Synced to ToT and flashed via Simple Chrome. Once I log in, I get an immediate crash, then subsequent follow-up crashes every few seconds.

CC'ing sheriffs/gardeners

Stack trace:
#0  0x00007acdbfb0cdd2 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007acdbfb0ebf6 in __GI_abort () at abort.c:89
#2  0x00005b823bbe2b75 in base::debug::BreakDebugger() () at ../../base/debug/debugger_posix.cc:258
#3  0x00005b823bc032f6 in logging::LogMessage::~LogMessage() () at ../../base/logging.cc:855
#4  0x00005b823e101b3e in sync_preferences::PrefModelAssociator::RegisterPref(char const*) () at ../../components/sync_preferences/pref_model_associator.cc:457
#5  0x00005b823e0fd338 in sync_preferences::PrefServiceSyncable::AddRegisteredSyncablePreference(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, unsigned int) () at /usr/local/google/chromium/.cros_cache/chrome-sdk/tarballs/eve+10486.0.0+target_toolchain/usr/bin/../include/c++/v1/string:1320
#6  0x00005b823c85eb05 in user_prefs::PrefRegistrySyncable::OnPrefRegistered(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::Value*, unsigned int) () at ../../base/callback.h:124
#7  0x00005b823c868802 in PrefRegistry::RegisterPreference(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::unique_ptr<base::Value, std::__1::default_delete<base::Value> >, unsigned int) () at ../../components/prefs/pref_registry.cc:78
#8  0x00005b823c8684db in PrefRegistry::SetDefaultForeignPrefValue(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::unique_ptr<base::Value, std::__1::default_delete<base::Value> >, unsigned int) () at ../../components/prefs/pref_registry.cc:58
#9  0x00005b823a4308be in prefs::SharedPrefRegistry::ProcessPublicPrefs(std::__1::vector<mojo::StructPtr<prefs::mojom::PrefRegistration>, std::__1::allocator<mojo::StructPtr<prefs::mojom::PrefRegistration> > >, bool, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > >*) () at ../../services/preferences/shared_pref_registry.cc:149
#10 0x00005b823a42ff38 in prefs::SharedPrefRegistry::CreateConnectionBuilder(mojo::StructPtr<prefs::mojom::PrefRegistry>, service_manager::Identity const&, base::OnceCallback<void (mojo::StructPtr<prefs::mojom::PersistentPrefStoreConnection>, mojo::StructPtr<prefs::mojom::IncognitoPersistentPrefStoreConnection>, std::__1::vector<mojo::StructPtr<prefs::mojom::PrefRegistration>, std::__1::allocator<mojo::StructPtr<prefs::mojom::PrefRegistration> > >, std::__1::unordered_map<PrefValueStore::PrefStoreType, mojo::StructPtr<prefs::mojom::PrefStoreConnection>, std::__1::hash<PrefValueStore::PrefStoreType>, std::__1::equal_to<PrefValueStore::PrefStoreType>, std::__1::allocator<std::__1::pair<PrefValueStore::PrefStoreType const, mojo::StructPtr<prefs::mojom::PrefStoreConnection> > > >)>) () at ../../services/preferences/shared_pref_registry.cc:87
#11 0x00005b823a42da50 in prefs::PrefStoreManagerImpl::ConnectorConnection::Connect(mojo::StructPtr<prefs::mojom::PrefRegistry>, base::OnceCallback<void (mojo::StructPtr<prefs::mojom::PersistentPrefStoreConnection>, mojo::StructPtr<prefs::mojom::IncognitoPersistentPrefStoreConnection>, std::__1::vector<mojo::StructPtr<prefs::mojom::PrefRegistration>, std::__1::allocator<mojo::StructPtr<prefs::mojom::PrefRegistration> > >, std::__1::unordered_map<PrefValueStore::PrefStoreType, mojo::StructPtr<prefs::mojom::PrefStoreConnection>, std::__1::hash<PrefValueStore::PrefStoreType>, std::__1::equal_to<PrefValueStore::PrefStoreType>, std::__1::allocator<std::__1::pair<PrefValueStore::PrefStoreType const, mojo::StructPtr<prefs::mojom::PrefStoreConnection> > > >)>) () at ../../services/preferences/pref_store_manager_impl.cc:34
#12 0x00005b823986eb64 in prefs::mojom::PrefStoreConnectorStubDispatch::AcceptWithResponder(prefs::mojom::PrefStoreConnector*, mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) () at gen/services/preferences/public/mojom/preferences.mojom.cc:895
#13 0x00005b823a42d6f6 in prefs::mojom::PrefStoreConnectorStub<mojo::UniquePtrImplRefTraits<prefs::mojom::PrefStoreConnector> >::AcceptWithResponder(mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) ()
    at gen/services/preferences/public/mojom/preferences.mojom.h:483
#14 0x00005b823c1dc782 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) () at ../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:394
#15 0x00005b823c1dc356 in mojo::FilterChain::Accept(mojo::Message*) () at ../../mojo/public/cpp/bindings/lib/filter_chain.cc:40
#16 0x00005b823c1ddcd2 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) () at ../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:306
#17 0x00005b823c1e420e in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) () at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:880
#18 0x00005b823c1e35a3 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) () at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:604
#19 0x00005b823c1dc356 in mojo::FilterChain::Accept(mojo::Message*) () at ../../mojo/public/cpp/bindings/lib/filter_chain.cc:40
#20 0x00005b823c1da187 in mojo::Connector::ReadSingleMessage(unsigned int*) () at ../../mojo/public/cpp/bindings/lib/connector.cc:443
#21 0x00005b823c1dac04 in mojo::Connector::ReadAllAvailableMessages() () at ../../mojo/public/cpp/bindings/lib/connector.cc:472
#22 0x00005b823c1daa66 in mojo::Connector::OnHandleReadyInternal(unsigned int) () at ../../mojo/public/cpp/bindings/lib/connector.cc:373
#23 0x00005b82397aace4 in mojo::SimpleWatcher::DiscardReadyState(base::RepeatingCallback<void (unsigned int)> const&, unsigned int, mojo::HandleSignalsState const&) () at ../../base/callback.h:124
#24 0x00005b823c1d48e5 in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) () at ../../base/callback.h:124
#25 0x00005b823c1d4e6e in void base::internal::Invoker<base::internal::BindState<void (content::FrameInputHandlerImpl::*)(int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > const&), base::WeakPtr<content::FrameInputHandlerImpl>, int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > >, void ()>::RunImpl<void (content::FrameInputHandlerImpl::* const&)(int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > const&), std::__1::tuple<base::WeakPtr<content::FrameInputHandlerImpl>, int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > > const&, 0ul, 1ul, 2ul, 3ul>(void (content::FrameInputHandlerImpl::* const&)(int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > const&), std::__1::tuple<base::WeakPtr<content::FrameInputHandlerImpl>, int, int, std::__1::vector<ui::ImeTextSpan, std::__1::allocator<ui::ImeTextSpan> > > const&, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>) () at ../../base/bind_internal.h:447
#26 0x00005b823bbe4c7d in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) () at ../../base/callback.h:95
#27 0x00005b823bcac796 in base::internal::IncomingTaskQueue::RunTask(base::PendingTask*) () at ../../base/message_loop/incoming_task_queue.cc:124
#28 0x00005b823bc0a3fd in base::MessageLoop::RunTask(base::PendingTask*) () at ../../base/message_loop/message_loop.cc:391
#29 0x00005b823bc0a804 in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask) () at ../../base/message_loop/message_loop.cc:403
#30 0x00005b823bc0aac2 in base::MessageLoop::DoWork() () at ../../base/message_loop/message_loop.cc:447
#31 0x00005b823bc0ce39 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) () at ../../base/message_loop/message_pump_libevent.cc:220
#32 0x00005b823bc09c7c in base::MessageLoop::Run(bool) () at ../../base/message_loop/message_loop.cc:342
#33 0x00005b823bc39086 in base::RunLoop::Run() () at ../../base/run_loop.cc:130
#34 0x00005b823b810b87 in ChromeBrowserMainParts::MainMessageLoopRun(int*) () at ../../chrome/browser/chrome_browser_main.cc:2176
#35 0x00005b8239a50ce4 in content::BrowserMainLoop::RunMainMessageLoopParts() () at ../../content/browser/browser_main_loop.cc:1052
#36 0x00005b8239a53f63 in content::BrowserMainRunnerImpl::Run() () at ../../content/browser/browser_main_runner.cc:161
#37 0x00005b8239a4cace in content::BrowserMain(content::MainFunctionParams const&) () at ../../content/browser/browser_main.cc:46
#38 0x00005b823b7f6ac0 in content::RunNamedProcessTypeMain(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) () at ../../content/app/content_main_runner.cc:423
#39 0x00005b823b7f7bc4 in content::ContentMainRunnerImpl::Run() () at ../../content/app/content_main_runner.cc:703
#40 0x00005b823b80435e in service_manager::Main(service_manager::MainParams const&) () at ../../services/service_manager/embedder/main.cc:453
#41 0x00005b823b7f5f61 in content::ContentMain(content::ContentMainParams const&) () at ../../content/app/content_main.cc:19
#42 0x00005b8238c8a9bf in ChromeMain () at ../../chrome/app/chrome_main.cc:101
#43 0x00007acdbfaf9736 in __libc_start_main (main=0x5b8238c8a920 <main>, argc=39, argv=0x7fff94ab5158, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fff94ab5148) at ../csu/libc-start.c:289
#44 0x00005b8238c8a7d9 in _start ()