I can repro.  We appear to be calling a null v8 function callback.

00 chrome_child!v8::internal::HandleBase::operator*
01 chrome_child!v8::internal::Handle<v8::internal::Object>::operator*
02 chrome_child!v8::internal::Handle<v8::internal::Object>::operator->
03 chrome_child!v8::internal::`anonymous namespace'::Invoke
04 chrome_child!v8::internal::`anonymous namespace'::CallInternal
05 chrome_child!v8::internal::Execution::Call
06 chrome_child!v8::Function::Call
07 chrome_child!blink::V8ScriptRunner::CallFunction
08 chrome_child!blink::V8FrameRequestCallback::Invoke
09 chrome_child!blink::V8FrameRequestCallback::InvokeAndReportException
0a chrome_child!blink::FrameRequestCallbackCollection::ExecuteCallbacks
0b chrome_child!blink::ScriptedAnimationController::ExecuteCallbacks
0c chrome_child!blink::ScriptedAnimationController::ServiceScriptedAnimations
0d chrome_child!blink::VRDisplay::ProcessScheduledAnimations
0e chrome_child!blink::FrameRequestCallbackCollection::ExecuteCallbacks
0f chrome_child!blink::ScriptedAnimationController::ExecuteCallbacks

Still investigating why.

hmmm...

It is probably breaking assumptions that chrome_child!blink::FrameRequestCallbackCollection::ExecuteCallbacks calls VRDisplay::ProcessScheduledAnimations, which calls chrome_child!blink::FrameRequestCallbackCollection::ExecuteCallbacks again.  This reentrancy is probably the issue.

hmmm... we have a different ScriptedAnimationController, so the theory in comment 2 is probably incorrect.

More data - The garbage collector is cleaning up the registered callback even though we are still holding a reference chain to it.

In my debugging, it seems to be getting cleaned up even though VRDisplay::TraceWrapper isn't getting called.  VRDisplay::Trace is called.

See crash c73bab46fc8fc784.  This happens on Android too.

I think starting OpenVR triggers focus change, which triggers GC and avoids processing animation frames for a bit so timing makes it pretty easy to repro.

See crbug/792604 for a related bug.

billorr@, if the issue is reproducible, could you confirm that the following patch fixes this issue?
https://chromium-review.googlesource.com/c/chromium/src/+/870330

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/113dc30a074ce43885015594c0bb992bd51ba43e

commit 113dc30a074ce43885015594c0bb992bd51ba43e
Author: Yuki Shiino <yukishiino@chromium.org>
Date: Wed Jan 17 11:43:44 2018

v8binding: Fixes VRDisplay::HasPendingActivity.

VRDisplay::HasPendingActivity doesn't take registered callbacks
into considerations, so VRDisplay's wrapper object might be
gone while callbacks are registered.  Then, there will be no
object that invokes wrapper-tracing for callback objects.

This patch makes HasPendingActivity return true if any callback
is currently registered.

Bug:  793420 , 792604
Change-Id: Iecf402c3140f521b99afe5ccc688ecb7c6531dfd
Reviewed-on: https://chromium-review.googlesource.com/870330
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#529711}
[modify] https://crrev.com/113dc30a074ce43885015594c0bb992bd51ba43e/third_party/WebKit/Source/core/dom/ScriptedAnimationController.cpp
[modify] https://crrev.com/113dc30a074ce43885015594c0bb992bd51ba43e/third_party/WebKit/Source/core/dom/ScriptedAnimationController.h
[modify] https://crrev.com/113dc30a074ce43885015594c0bb992bd51ba43e/third_party/WebKit/Source/modules/vr/VRDisplay.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2f365a763e03a91efba881bda6aeb05d7b5f66ea

commit 2f365a763e03a91efba881bda6aeb05d7b5f66ea
Author: Yuki Shiino <yukishiino@chromium.org>
Date: Wed Jan 17 13:44:17 2018

v8binding: Fixes VRDisplay::HasPendingActivity (follow-up).

https://crrev.com/870330 assumes that
|scripted_animation_controller_| always exists, but it's not true.
Adds an extra check for existence of
|scripted_animation_controller_|.

Bug:  793420 , 792604
Change-Id: I8e1fadb631147175b19ddcc3b60ea26568ada90e
Reviewed-on: https://chromium-review.googlesource.com/870410
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Hitoshi Yoshida <peria@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#529724}
[modify] https://crrev.com/2f365a763e03a91efba881bda6aeb05d7b5f66ea/third_party/WebKit/Source/modules/vr/VRDisplay.cpp

Thank you yukishiino@, your patch appears to fix this issue.  I was previously able to repro 75% of the time, but haven't yet been able to repro with the patch.