Created a minimized repro.
https://chromium-review.googlesource.com/c/chromium/src/+/997234

The root cause is that we could call ServiceWorkerSubresourceLoader::DeleteSoon() twice when a connection error occurs on |url_loader_binding_|.
- The class has a connection error handler which calls DeleteSoon().
- The class also calls DeleteSoon() when a request falls back to network or the controller SW is gone.

DeleteSoon() can be called twice, for example, when there is a connection error and the request falls back to network. I'll upload a fix soon.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2ad1f83a5d6e0008a11822e1b30a1c24b03e23e6

commit 2ad1f83a5d6e0008a11822e1b30a1c24b03e23e6
Author: Kenichi Ishibashi <bashi@chromium.org>
Date: Fri Apr 06 07:52:28 2018

S13nSW: Don't delete ServiceWorkerSubresourceLoader twice

Before this CL, DeleteSoon() could be called twice when a
connection error happens on |url_loader_binding_|.
- ServiceWorkerSubresourceLoader sets DeleteSoon() as the connection
  error handler.
- The class also calls DeleteSoon() when the loader is no longer needed.
  For example, it delete itself when a request falls back to network.

After this CL we just call delete directly as needed.
Existing DeleteSoon() is renamed to OnConnectionError() as it is only
used as the connection error handler.

Bug:  828257 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_mojo
Change-Id: I85737d0d6c33b747a4f70f5156b2b3b4b512f873
Reviewed-on: https://chromium-review.googlesource.com/997256
Commit-Queue: Kenichi Ishibashi <bashi@chromium.org>
Reviewed-by: Matt Falkenhagen <falken@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#548708}
[modify] https://crrev.com/2ad1f83a5d6e0008a11822e1b30a1c24b03e23e6/content/renderer/service_worker/service_worker_subresource_loader.cc
[modify] https://crrev.com/2ad1f83a5d6e0008a11822e1b30a1c24b03e23e6/content/renderer/service_worker/service_worker_subresource_loader.h
[modify] https://crrev.com/2ad1f83a5d6e0008a11822e1b30a1c24b03e23e6/third_party/WebKit/LayoutTests/FlagExpectations/enable-features=NetworkService