Open the attached example and you'll get the following BT:
[4:4:1122/095143.916140:FATAL:LayoutFlexibleBox.cpp(884)] Check failed: current_line->total_flex_grow >= 0 (-1 vs. 0)
#0 0x7f8a46b5563d base::debug::StackTrace::StackTrace()
#1 0x7f8a46b5558c base::debug::StackTrace::StackTrace()
#2 0x7f8a46bfd7aa logging::LogMessage::~LogMessage()
#3 0x7f8a3f26b3c5 blink::LayoutFlexibleBox::LayoutFlexItems()
#4 0x7f8a3f26abb4 blink::LayoutFlexibleBox::UpdateBlockLayout()
#5 0x7f8a3f207cbc blink::LayoutBlock::UpdateLayout()
#6 0x7f8a3f220dd0 blink::LayoutBlockFlow::PositionAndLayoutOnceIfNeeded()
#7 0x7f8a3f2213a0 blink::LayoutBlockFlow::LayoutBlockChild()
#8 0x7f8a3f21f2a4 blink::LayoutBlockFlow::LayoutBlockChildren()
#9 0x7f8a3f21b704 blink::LayoutBlockFlow::LayoutChildren()
#10 0x7f8a3f21b0e0 blink::LayoutBlockFlow::UpdateBlockLayout()
#11 0x7f8a3f207cbc blink::LayoutBlock::UpdateLayout()
#12 0x7f8a3f220dd0 blink::LayoutBlockFlow::PositionAndLayoutOnceIfNeeded()
#13 0x7f8a3f2213a0 blink::LayoutBlockFlow::LayoutBlockChild()
#14 0x7f8a3f21f2a4 blink::LayoutBlockFlow::LayoutBlockChildren()
#15 0x7f8a3f21b704 blink::LayoutBlockFlow::LayoutChildren()
#16 0x7f8a3f21b0e0 blink::LayoutBlockFlow::UpdateBlockLayout()
#17 0x7f8a3f207cbc blink::LayoutBlock::UpdateLayout()
#18 0x7f8a3f220dd0 blink::LayoutBlockFlow::PositionAndLayoutOnceIfNeeded()
#19 0x7f8a3f2213a0 blink::LayoutBlockFlow::LayoutBlockChild()
#20 0x7f8a3f21f2a4 blink::LayoutBlockFlow::LayoutBlockChildren()
#21 0x7f8a3f21b704 blink::LayoutBlockFlow::LayoutChildren()
#22 0x7f8a3f21b0e0 blink::LayoutBlockFlow::UpdateBlockLayout()
#23 0x7f8a3f207cbc blink::LayoutBlock::UpdateLayout()
#24 0x7f8a3f395752 blink::LayoutView::LayoutContent()
#25 0x7f8a3f39632a blink::LayoutView::UpdateLayout()

This was initially reported by Renata at https://bugs.webkit.org/show_bug.cgi?id=151105
but it seems it hasn't been fixed in Blink either.
Dunno if there's a duplicated bug report for this but I couldn't find it.

 

Deleted: crash.html 268 bytes

crash.html 268 bytes View Download