Navigate to https://www.paypal-gifts.com/en_ca/10-off-itunes.html
Click "Gift",
Fill in fift form,
Click "Review",
Crash at NOTREACHED marked by "<<< HERE" below

void PaintController::ProcessNewItem(DisplayItem& display_item) {
  DCHECK(!construction_disabled_);

  if (IsSkippingCache())
    display_item.SetSkippedCache();

  if (raster_invalidation_tracking_info_) {
    raster_invalidation_tracking_info_->new_client_debug_names.insert(
        &display_item.Client(), display_item.Client().DebugName());
  }

  if (RuntimeEnabledFeatures::SlimmingPaintV2Enabled()) {
    size_t last_chunk_index = new_paint_chunks_.LastChunkIndex();
    if (new_paint_chunks_.IncrementDisplayItemIndex(display_item)) {
      DCHECK(last_chunk_index != new_paint_chunks_.LastChunkIndex());
      if (last_chunk_index != kNotFound) {
        GenerateRasterInvalidations(
            new_paint_chunks_.PaintChunkAt(last_chunk_index));
      }
    }

    new_paint_chunks_.LastChunk().outset_for_raster_effects =
        std::max(new_paint_chunks_.LastChunk().outset_for_raster_effects,
                 display_item.OutsetForRasterEffects().ToFloat());
  }

#if DCHECK_IS_ON()
  // Verify noop begin/end pairs have been removed.
  if (new_display_item_list_.size() >= 2 && display_item.IsEnd()) {
    const auto& begin_display_item =
        new_display_item_list_[new_display_item_list_.size() - 2];
    if (begin_display_item.IsBegin() && !begin_display_item.DrawsContent())
      DCHECK(!display_item.IsEndAndPairedWith(begin_display_item.GetType()));
  }

  size_t index = FindMatchingItemFromIndex(display_item.GetId(),
                                           new_display_item_indices_by_client_,
                                           new_display_item_list_);
  if (index != kNotFound) {
#ifndef NDEBUG
    ShowDebugData();
    WTFLogAlways(
        "DisplayItem %s has duplicated id with previous %s (index=%zu)\n",
        display_item.AsDebugString().Utf8().data(),
        new_display_item_list_[index].AsDebugString().Utf8().data(), index);
#endif
    NOTREACHED();   <<< HERE
  }
  AddItemToIndexIfNeeded(display_item, new_display_item_list_.size() - 1,
                         new_display_item_indices_by_client_);
#endif  // DCHECK_IS_ON()

  if (RuntimeEnabledFeatures::PaintUnderInvalidationCheckingEnabled())
    CheckUnderInvalidation();

  if (!frame_first_paints_.back().first_painted && display_item.IsDrawing() &&
      // Here we ignore all document-background paintings because we don't
      // know if the background is default. ViewPainter should have called
      // setFirstPainted() if this display item is for non-default
      // background.
      display_item.GetType() != DisplayItem::kDocumentBackground &&
      display_item.DrawsContent()) {
    SetFirstPainted();
  }
}

Locals:
0:000> dv
              this = 0x49974010
      display_item = 0x5a63d828
             index = 0
  last_chunk_index = <value unavailable>
begin_display_item = <value unavailable>

(Sadly this & display_item dump is gibberish).

The stack trace is:
0:000> kc
  *** Stack trace for last set context - .thread/.cxr resets it
 # 
00 chrome_child!base::debug::BreakDebugger
01 chrome_child!logging::LogMessage::~LogMessage
02 chrome_child!blink::PaintController::ProcessNewItem
03 chrome_child!blink::PaintController::CreateAndAppend<blink::DrawingDisplayItem,blink::DisplayItemClient const &,enum blink::DisplayItem::Type const &,sk_sp<cc::PaintOpBuffer const > &,blink::IntRect &,bool &>
04 chrome_child!blink::DrawingRecorder::~DrawingRecorder
05 chrome_child!blink::InlineTextBoxPainter::Paint
06 chrome_child!blink::InlineTextBox::Paint
07 chrome_child!blink::InlineFlowBoxPainter::Paint
08 chrome_child!blink::InlineFlowBox::Paint
09 chrome_child!blink::RootInlineBoxPainter::Paint
0a chrome_child!blink::RootInlineBox::Paint
0b chrome_child!blink::LineBoxListPainter::Paint
0c chrome_child!blink::BlockFlowPainter::PaintContents
0d chrome_child!blink::BlockPainter::PaintObject
0e chrome_child!blink::LayoutBlock::PaintObject
0f chrome_child!blink::BlockPainter::Paint
10 chrome_child!blink::LayoutBlock::Paint
11 chrome_child!blink::ObjectPainter::PaintAllPhasesAtomically
12 chrome_child!blink::BlockFlowPainter::PaintFloats
13 chrome_child!blink::BlockPainter::PaintObject
14 chrome_child!blink::LayoutBlock::PaintObject
15 chrome_child!blink::BlockPainter::Paint
16 chrome_child!blink::LayoutBlock::Paint
17 chrome_child!blink::ObjectPainter::PaintAllPhasesAtomically
18 chrome_child!blink::BlockFlowPainter::PaintFloats
19 chrome_child!blink::BlockPainter::PaintObject
1a chrome_child!blink::LayoutBlock::PaintObject
1b chrome_child!blink::BlockPainter::Paint
1c chrome_child!blink::LayoutBlock::Paint
1d chrome_child!blink::PaintLayerPainter::PaintFragmentWithPhase
1e chrome_child!blink::PaintLayerPainter::PaintForegroundForFragmentsWithPhase
1f chrome_child!blink::PaintLayerPainter::PaintForegroundForFragments
20 chrome_child!blink::PaintLayerPainter::PaintLayerContents
21 chrome_child!blink::PaintLayerPainter::PaintLayerContentsCompositingAllPhases
22 chrome_child!blink::PaintLayerPainter::Paint
23 chrome_child!blink::PaintLayerPainter::PaintChildren
24 chrome_child!blink::PaintLayerPainter::PaintLayerContents
25 chrome_child!blink::PaintLayerPainter::PaintLayerContentsCompositingAllPhases
26 chrome_child!blink::PaintLayerPainter::Paint
27 chrome_child!blink::PaintLayerPainter::PaintChildren
28 chrome_child!blink::PaintLayerPainter::PaintLayerContents
29 chrome_child!blink::CompositedLayerMapping::DoPaintTask
2a chrome_child!blink::CompositedLayerMapping::PaintContents
2b chrome_child!blink::GraphicsLayer::PaintWithoutCommit
2c chrome_child!blink::GraphicsLayer::Paint
2d chrome_child!blink::LocalFrameView::PaintGraphicsLayerRecursively
2e chrome_child!blink::LocalFrameView::PaintGraphicsLayerRecursively
2f chrome_child!blink::LocalFrameView::PaintGraphicsLayerRecursively
30 chrome_child!blink::LocalFrameView::PaintGraphicsLayerRecursively
31 chrome_child!blink::LocalFrameView::PaintGraphicsLayerRecursively
32 chrome_child!blink::LocalFrameView::PaintTree
33 chrome_child!blink::LocalFrameView::UpdateLifecyclePhasesInternal
34 chrome_child!blink::LocalFrameView::UpdateAllLifecyclePhases
35 chrome_child!blink::PageAnimator::UpdateAllLifecyclePhases
36 chrome_child!blink::PageWidgetDelegate::UpdateAllLifecyclePhases
37 chrome_child!blink::WebViewImpl::UpdateAllLifecyclePhases
38 chrome_child!content::RenderWidget::UpdateVisualState
39 chrome_child!cc::LayerTreeHost::RequestMainFrameUpdate
3a chrome_child!cc::ProxyMain::BeginMainFrame
3b chrome_child!base::internal::FunctorTraits<void (__thiscall cc::ProxyMain::*)(std::unique_ptr<cc::BeginMainFrameAndCommitState,std::default_delete<cc::BeginMainFrameAndCommitState> >),void>::Invoke
3c chrome_child!base::internal::InvokeHelper<1,void>::MakeItSo
3d chrome_child!base::internal::Invoker<base::internal::BindState<void (__thiscall cc::ProxyMain::*)(std::unique_ptr<cc::BeginMainFrameAndCommitState,std::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,base::internal::PassedWrapper<std::unique_ptr<cc::BeginMainFrameAndCommitState,std::default_delete<cc::BeginMainFrameAndCommitState> > > >,void __cdecl(void)>::RunImpl
3e chrome_child!base::internal::Invoker<base::internal::BindState<void (__thiscall cc::ProxyMain::*)(std::unique_ptr<cc::BeginMainFrameAndCommitState,std::default_delete<cc::BeginMainFrameAndCommitState> >),base::WeakPtr<cc::ProxyMain>,base::internal::PassedWrapper<std::unique_ptr<cc::BeginMainFrameAndCommitState,std::default_delete<cc::BeginMainFrameAndCommitState> > > >,void __cdecl(void)>::RunOnce
3f chrome_child!base::Callback<void __cdecl(void),0,0>::Run
40 chrome_child!base::debug::TaskAnnotator::RunTask
41 chrome_child!blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue
42 chrome_child!blink::scheduler::TaskQueueManager::DoWork
43 chrome_child!base::internal::FunctorTraits<void (__thiscall media::AudioRendererImpl::*)(bool),void>::Invoke<base::WeakPtr<media::AudioRendererImpl> const &,bool>
44 chrome_child!base::internal::InvokeHelper<1,void>::MakeItSo<void (__thiscall content::FilteringNetworkManager::*const &)(bool),base::WeakPtr<content::FilteringNetworkManager> const &,bool>
45 chrome_child!base::internal::Invoker<base::internal::BindState<void (__thiscall blink::scheduler::TaskQueueManager::*)(bool),base::WeakPtr<blink::scheduler::TaskQueueManager>,bool>,void __cdecl(void)>::RunImpl<void (__thiscall blink::scheduler::TaskQueueManager::*const &)(bool),std::tuple<base::WeakPtr<blink::scheduler::TaskQueueManager>,bool> const &,0,1>
46 chrome_child!base::internal::Invoker<base::internal::BindState<void (__thiscall blink::scheduler::TaskQueueManager::*)(bool),base::WeakPtr<blink::scheduler::TaskQueueManager>,bool>,void __cdecl(void)>::Run
47 chrome_child!base::Callback<void __cdecl(void),1,1>::Run
48 chrome_child!base::CancelableCallback<void __cdecl(void)>::Forward
49 chrome_child!base::internal::FunctorTraits<void (__thiscall base::CancelableCallback<void __cdecl(void)>::*)(void)const ,void>::Invoke
4a chrome_child!base::internal::InvokeHelper<1,void>::MakeItSo
4b chrome_child!base::internal::Invoker<base::internal::BindState<void (__thiscall base::CancelableCallback<void __cdecl(void)>::*)(void)const ,base::WeakPtr<base::CancelableCallback<void __cdecl(void)> > >,void __cdecl(void)>::RunImpl<void (__thiscall base::CancelableCallback<void __cdecl(void)>::*const &)(void)const ,std::tuple<base::WeakPtr<base::CancelableCallback<void __cdecl(void)> > > const &,0>
4c chrome_child!base::internal::Invoker<base::internal::BindState<void (__thiscall base::CancelableCallback<void __cdecl(void)>::*)(void)const ,base::WeakPtr<base::CancelableCallback<void __cdecl(void)> > >,void __cdecl(void)>::Run
4d chrome_child!base::Callback<void __cdecl(void),0,0>::Run
4e chrome_child!base::debug::TaskAnnotator::RunTask
4f chrome_child!base::MessageLoop::RunTask
50 chrome_child!base::MessageLoop::DeferOrRunPendingTask
51 chrome_child!base::MessageLoop::DoDelayedWork
52 chrome_child!base::MessagePumpDefault::Run
53 chrome_child!base::MessageLoop::Run
54 chrome_child!base::RunLoop::Run
55 chrome_child!content::RendererMain
56 chrome_child!content::RunNamedProcessTypeMain
57 chrome_child!content::ContentMainRunnerImpl::Run
58 chrome_child!service_manager::Main
59 chrome_child!content::ContentMain