mash: Crash in viz::HostFrameSinkManager::RegisterFrameSinkId on first sign-in

On ToT @ #549307 build chrome os on linux desktop.
(1) chrome --enable-features=Mash --login-manager --user-data-dir=<some new temp dir>
(2) go through oobe and sign in for the first time with a pre-existing account
(3) wait a minute (likely for preferences to sync)
Expected: No crash
Actual: Crash, see stack below.

I hit the crash with one of my two test profiles, I'm not sure what the difference is.
FIWIW, crashing profile has a11y and kbd/lang system tray items and the other doesn't.
Perhaps Kyle knows more about the trigger from the OffscreenCanvasProviderImpl usage?

Received signal 11 SEGV_MAPERR 000000000080
#0 0x7fcc6d720f4c base::debug::StackTrace::StackTrace()
#1 0x7fcc6d720a41 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7fcc6d8af0c0 <unknown>
#3 0x7fcc66da029c base::flat_map<>::operator[]()
#4 0x7fcc66da0182 viz::HostFrameSinkManager::RegisterFrameSinkId()
#5 0x7fcc6ac77ef7 content::OffscreenCanvasSurfaceImpl::OffscreenCanvasSurfaceImpl()
#6 0x7fcc6ac76ba2 content::OffscreenCanvasProviderImpl::CreateOffscreenCanvasSurface()
#7 0x7fcc6ae9d39b blink::mojom::OffscreenCanvasProviderStubDispatch::Accept()
#8 0x7fcc6c9cfaa6 mojo::InterfaceEndpointClient::HandleValidatedMessage()
#9 0x7fcc6c9cf3e6 mojo::FilterChain::Accept()
#10 0x7fcc6c9d0dd5 mojo::InterfaceEndpointClient::HandleIncomingMessage()
#11 0x7fcc6c9d753c mojo::internal::MultiplexRouter::ProcessIncomingMessage()
#12 0x7fcc6c9d6940 mojo::internal::MultiplexRouter::Accept()
#13 0x7fcc6c9cf3e6 mojo::FilterChain::Accept()
#14 0x7fcc6c9ca5c3 mojo::Connector::ReadSingleMessage()
#15 0x7fcc6c9caff1 mojo::Connector::ReadAllAvailableMessages()
#16 0x7fcc6c9cae99 mojo::Connector::OnHandleReadyInternal()
#17 0x7fcc6c9cb727 mojo::SimpleWatcher::DiscardReadyState()
#18 0x7fcc6c993f26 mojo::SimpleWatcher::OnHandleReady()
#19 0x7fcc6c994431 _ZN4base8internal7InvokerINS0_9BindStateIMN4mojo13SimpleWatcherEFvijRKNS3_18HandleSignalsStateEEJNS_7WeakPtrIS4_EEijS5_EEEFvvEE7RunImplIRKS9_RKNSt3__15tupleIJSB_ijS5_EEEJLm0ELm1ELm2ELm3EEEEvOT_OT0_NSI_16integer_sequenceImJXspT1_EEEE
#20 0x7fcc6d7218e5 base::debug::TaskAnnotator::RunTask()
#21 0x7fcc6d754099 base::internal::IncomingTaskQueue::RunTask()
#22 0x7fcc6d757bdb base::MessageLoop::RunTask()
#23 0x7fcc6d757f6a base::MessageLoop::DeferOrRunPendingTask()
#24 0x7fcc6d7581cc base::MessageLoop::DoWork()
#25 0x7fcc6d75a5f9 base::MessagePumpLibevent::Run()
#26 0x7fcc6d757509 base::MessageLoop::Run()
#27 0x7fcc6d78e209 base::RunLoop::Run()
#28 0x55ad9957b8da ChromeBrowserMainParts::MainMessageLoopRun()
#29 0x7fcc6a93bb67 content::BrowserMainLoop::RunMainMessageLoopParts()
#30 0x7fcc6a93ec66 content::BrowserMainRunnerImpl::Run()
#31 0x7fcc6a937df9 content::BrowserMain()
#32 0x7fcc6b310f7d content::ContentMainRunnerImpl::Run()
#33 0x7fcc6dc66322 service_manager::Main()
#34 0x7fcc6b30f5f4 content::ContentMain()
#35 0x55ad989f6133 ChromeMain
#36 0x7fcc601a22b1 __libc_start_main
#37 0x55ad989f5faa _start