On ToT, I ran chrome --mash, clicked on omnibox and typed any 1 character, Chrome immediately crashed with the following stacktraces:

This is quite similar to crbug/733694, but with different class names.

[28139:28144:0809/133904.050823:588683176394:INFO:service_process_launcher.cc(191)] Launched child process pid=28149, instance=, name=ui, user_id=223e482a-703c-4e32-ae72-44977ba754b9
[28139:28148:0809/133904.052666:588683177809:INFO:service_process_launcher.cc(191)] Launched child process pid=28151, instance=, name=content_packaged_services, user_id=b6cafa45-54f5-45a0-b8f8-0059c0a25a21
[28139:28148:0809/133904.054357:588683179498:INFO:service_process_launcher.cc(191)] Launched child process pid=28152, instance=, name=ash, user_id=505C0EE9-3013-43C0-82B0-A84F50CF8D84
[28139:28148:0809/133904.056268:588683181409:INFO:service_process_launcher.cc(191)] Launched child process pid=28153, instance=, name=quick_launch, user_id=505C0EE9-3013-43C0-82B0-A84F50CF8D84
[28151:28151:0809/133904.491834:ERROR:zygote_host_impl_linux.cc(109)] SUID sandbox binary is missing. Won't be able to adjust OOM scores.
[28139:28148:0809/133904.601875:588683727017:INFO:service_process_launcher.cc(191)] Launched child process pid=28182, instance=, name=font_service, user_id=505C0EE9-3013-43C0-82B0-A84F50CF8D84
[28152:28152:0809/133905.281952:588684407251:ERROR:shell_delegate_mus.cc(113)] Not implemented reached in virtual ash::GPUSupport *ash::ShellDelegateMus::CreateGPUSupport()
[28152:28152:0809/133905.282554:588684407685:ERROR:shell_delegate_mus.cc(102)] Not implemented reached in virtual std::unique_ptr<PaletteDelegate> ash::ShellDelegateMus::CreatePaletteDelegate()
[28152:28152:0809/133905.282609:588684407738:ERROR:shell_delegate_mus.cc(60)] Not implemented reached in virtual void ash::ShellDelegateMus::PreInit()
[28152:28152:0809/133905.465192:588684590328:ERROR:layer_tree_host_impl.cc(2415)] Forcing zero-copy tile initialization as worker context is missing
[28152:28152:0809/133905.478502:588684603637:ERROR:shell_delegate_mus.cc(50)] Not implemented reached in virtual bool ash::ShellDelegateMus::CanShowWindowForUser(aura::Window *) const
[28153:28153:0809/133905.480759:588684606136:ERROR:layer_tree_host_impl.cc(2415)] Forcing zero-copy tile initialization as worker context is missing
[28151:28216:0809/133906.178208:ERROR:logging_chrome.cc(180)] Unable to create symlink /tmp/any/test-user/chrome_debug.log pointing at /tmp/any/test-user/chrome_debug_20170809-133906.log: No such file or directory (2)
[28152:28152:0809/133906.300171:588685425302:ERROR:shell_delegate_mus.cc(81)] Not implemented reached in virtual void ash::ShellDelegateMus::ShelfInit()
[28151:28151:0809/133906.483214:ERROR:remote_text_input_client.cc(140)] Not implemented reached in virtual void RemoteTextInputClient::OnInputMethodChanged()
[28151:28151:0809/133906.483243:ERROR:remote_text_input_client.cc(97)] Not implemented reached in virtual bool RemoteTextInputClient::HasCompositionText() const
[28151:28151:0809/133906.483253:ERROR:remote_text_input_client.cc(103)] Not implemented reached in virtual bool RemoteTextInputClient::GetTextRange(gfx::Range *) const
[28151:28151:0809/133906.483263:ERROR:remote_text_input_client.cc(158)] Not implemented reached in virtual void RemoteTextInputClient::EnsureCaretNotInRect(const gfx::Rect &)
[28151:28151:0809/133906.513503:ERROR:layer_tree_host_impl.cc(2415)] Forcing zero-copy tile initialization as worker context is missing
[1:10:0809/133906.691355:ERROR:layer_tree_host_impl.cc(2415)] Forcing zero-copy tile initialization as worker context is missing
[28151:28151:0809/133906.961185:ERROR:status_bubble_views.cc(676)] Not implemented reached in void StatusBubbleViews::Init()
[28151:28151:0809/133906.974790:ERROR:layer_tree_host_impl.cc(2415)] Forcing zero-copy tile initialization as worker context is missing
[28139:28146:0809/133908.367058:588687492193:ERROR:service_manager.cc(156)] Connection InterfaceProviderSpec prevented service: content_browser from binding interface: content::mojom::Child exposed by: nacl_loader
[1,3382015872:17:39:08.374922] Native Client module will be loaded at base address 0x000048ea00000000
[28151:28151:0809/133908.407905:ERROR:layer_tree_host_impl.cc(2415)] Forcing zero-copy tile initialization as worker context is missing
[28151:28151:0809/133908.496694:FATAL:client_layer_tree_frame_sink.cc(170)] Surface invariants violation
#0 0x7f8354fa3e6c base::debug::StackTrace::StackTrace()
#1 0x7f8354fc96cc logging::LogMessage::~LogMessage()
#2 0x7f8350eee1c2 viz::ClientLayerTreeFrameSink::OnMojoConnectionError()
#3 0x7f835429b9a3 mojo::InterfaceEndpointClient::NotifyError()
#4 0x7f83542a5406 mojo::internal::MultiplexRouter::ProcessNotifyErrorTask()
#5 0x7f83542a2b8d mojo::internal::MultiplexRouter::ProcessTasks()
#6 0x7f83542a43b6 mojo::internal::MultiplexRouter::Accept()
#7 0x7f8354299e86 mojo::FilterChain::Accept()
#8 0x7f8354295285 mojo::Connector::ReadSingleMessage()
#9 0x7f8354295d61 mojo::Connector::ReadAllAvailableMessages()
#10 0x7f8354295c19 mojo::Connector::OnHandleReadyInternal()
#11 0x7f83542961c5 mojo::SimpleWatcher::DiscardReadyState()
#12 0x7f835426def4 mojo::SimpleWatcher::OnHandleReady()
#13 0x7f835426e43f _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo13SimpleWatcherEFvijRKNS3_18HandleSignalsStateEEJNS_7WeakPtrIS4_EEijS5_EEEFvvEE7RunImplIRKS9_RKNSt3__15tupleIJSB_ijS5_EEEJLm0ELm1ELm2ELm3EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#14 0x7f8354fa4710 base::debug::TaskAnnotator::RunTask()
#15 0x7f8354fd6529 base::MessageLoop::RunTask()
#16 0x7f8354fd684e base::MessageLoop::DeferOrRunPendingTask()
#17 0x7f8354fd6ba9 base::MessageLoop::DoWork()
#18 0x7f8354fd9419 base::MessagePumpLibevent::Run()
#19 0x7f8354fd5f92 base::MessageLoop::Run()
#20 0x7f8355009b7a base::RunLoop::Run()
#21 0x55c4c754a26a ChromeBrowserMainParts::MainMessageLoopRun()
#22 0x7f835256c2b7 content::BrowserMainLoop::RunMainMessageLoopParts()
#23 0x7f835256eed6 content::BrowserMainRunnerImpl::Run()
#24 0x7f8352567bff content::BrowserMain()
#25 0x7f8352d720b8 content::ContentMainRunnerImpl::Run()
#26 0x7f83554e7cb2 service_manager::Main()
#27 0x7f8352d70b94 content::ContentMain()
#28 0x55c4c6bd49f8 ChromeMain
#29 0x7f834ac59f45 __libc_start_main
#30 0x55c4c6bd4834 <unknown>

Received signal 6
#0 0x7f8354fa3e6c base::debug::StackTrace::StackTrace()
#1 0x7f8354fa3961 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f8355121330 <unknown>
#3 0x7f834ac6ec37 gsignal
#4 0x7f834ac72028 abort
#5 0x7f8354fa18b5 base::debug::BreakDebugger()
#6 0x7f8354fc9b7b logging::LogMessage::~LogMessage()
#7 0x7f8350eee1c2 viz::ClientLayerTreeFrameSink::OnMojoConnectionError()
#8 0x7f835429b9a3 mojo::InterfaceEndpointClient::NotifyError()
#9 0x7f83542a5406 mojo::internal::MultiplexRouter::ProcessNotifyErrorTask()
#10 0x7f83542a2b8d mojo::internal::MultiplexRouter::ProcessTasks()
#11 0x7f83542a43b6 mojo::internal::MultiplexRouter::Accept()
#12 0x7f8354299e86 mojo::FilterChain::Accept()
#13 0x7f8354295285 mojo::Connector::ReadSingleMessage()
#14 0x7f8354295d61 mojo::Connector::ReadAllAvailableMessages()
#15 0x7f8354295c19 mojo::Connector::OnHandleReadyInternal()
#16 0x7f83542961c5 mojo::SimpleWatcher::DiscardReadyState()
#17 0x7f835426def4 mojo::SimpleWatcher::OnHandleReady()
#18 0x7f835426e43f _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo13SimpleWatcherEFvijRKNS3_18HandleSignalsStateEEJNS_7WeakPtrIS4_EEijS5_EEEFvvEE7RunImplIRKS9_RKNSt3__15tupleIJSB_ijS5_EEEJLm0ELm1ELm2ELm3EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#19 0x7f8354fa4710 base::debug::TaskAnnotator::RunTask()
#20 0x7f8354fd6529 base::MessageLoop::RunTask()
#21 0x7f8354fd684e base::MessageLoop::DeferOrRunPendingTask()
#22 0x7f8354fd6ba9 base::MessageLoop::DoWork()
#23 0x7f8354fd9419 base::MessagePumpLibevent::Run()
#24 0x7f8354fd5f92 base::MessageLoop::Run()
#25 0x7f8355009b7a base::RunLoop::Run()
#26 0x55c4c754a26a ChromeBrowserMainParts::MainMessageLoopRun()
#27 0x7f835256c2b7 content::BrowserMainLoop::RunMainMessageLoopParts()
#28 0x7f835256eed6 content::BrowserMainRunnerImpl::Run()
#29 0x7f8352567bff content::BrowserMain()
#30 0x7f8352d720b8 content::ContentMainRunnerImpl::Run()
#31 0x7f83554e7cb2 service_manager::Main()
#32 0x7f8352d70b94 content::ContentMain()
#33 0x55c4c6bd49f8 ChromeMain
#34 0x7f834ac59f45 __libc_start_main
#35 0x55c4c6bd4834 <unknown>
  r8: ffff9ee2e93ba190  r9: ffff9ee2e93ba180 r10: 0000000000000008 r11: 0000000000000202
 r12: 00007ffcf78f1348 r13: 00007ffcf78f1338 r14: 00007ffcf78f1340 r15: 00007ffcf78f0e90
  di: 0000000000006df7  si: 0000000000006df7  bp: 00007ffcf78f0e80  bx: 00007ffcf78f0e90
  dx: 0000000000000006  ax: 0000000000000000  cx: 00007f834ac6ec37  sp: 00007ffcf78f0d48
  ip: 00007f834ac6ec37 efl: 0000000000000202 cgf: 0000000000000033 erf: 0000000000000000
 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]
Calling _exit(1). Core file will not be generated.
[28139:28139:0809/133908.596796:588687721931:ERROR:chrome_main_delegate.cc(1186)] Main process exiting because service content_packaged_services quit unexpectedly.
[28152:28152:0809/133908.605474:588687730623:ERROR:shell_delegate_mus.cc(64)] Not implemented reached in virtual void ash::ShellDelegateMus::PreShutdown()
[28152:28152:0809/133908.613378:588687738510:ERROR:shell_delegate_mus.cc(85)] Not implemented reached in virtual void ash::ShellDelegateMus::ShelfShutdown()