Repro steps:

1) Build Chrome with DCHECK on, macOS [10.12.6].
2) Load this sheet [using google account] https://docs.google.com/spreadsheets/d/1iQ707GcC4calJ8vfQ_ULIILh_LNmAFIlHvejKwmL3Pw/edit#gid=241942295

3) Open devtools. Enable timeline profiling.
4) Scroll the sheet up and down. ~30 seconds.
5) Stop timeline profiling

#
# Fatal error in ../../v8/src/profiler/heap-snapshot-generator.cc, line 1854
# Debug check failed: !is_weak.
#
0   libbase.dylib                       0x000000011375d33e base::debug::StackTrace::StackTrace(unsigned long) + 174
1   libbase.dylib                       0x000000011375d3fd base::debug::StackTrace::StackTrace(unsigned long) + 29
2   libbase.dylib                       0x000000011375b87c base::debug::StackTrace::StackTrace() + 28
3   libgin.dylib                        0x0000000129b39be5 gin::(anonymous namespace)::PrintStackTrace() + 37
4   libv8_libbase.dylib                 0x0000000139eabaac V8_Fatal(char const*, int, char const*, ...) + 220
5   libv8_libbase.dylib                 0x0000000139eab645 v8::base::(anonymous namespace)::DefaultDcheckHandler(char const*, int, char const*) + 21
6   libv8.dylib                         0x00000001032c6514 v8::internal::V8HeapExplorer::SetGcSubrootReference(v8::internal::VisitorSynchronization::SyncTag, bool, v8::internal::Object*) + 660
7   libv8.dylib                         0x00000001032c56fb v8::internal::RootsReferencesExtractor::FillReferences(v8::internal::V8HeapExplorer*) + 363
8   libv8.dylib                         0x00000001032c5406 v8::internal::V8HeapExplorer::IterateAndExtractReferences(v8::internal::SnapshotFiller*) + 406
9   libv8.dylib                         0x00000001032cc1b7 v8::internal::HeapSnapshotGenerator::GenerateSnapshot() + 375
10  libv8.dylib                         0x00000001032b898a v8::internal::HeapProfiler::TakeSnapshot(v8::ActivityControl*, v8::HeapProfiler::ObjectNameResolver*) + 106
11  libv8.dylib                         0x000000010368ca37 v8_inspector::V8HeapProfilerAgentImpl::takeHeapSnapshot(v8_inspector::protocol::Maybe<bool>) + 359
12  libv8.dylib                         0x000000010368c5a6 v8_inspector::V8HeapProfilerAgentImpl::stopTrackingHeapObjects(v8_inspector::protocol::Maybe<bool>) + 150
13  libv8.dylib                         0x000000010363526c v8_inspector::protocol::HeapProfiler::DispatcherImpl::stopTrackingHeapObjects(int, std::__1::unique_ptr<v8_inspector::protocol::DictionaryValue, std::__1::default_delete<v8_inspector::protocol::DictionaryValue> >, v8_inspector::protocol::ErrorSupport*) + 380
14  libv8.dylib                         0x0000000103633b12 v8_inspector::protocol::HeapProfiler::DispatcherImpl::dispatch(int, v8_inspector::String16 const&, std::__1::unique_ptr<v8_inspector::protocol::DictionaryValue, std::__1::default_delete<v8_inspector::protocol::DictionaryValue> >) + 146
15  libv8.dylib                         0x00000001036177f7 v8_inspector::protocol::UberDispatcher::dispatch(std::__1::unique_ptr<v8_inspector::protocol::Value, std::__1::default_delete<v8_inspector::protocol::Value> >, int*, v8_inspector::String16*) + 519