To reproduce run debug chrome with --single-process and navigate to http://sfgate.com

Here's the callstack:

[39828:39952:0314/161749.584372:FATAL:ref_counted.h(61)] Check failed: CalledOnValidSequence(). 
[Thread 0x7fffa97c7700 (LWP 41978) exited]
[Thread 0x7fffc4b0c700 (LWP 41965) exited]
[New Thread 0x7fffc4b0c700 (LWP 42046)]

Program received signal SIGTRAP, Trace/breakpoint trap.
base::debug::(anonymous namespace)::DebugBreak () at ../../base/debug/debugger_posix.cc:239
239	}
(gdb) bt
#0  base::debug::(anonymous namespace)::DebugBreak () at ../../base/debug/debugger_posix.cc:239
#1  0x00007ffff7665c38 in base::debug::BreakDebugger () at ../../base/debug/debugger_posix.cc:258
#2  0x00007ffff76f19a5 in logging::LogMessage::~LogMessage (this=0x7fffbb6e3f40) at ../../base/logging.cc:855
#3  0x00007fffed034fea in base::subtle::RefCountedBase::AddRef (this=0x9d61b55db60) at ../../base/memory/ref_counted.h:61
#4  0x00007fffed034dd5 in base::RefCounted<network::HttpRawRequestResponseInfo, base::DefaultRefCountedTraits<network::HttpRawRequestResponseInfo> >::AddRef (
    this=0x9d61b55db60) at ../../base/memory/ref_counted.h:313
#5  0x00007fffed034db5 in scoped_refptr<network::HttpRawRequestResponseInfo>::AddRef (ptr=0x9d61b55db60) at ../../base/memory/scoped_refptr.h:274
#6  0x00007fffed034d95 in scoped_refptr<network::HttpRawRequestResponseInfo>::scoped_refptr (this=0x7fffbb6e5440, p=0x9d61b55db60) at ../../base/memory/scoped_refptr.h:176
#7  0x00007fffed05b4f0 in scoped_refptr<network::HttpRawRequestResponseInfo>::scoped_refptr (this=0x7fffbb6e5440, r=...) at ../../base/memory/scoped_refptr.h:181
#8  0x00007fffed05b206 in network::ResourceResponseInfo::ResourceResponseInfo (this=0x7fffbb6e52d8, other=...) at ../../services/network/public/cpp/resource_response_info.cc:34
#9  0x00007ffff2b92eeb in content::WebURLLoaderImpl::Context::OnReceivedResponse (this=0x9d61bf8e020, initial_info=...)
    at ../../content/renderer/loader/web_url_loader_impl.cc:812
#10 0x00007ffff2b9643c in content::WebURLLoaderImpl::RequestPeerImpl::OnReceivedResponse (this=0x9d61a55cde0, info=...)
    at ../../content/renderer/loader/web_url_loader_impl.cc:1105
#11 0x00007ffff2b69240 in content::ResourceDispatcher::OnReceivedResponse (this=0x9d615b18aa0, request_id=507, response_head=...)
    at ../../content/renderer/loader/resource_dispatcher.cc:176
#12 0x00007ffff2b84231 in content::URLLoaderClientImpl::OnReceiveResponse (this=0x9d61706b4a0, response_head=..., ssl_info=..., downloaded_file=...)
    at ../../content/renderer/loader/url_loader_client_impl.cc:244
#13 0x00007ffff06a348d in content::ThrottlingURLLoader::OnReceiveResponse (this=0x9d6159ab720, response_head=..., ssl_info=..., downloaded_file=...)
    at ../../content/common/throttling_url_loader.cc:339
#14 0x00007ffff0486294 in network::mojom::URLLoaderClientProxy_OnReceiveResponse_Message::Dispatch (this=0x9d618709020, impl=0x9d6159ab720)
    at gen/services/network/public/mojom/url_loader.mojom.cc:984
#15 0x00007ffff047aefe in network::mojom::URLLoaderClientStubDispatch::Accept (impl=0x9d6159ab720, message=0x7fffbb6e9450)
    at gen/services/network/public/mojom/url_loader.mojom.cc:1955
#16 0x00007ffff06a7713 in network::mojom::URLLoaderClientStub<mojo::RawPtrImplRefTraits<network::mojom::URLLoaderClient> >::Accept (this=0x9d6159ab7a0, message=0x7fffbb6e9450)
    at gen/services/network/public/mojom/url_loader.mojom.h:457
#17 0x00007ffff5ae3b98 in mojo::InterfaceEndpointClient::HandleValidatedMessage (this=0x9d618373560, message=0x7fffbb6e9450)
    at ../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:419
#18 0x00007ffff5ae2601 in mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept (this=0x9d618373590, message=0x7fffbb6e9450)
    at ../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:133
#19 0x00007ffff5ae0ab2 in mojo::FilterChain::Accept (this=0x9d6183735a0, message=0x7fffbb6e9450) at ../../mojo/public/cpp/bindings/lib/filter_chain.cc:40
#20 0x00007ffff5ae67a5 in mojo::InterfaceEndpointClient::HandleIncomingMessage (this=0x9d618373560, message=0x7fffbb6e9450)
    at ../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:306
#21 0x00007ffff5af2d0b in mojo::internal::MultiplexRouter::ProcessIncomingMessage (this=0x9d6153f7b20, message_wrapper=0x7fffbb6e9d08, 
    client_call_behavior=mojo::internal::MultiplexRouter::ALLOW_DIRECT_CLIENT_CALLS, current_task_runner=0x9d61b206920)
    at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:880
#22 0x00007ffff5af2255 in mojo::internal::MultiplexRouter::Accept (this=0x9d6153f7b20, message=0x7fffbb6ea468) at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:604
#23 0x00007ffff5ae0ab2 in mojo::FilterChain::Accept (this=0x9d6153f7b58, message=0x7fffbb6ea468) at ../../mojo/public/cpp/bindings/lib/filter_chain.cc:40
#24 0x00007ffff5ad2a8f in mojo::Connector::ReadSingleMessage (this=0x9d6153f7b80, read_result=0x7fffbb6ea65c) at ../../mojo/public/cpp/bindings/lib/connector.cc:445
#25 0x00007ffff5ad3aca in mojo::Connector::ReadAllAvailableMessages (this=0x9d6153f7b80) at ../../mojo/public/cpp/bindings/lib/connector.cc:474
#26 0x00007ffff5ad3892 in mojo::Connector::OnHandleReadyInternal (this=0x9d6153f7b80, result=0) at ../../mojo/public/cpp/bindings/lib/connector.cc:375
#27 0x00007ffff5ad377b in mojo::Connector::OnWatcherHandleReady (this=0x9d6153f7b80, result=0) at ../../mojo/public/cpp/bindings/lib/connector.cc:352
#28 0x00007ffff5ad714f in base::internal::FunctorTraits<void (mojo::Connector::*)(unsigned int), void>::Invoke<mojo::Connector*, unsigned int>(void (mojo::Connector::*)(unsigned int), mojo::Connector*&&, unsigned int&&) (method=
    (void (mojo::Connector::*)(mojo::Connector * const, unsigned int)) 0x7ffff5ad3760 <mojo::Connector::OnWatcherHandleReady(unsigned int)>, 
    receiver_ptr=<unknown type in /media/alph/work/chromium/src/out/Debug/./libbindings.so, CU 0x0, DIE 0x1949e>, 
    args=<unknown type in /media/alph/work/chromium/src/out/Debug/./libbindings.so, CU 0x0, DIE 0x194ab>) at ../../base/bind_internal.h:447
#29 0x00007ffff5ad70af in base::internal::InvokeHelper<false, void>::MakeItSo<void (mojo::Connector::* const&)(unsigned int), mojo::Connector*, unsigned int>(void (mojo::Connector::* const&)(unsigned int), mojo::Connector*&&, unsigned int&&) (functor=
    @0x9d61861a200: (void (mojo::Connector::*)(mojo::Connector * const, unsigned int)) 0x7ffff5ad3760 <mojo::Connector::OnWatcherHandleReady(unsigned int)>, 
    args=<unknown type in /media/alph/work/chromium/src/out/Debug/./libbindings.so, CU 0x0, DIE 0x19415>, 
    args=<unknown type in /media/alph/work/chromium/src/out/Debug/./libbindings.so, CU 0x0, DIE 0x19415>) at ../../base/bind_internal.h:530
#30 0x00007ffff5ad7045 in base::internal::Invoker<base::internal::BindState<void (mojo::Connector::*)(unsigned int), base::internal::UnretainedWrapper<mojo::Connector> >, void (unsigned int)>::RunImpl<void (mojo::Connector::* const&)(unsigned int), std::__1::tuple<base::internal::UnretainedWrapper<mojo::Connector> > const&, 0ul>(void (mojo::Connector::* const&)(unsigned int), std::__1::tuple<base::internal::UnretainedWrapper<mojo::Connector> > const&, std::__1::integer_sequence<unsigned long, 0ul>, unsigned int&&) (functor=
    @0x9d61861a200: (void (mojo::Connector::*)(mojo::Connector * const, unsigned int)) 0x7ffff5ad3760 <mojo::Connector::OnWatcherHandleReady(unsigned int)>, bound=..., 
    unbound_args=<unknown type in /media/alph/work/chromium/src/out/Debug/./libbindings.so, CU 0x0, DIE 0x12884>) at ../../base/bind_internal.h:604
#31 0x00007ffff5ad6f7b in base::internal::Invoker<base::internal::BindState<void (mojo::Connector::*)(unsigned int), base::internal::UnretainedWrapper<mojo::Connector> >, void (unsigned int)>::Run(base::internal::BindStateBase*, unsigned int) (base=0x9d61861a1e0, unbound_args=0) at ../../base/bind_internal.h:586
#32 0x00007ffff5ace05e in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & (this=0x9d618ad73c8, args=0) at ../../base/callback.h:124
#33 0x00007ffff5ad61cf in mojo::SimpleWatcher::DiscardReadyState(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&) (
    callback=..., result=0, state=...) at ../../mojo/public/cpp/system/simple_watcher.h:194
#34 0x00007ffff5ad6444 in base::internal::FunctorTraits<void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), void>::Invoke<base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&>(void (*)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&, unsigned int&&, mojo::HandleSignalsState const&) (
    function=0x7ffff5ad61b0 <mojo::SimpleWatcher::DiscardReadyState(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&)>, 
    args=..., args=..., args=...) at ../../base/bind_internal.h:402
#35 0x00007ffff5ad63f0 in base::internal::InvokeHelper<false, void>::MakeItSo<void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&>(void (* const&)(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&), base::RepeatingCallback<void (unsigned int)> const&, unsigned int&&, mojo::HandleSignalsState const&) (
    functor=@0x9d618ad73c0: 0x7ffff5ad61b0 <mojo::SimpleWatcher::DiscardReadyState(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&)>, args=..., args=..., args=...) at ../../base/bind_internal.h:530