Assigning to yusukes@ for further triage.

A better crash stack:
Received signal 11 SEGV_MAPERR 000000000000
#0 0x58754754f4ec base::debug::StackTrace::StackTrace()
#1 0x58754754f041 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x760c853b12e0 <unknown>
#3 0x587545f9f427 content::GpuProcessHost::Init()
#4 0x587545f9ef6b content::GpuProcessHost::Get()
#5 0x587545d7922d content::BindInterfaceInGpuProcess()
#6 0x587546675cbd arc::(anonymous namespace)::ConnectToVideoDecodeAcceleratorOnIOThread()
#7 0x5875462b494f _ZN4base8internal7InvokerINS0_9BindStateIPFvN4mojo16InterfaceRequestIN6device5mojom17OrientationSensorEEEEJNS0_13PassedWrapperIS8_EEEEEFvvEE3RunEPNS0_13BindStateBaseE
#8 0x58754754fce9 base::debug::TaskAnnotator::RunTask()
#9 0x58754756b137 base::MessageLoop::RunTask()
#10 0x58754756b936 base::MessageLoop::DoWork()
#11 0x58754756d2b9 base::MessagePumpLibevent::Run()
#12 0x58754758defa base::RunLoop::Run()
#13 0x587545e5b8b8 content::BrowserThreadImpl::IOThreadRun()
#14 0x587545e5bad1 content::BrowserThreadImpl::Run()
#15 0x5875475b56da base::Thread::ThreadMain()
#16 0x5875475b066d base::(anonymous namespace)::ThreadFunc()
#17 0x760c853a72b8 <unknown>
#18 0x760c842f6fad clone
  r8: 0000000000000000  r9: 00000000000006cd r10: e3ebff6e6e184a4f r11: dd7c6f672d8bd9e6
 r12: 0000760c76f163b0 r13: 0000000000000000 r14: 00000d7618a05300 r15: 00000d7619d5e200
  di: 00000d7614d27620  si: 00000d7618a05190  bp: 0000760c76f16490  bx: 0000760c76f163d8
  dx: 0000000000000a05  ax: 0000000000000000  cx: 000058754d45e028  sp: 0000760c76f16340
  ip: 0000587545f9f427 efl: 0000000000010246 cgf: 0000000000000033 erf: 0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]

In --mus the browser/ash service doesn't talk to the GPU. The WS (window server) process is what handles communicating with the GPU. That callstack looks like something in the browser calls GpuProcessHost::Get() which creates GpuProcessHost and tries to start up the GPU a second time?

In thise case, the browser process need access GPU process to do HW encode and decode via mojo interface I think. Is there a way to access services in GPU process from browser for --mus? 

For mus/mash clients don't connect directly to the viz service via service_manager::Connector. Instead, clients send the request to the WS and the WS forwards the request to the viz service to bind.

The main interface from client to WS is mojom::WindowTree but it's not privileged. I don't think we want all clients to be able control video decode, so that won't really work. The WM interface is privileged, but would only exist in ash?

Actually, we don't need privilege to access video decode. All renderers process can access to the video decode. 

It sounds like the following code need to be updated for mus/mash.

https://cs.chromium.org/chromium/src/content/public/browser/gpu_service_registry.cc?type=cs&sq=package:chromium&l=11

kylechar@, Can you help with the bug? I don't have much knowledge about mus or WS you mentioned. I assume it will be more efficient for you to take the issue, if not, please feel free to assign the bug back to me.

I don't have any cycles to work on this right now unfortuantely. penghuang@ is the mustash team member that is working on exo related things. 

Basically, the browser needs to go through mojom::WindowTree instead of the service registry. The browser would pass a mojom::VideoDecodeAcceleratorRequest over mojom::WindowTree to the WS, and the WS would pass the mojom::VideoDecodeAcceleratorRequest to the viz process over something like mojom::GpuService?

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/417f0cf7506bf91c82b9e75b0036a2b41ff5b549

commit 417f0cf7506bf91c82b9e75b0036a2b41ff5b549
Author: Peng Huang <penghuang@chromium.org>
Date: Mon Nov 20 20:06:16 2017

mus: Enable arc video accelerators in viz

For Classic Ash, ArcVideo*Accelerator and ProtectedBufferManager interfaces
are implemented in GPU process and requested from browser process. And the
the message pipes for ArcVideo*Accelerators interfaces can be forward from
the browser process into ARC container.

This CL adds CreateArcVideo*Accelerator() and CreateProtectedBufferManager()
methods in viz::mojom::GpuService. Those methods can only be used by the
ui(window server) process via the viz::mojo::VizMain interface.

This CL also adds a new ui::mojom::Arc interface. It is exposed from ui
process, and can only be used by browser process.

For mushrome, the workflow is, ARC requests ArcVideo*Accelerator interfaces
from browser process, and then browser process requests ui::mojom::Arc
interface exposed by ui process and then uses the ui::mojom::Arc to create the
ArcVideo*Accelerators interfaces implemented in viz process, and then forwards
the message handle for ArcVideo*Accelerator interface to ARC. The workflow looks
like:

[ARC]<--arc.mojom.ArcBridgeHost-->[browser]<--ui.mojom.Arc-->[ui]<--viz.mojom.GpuService-->[viz]


Test: Test ARC youtube on device
Bug:  769755 
Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Change-Id: If8ff4aeeffc378d12bd86161bf705497bcfc28e5
Reviewed-on: https://chromium-review.googlesource.com/759092
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Sadrul Chowdhury <sadrul@chromium.org>
Reviewed-by: Antoine Labour <piman@chromium.org>
Reviewed-by: Yusuke Sato <yusukes@chromium.org>
Reviewed-by: Michael Wasserman <msw@chromium.org>
Commit-Queue: Peng Huang <penghuang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#517898}
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/chrome/browser/chromeos/arc/video/gpu_arc_video_service_host.cc
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/chrome/browser/ui/views/toolbar/toolbar_view.h
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/chrome/gpu/BUILD.gn
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/arc/BUILD.gn
[add] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/arc/common/BUILD.gn
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/arc/common/video_common.typemap
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/arc/common/video_encode_accelerator.typemap
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/arc/common/volume_mounter.typemap
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/arc/video_accelerator/BUILD.gn
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/viz/host/server_gpu_memory_buffer_manager_unittest.cc
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/viz/service/BUILD.gn
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/viz/service/gl/DEPS
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/viz/service/gl/gpu_service_impl.cc
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/viz/service/gl/gpu_service_impl.h
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/viz/service/main/BUILD.gn
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/viz/service/main/DEPS
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/components/viz/service/main/viz_main_impl.cc
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/content/public/app/mojo/content_browser_manifest.json
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/media/gpu/BUILD.gn
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/manifest.json
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/public/cpp/gpu/DEPS
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/public/cpp/gpu/gpu.cc
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/public/cpp/gpu/gpu.h
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/public/interfaces/BUILD.gn
[add] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/public/interfaces/arc.mojom
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/service.cc
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/service.h
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/ws/BUILD.gn
[add] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/ws/arc_client.cc
[add] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/ws/arc_client.h
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/ws/gpu_host.cc
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/ws/gpu_host.h
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/ui/ws/test_gpu_host.h
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/viz/privileged/interfaces/gl/BUILD.gn
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/services/viz/privileged/interfaces/gl/gpu_service.mojom
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/ui/aura/env.cc
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/ui/aura/env.h
[modify] https://crrev.com/417f0cf7506bf91c82b9e75b0036a2b41ff5b549/ui/aura/mus/window_tree_client.h

CL in #13 fixes the problem for mushrome. But mash still has the problem which is tracked in  issue 774514 .

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c3b0a9ba7ca55a3c11ff1179176992056dfcaeec

commit c3b0a9ba7ca55a3c11ff1179176992056dfcaeec
Author: Peng Huang <penghuang@chromium.org>
Date: Wed Nov 22 17:46:00 2017

mus: Remove the ui::mojom::ArcPtr in ui::Gpu

This CL moves ui::mojom::ArcPtr in ui::Gpu to
chrome/browser/chromeos/arc/video/gpu_arc_video_service_host.cc to only
create the ArcPtr for arc.

This CL also modifies GpuArcVideoServiceHost to only create
VideoAcceleratorFactory once to avoid unnecessary mojo IPC for creating
ArcPtr.

Test: Test ARC youtube app on device with and without --mus
Bug:  769755 
Change-Id: I6c6ee2926fef1afe9d94134ae0022484a1bd4ad4
Reviewed-on: https://chromium-review.googlesource.com/782099
Reviewed-by: Sadrul Chowdhury <sadrul@chromium.org>
Reviewed-by: Hidehiko Abe <hidehiko@chromium.org>
Commit-Queue: Peng Huang <penghuang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#518674}
[modify] https://crrev.com/c3b0a9ba7ca55a3c11ff1179176992056dfcaeec/chrome/browser/chromeos/arc/video/gpu_arc_video_service_host.cc
[modify] https://crrev.com/c3b0a9ba7ca55a3c11ff1179176992056dfcaeec/chrome/browser/chromeos/arc/video/gpu_arc_video_service_host.h
[modify] https://crrev.com/c3b0a9ba7ca55a3c11ff1179176992056dfcaeec/services/ui/public/cpp/gpu/DEPS
[modify] https://crrev.com/c3b0a9ba7ca55a3c11ff1179176992056dfcaeec/services/ui/public/cpp/gpu/gpu.cc
[modify] https://crrev.com/c3b0a9ba7ca55a3c11ff1179176992056dfcaeec/services/ui/public/cpp/gpu/gpu.h
[modify] https://crrev.com/c3b0a9ba7ca55a3c11ff1179176992056dfcaeec/ui/aura/env.cc
[modify] https://crrev.com/c3b0a9ba7ca55a3c11ff1179176992056dfcaeec/ui/aura/env.h
[modify] https://crrev.com/c3b0a9ba7ca55a3c11ff1179176992056dfcaeec/ui/aura/mus/window_tree_client.h