Chrome Version       : 65.0.3325.146
OS Version: linux (Debian 4.9.82-1+deb9u2 (2018-02-21) x86_64 GNU/Linux)
URLs (if applicable) : https://292-73026e3-tainted-martiniss-dot-cq-analyzer.appspot.com/
Other browsers tested:
  Add OK or FAIL after other browsers where you have tested this issue:
     Safari: Not tested
    Firefox: OK
    IE/Edge: Not tested

What steps will reproduce the problem?
1. Go to https://292-73026e3-tainted-martiniss-dot-cq-analyzer.appspot.com/app/limiting?startDate=2018-03-03&endDate=2018-03-10
2. Log in with a google.com account

What is the expected result?
The web page renders ok

What happens instead of that?
The web page crashes, goes to "Aw snap".

Please provide any additional information below. Attach a screenshot if
possible.

UserAgentString: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36


This seems to reproduce on linux google machines; I had a coworker test it who also runs linux. Doesn't seem to reproduce on Mac or Chrome OS.

This was working this Monday as far as I know, so it's strange it crashes now. 

I visited the website with a debug build built at 59c6647d213a63c63a5671048c08577ca961dfae and got the following crash log:

#
# Fatal error in ../../v8/src/objects.cc, line 13691
# Check failed: requested_embedder_fields <= max_nof_fields - *in_object_properties (2 vs. 0).
#
#
#
#FailureMessage Object: 0x7ffe75e9c110#0 0x7f03c89826ad base::debug::StackTrace::StackTrace()
#1 0x7f03c8980b9c base::debug::StackTrace::StackTrace()
#2 0x7f03b80351a7 gin::(anonymous namespace)::PrintStackTrace()
#3 0x7f03a7c2a7a8 V8_Fatal()
#4 0x7f03b7b63094 v8::internal::JSFunction::CalculateInstanceSizeHelper()
#5 0x7f03b7b68a44 v8::internal::JSFunction::CalculateInstanceSizeForDerivedClass()
#6 0x7f03b7b135ca v8::internal::JSFunction::GetDerivedMap()
#7 0x7f03b7b12f4a v8::internal::JSObject::New()
#8 0x7f03b7475821 v8::internal::(anonymous namespace)::InstantiateObject()
#9 0x7f03b747558e v8::internal::ApiNatives::InstantiateObject()
#10 0x7f03b756b12c v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
#11 0x7f03b756a4ef v8::internal::Builtin_Impl_HandleApiCall()
#12 0x7f03b7569f8d v8::internal::Builtin_HandleApiCall()
#13 0x3ec9b3284ae4 <unknown>
Received signal 4 ILL_ILLOPN 7f03a7c2f7d2
#0 0x7f03c89826ad base::debug::StackTrace::StackTrace()
#1 0x7f03c8980b9c base::debug::StackTrace::StackTrace()
#2 0x7f03c8982075 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#3 0x7f03c8ee50c0 <unknown>
#4 0x7f03a7c2f7d2 v8::base::OS::Abort()
#5 0x7f03b7b63094 v8::internal::JSFunction::CalculateInstanceSizeHelper()
#6 0x7f03b7b68a44 v8::internal::JSFunction::CalculateInstanceSizeForDerivedClass()
#7 0x7f03b7b135ca v8::internal::JSFunction::GetDerivedMap()
#8 0x7f03b7b12f4a v8::internal::JSObject::New()
#9 0x7f03b7475821 v8::internal::(anonymous namespace)::InstantiateObject()
#10 0x7f03b747558e v8::internal::ApiNatives::InstantiateObject()
#11 0x7f03b756b12c v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
#12 0x7f03b756a4ef v8::internal::Builtin_Impl_HandleApiCall()
#13 0x7f03b7569f8d v8::internal::Builtin_HandleApiCall()
#14 0x3ec9b3284ae4 <unknown>
  r8: 00007f03ae0fc750  r9: 00007f039fd40ac0 r10: 0000000000000000 r11: 0000000000000000
 r12: 00007f03b719184f r13: 00007ffe75e9c5d0 r14: 000000000000357b r15: 00007f03b71762bd
  di: 00007f03ae0fb520  si: 00007f03ae0fc750  bp: 00007ffe75e9c610  bx: 00007f03ae0fb6e0
  dx: 0000000000000000  ax: 0000000000000000  cx: 0000000000000b40  sp: 00007ffe75e9c108
  ip: 00007f03a7c2f7d2 efl: 0000000000010202 cgf: 002b000000000033 erf: 0000000000000000
 trp: 0000000000000006 msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]
Calling _exit(1). Core file will not be generated.