Chrome Version: ToT - 65.0.3317.0 (Developer Build) (64-bit), 577dabea789a3e6b42c4072e4ad63fa411b2f3f2-refs/heads/master@{#527904}
OS: Ubuntu Linux x64

What steps will reproduce the problem?
(1) Open https://hotel.muji.com/shenzhen/ja/

What is the expected result?
No crash

What happens instead?
Crash

Please use labels and text to provide additional information.
Crash logs vary for each execution:

Example 1:

Fontconfig warning: "/etc/fonts/fonts.conf", line 146: blank doesn't take any effect anymore. please remove it from your fonts.conf
[1:25:0110/162745.525696:ERROR:data_pipe_consumer_dispatcher.cc(440)] Failed to map shared buffer.
[1:25:0110/162745.525864:FATAL:data_pipe_consumer_dispatcher.cc(428)] Check failed: is_closed_ && !shared_ring_buffer_ && !ring_buffer_mapping_ && !in_transit_.
#0 0x7f0cf169d94c base::debug::StackTrace::StackTrace()
#1 0x7f0cf16c7d1c logging::LogMessage::~LogMessage()
#2 0x7f0ced029b6a mojo::edk::DataPipeConsumerDispatcher::~DataPipeConsumerDispatcher()
#3 0x7f0ced029c1e mojo::edk::DataPipeConsumerDispatcher::~DataPipeConsumerDispatcher()
#4 0x7f0ced0299bf mojo::edk::DataPipeConsumerDispatcher::Deserialize()
#5 0x7f0ced02cea9 mojo::edk::Dispatcher::Deserialize()
#6 0x7f0ced04369a mojo::edk::UserMessageImpl::ExtractSerializedHandles()
#7 0x7f0ced023fb6 mojo::edk::Core::GetSerializedMessageContents()
#8 0x7f0ced04e010 MojoGetSerializedMessageContentsImpl
#9 0x7f0cf08d8b6d mojo::Message::Message()
#10 0x7f0cf08db0ff mojo::ReadMessage()
#11 0x7f0cf08cec28 mojo::Connector::ReadSingleMessage()
#12 0x7f0cf08cfa14 mojo::Connector::ReadAllAvailableMessages()
#13 0x7f0cf08cf876 mojo::Connector::OnHandleReadyInternal()
#14 0x7f0cf08d01b4 mojo::SimpleWatcher::DiscardReadyState()
#15 0x7f0cf088ee65 mojo::SimpleWatcher::OnHandleReady()
#16 0x7f0cf088f3ee _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo13SimpleWatcherEFvijRKNS3_18HandleSignalsStateEEJNS_7WeakPtrIS4_EEijS5_EEEFvvEE7RunImplIRKS9_RKNSt3__15tupleIJSB_ijS5_EEEJLm0ELm1ELm2ELm3EEEEvOT_OT0_NSI_16integer_sequenceImJXspT1_EEEE
#17 0x7f0cf169e26a base::debug::TaskAnnotator::RunTask()
#18 0x7f0ce8f569a1 blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue()
#19 0x7f0ce8f5628e blink::scheduler::TaskQueueManager::DoWork()
#20 0x7f0ce8f5afd8 _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvNS4_8internal8Sequence8WorkTypeEEJNS_7WeakPtrIS5_EES8_EEEFvvEE3RunEPNS0_13BindStateBaseE
#21 0x7f0cf169e26a base::debug::TaskAnnotator::RunTask()
#22 0x7f0ce8f5d178 blink::scheduler::internal::ThreadControllerImpl::DoWork()
#23 0x7f0ce8f5afd8 _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvNS4_8internal8Sequence8WorkTypeEEJNS_7WeakPtrIS5_EES8_EEEFvvEE3RunEPNS0_13BindStateBaseE
#24 0x7f0cf169e26a base::debug::TaskAnnotator::RunTask()
#25 0x7f0cf16d15e6 base::internal::IncomingTaskQueue::RunTask()
#26 0x7f0cf16d5817 base::MessageLoop::RunTask()
#27 0x7f0cf16d5c34 base::MessageLoop::DeferOrRunPendingTask()
#28 0x7f0cf16d5ef8 base::MessageLoop::DoWork()
#29 0x7f0cf16d7390 base::MessagePumpDefault::Run()
#30 0x7f0cf16d506c base::MessageLoop::Run()
#31 0x7f0cf170c506 base::RunLoop::Run()
#32 0x7f0cf174fb9a base::Thread::Run()
#33 0x7f0cf1750193 base::Thread::ThreadMain()
#34 0x7f0cf17464cf base::(anonymous namespace)::ThreadFunc()
#35 0x7f0cf17e9184 start_thread
#36 0x7f0ce4c51ffd clone

Received signal 6
#0 0x7f0cf169d94c base::debug::StackTrace::StackTrace()
#1 0x7f0cf169d421 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f0cf17f1330 <unknown>
#3 0x7f0ce4b8ac37 gsignal
#4 0x7f0ce4b8e028 abort
#5 0x7f0cf169abe5 q^Chajimehoshi@hajimehoshi-z840:~/chromium/src$ ./out/Default/chrome
Fontconfig warning: "/etc/fonts/fonts.conf", line 146: blank doesn't take any effect anymore. please remove it from your fonts.conf
^N^P

^C[82825:82825:0110/163012.365490:ERROR:selection_owner.cc(179)] SelectionClear


Example 2:

Fontconfig warning: "/etc/fonts/fonts.conf", line 146: blank doesn't take any effect anymore. please remove it from your fonts.conf
[1:42:0110/163122.282576:ERROR:platform_thread_posix.cc(123)] pthread_create: Resource temporarily unavailable (11)
[1:1:0110/163122.285127:ERROR:data_pipe_consumer_dispatcher.cc(440)] Failed to map shared buffer.

<--- Last few GCs --->


<--- JS stacktrace --->

==== JS stack trace =========================================

Security context: 0x356225ac831 <DedicatedWorkerGlobalScope map = 0x2cfda82893c1>
    2: receive [blob:https://hotel.muji.com/391ccdd4-b3e5-4ce5-aa36-9ace707fc142:305] [bytecode=0xf2c51465679 offset=9](this=0x24b8667e8571 <Actor map = 0x2cfda82b0f61>,t=0x24b8667eb389 <MessageEvent map = 0x2cfda82b1641>)

==== Details ================================================

[2]: receive [blob:https://hotel.muji.com/391ccdd4-b3e5-4ce5-aa36-9ace707...