproducible. My best guess that the Dictionary is somehow being deleted. It may have something to do with the way we're manipulating the unique_ptrs but I couldn't see anything specifically wrong.