OS: Linux

What steps will reproduce the problem?
(1) cat args.gn
allow_posix_link_time_opt = true
dcheck_always_on = true
is_cfi = true
is_component_build = false
is_debug = false
use_cfi_cast = true
use_cfi_diag = true
use_thin_lto = true
(2) ninja unit_tests
(3) UBSAN_OPTIONS=print_stacktrace=1 ./unit_tests --gtest_filter=SyncInternalsMessageHandlerTest.AddRemoveObservers

What is the expected result?

test passes

What happens instead?

IMPORTANT DEBUGGING NOTE: batches of tests are run inside their
own process. For debugging a test inside a debugger, use the
--gtest_filter=<your_test_name> flag along with
--single-process-tests.
Using sharding settings from environment. This is shard 0/1
Using 1 parallel jobs.
Note: Google Test filter = SyncInternalsMessageHandlerTest.AddRemoveObservers
[==========] Running 1 test from 1 test case.
[----------] Global test environment set-up.
[----------] 1 test from SyncInternalsMessageHandlerTest
[ RUN      ] SyncInternalsMessageHandlerTest.AddRemoveObservers
../../chrome/browser/sync/profile_sync_service_factory.cc:109:10: runtime error: control flow integrity check for type 'browser_sync::ProfileSyncService' failed during base-to-derived cast (vtable address 0x000000b5e460)
0x000000b5e460: note: vtable is of type '(anonymous namespace)::TestSyncService'
 00 00 00 00  60 15 4c 07 00 00 00 00  a0 15 4c 07 00 00 00 00  d0 0c 0b 0b 00 00 00 00  e0 0c 0b 0b
              ^ 
    #0 0xc509b85 in ProfileSyncServiceFactory::GetForProfile(Profile*) ../../chrome/browser/sync/profile_sync_service_factory.cc:109:10
    #1 0xecc3460 in SyncInternalsMessageHandler::HandleRegisterForEvents(base::ListValue const*) ../../chrome/browser/ui/webui/sync_internals_message_handler.cc:130:26
    #2 0x74c431d in (anonymous namespace)::SyncInternalsMessageHandlerTest_AddRemoveObservers_Test::TestBody() ../../chrome/browser/ui/webui/sync_internals_message_handler_unittest.cc:214:14
    #3 0x88ce2ef in testing::Test::Run() ../../third_party/googletest/src/googletest/src/gtest.cc:2471:5
    #4 0x88cea3d in testing::TestInfo::Run() ../../third_party/googletest/src/googletest/src/gtest.cc:2653:11
    #5 0x88cf111 in testing::TestCase::Run() ../../third_party/googletest/src/googletest/src/gtest.cc:2771:28
    #6 0x88d3222 in testing::internal::UnitTestImpl::RunAllTests() ../../third_party/googletest/src/googletest/src/gtest.cc:4648:43
    #7 0x88d2f4c in testing::UnitTest::Run() ../../third_party/googletest/src/googletest/src/gtest.cc:4256:10
    #8 0xaffe033 in base::TestSuite::Run() ../../base/test/test_suite.cc:271:16
    #9 0xaff108d in int base::internal::Invoker<base::internal::BindState<int (content::UnitTestTestSuite::*)(), base::internal::UnretainedWrapper<content::UnitTestTestSuite> >, int ()>::RunImpl<int (content::UnitTestTestSuite::* const&)(), std::tuple<base::internal::UnretainedWrapper<content::UnitTestTestSuite> > const&, 0ul>(int (content::UnitTestTestSuite::* const&)(), std::tuple<base::internal::UnretainedWrapper<content::UnitTestTestSuite> > const&, base::IndexSequence<0ul>) ../../base/bind_internal.h:351:12
    #10 0xb001f0e in base::(anonymous namespace)::LaunchUnitTestsInternal(base::Callback<int (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, int, int, bool, base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&) ../../base/test/launcher/unit_test_launcher.cc:216:27
    #11 0xb001de1 in base::LaunchUnitTests(int, char**, base::Callback<int (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&) ../../base/test/launcher/unit_test_launcher.cc:458:10
    #12 0xaff0e10 in main ../../chrome/test/base/run_all_unittests.cc:30:10
    #13 0x7fb3e1902f44 in __libc_start_main /build/eglibc-MjiXCM/eglibc-2.19/csu/libc-start.c:287
    #14 0x72e2028 in _start (/usr/local/ssd/home/pcc/src/chromium/src/out_gn2/cfi_trybot/unit_tests+0x72e2028)

[1/1] SyncInternalsMessageHandlerTest.AddRemoveObservers (CRASHED)
1 test crashed:
    SyncInternalsMessageHandlerTest.AddRemoveObservers (../../chrome/browser/ui/webui/sync_internals_message_handler_unittest.cc:210)
Tests took 7 seconds.


Please use labels and text to provide additional information.

Started failing at https://build.chromium.org/p/chromium.fyi/builders/CFI%20Linux%20ToT/builds/6326
Suspected culprit is https://codereview.chromium.org/2910773003