Please attach logs collected immediately after you see this.

On clicking sign-out, either of the below two things happens

1. Device display turns off. On clicking power button, device reboots. 
2. Start screen is displayed for a second and device reboots automatically.

So unable to capture logs immediately after the issue is seen.

Logs from eve device after device reboot: https://storage.cloud.google.com/chromiumos-test-logs/bugfiles/cr/831423/debug-logs_20180410-171552.tgz?_ga=2.221489368.-1949964863.1508264737

Thanks. eventlog:

...
309 | 2018-04-10 17:12:09 | System boot | 62
310 | 2018-04-10 17:12:09 | EC Event | Power Button
311 | 2018-04-10 17:12:09 | Power Button Override
312 | 2018-04-10 17:12:09 | ACPI Wake | Deep S5
313 | 2018-04-10 17:12:09 | Wake Source | Power Button | 0
314 | 2018-04-10 17:12:09 | Chrome OS Developer Mode
315 | 2018-04-10 17:12:29 | Kernel Event | Clean Shutdown
316 | 2018-04-10 17:12:34 | System boot | 63
317 | 2018-04-10 17:12:34 | System Reset
318 | 2018-04-10 17:12:34 | Chrome OS Developer Mode
319 | 2018-04-10 17:12:45 | Kernel Event | Clean Shutdown
320 | 2018-04-10 17:12:51 | System boot | 64
321 | 2018-04-10 17:12:51 | System Reset
322 | 2018-04-10 17:12:51 | Chrome OS Developer Mode
323 | 2018-04-10 17:14:53 | Kernel Event | Clean Shutdown
324 | 2018-04-10 17:14:57 | System boot | 65
325 | 2018-04-10 17:14:57 | System Reset
326 | 2018-04-10 17:14:57 | Chrome OS Developer Mode
EOF

I only see powerd.20180410-171518 (Apr 10 17:15) and powerd.20180411-001258 (Apr 10 17:14), though -- looks like the system clock was messed up.

Looks like Chrome is in a crash loop:

...
[0411/001447:INFO:suspend_delay_controller.cc(121)] Unregistering suspend delay 80543753 (chrome) due to D-Bus client :1.69 going away
[0411/001447:INFO:suspend_delay_controller.cc(121)] Unregistering dark suspend delay 80576519 (chrome) due to D-Bus client :1.69 going away
[0411/001447:INFO:daemon.cc(785)] D-Bus org.chromium.SessionManager ownership changed to :1.73
[0411/001447:INFO:suspend_delay_controller.cc(62)] Registering suspend delay 80543754 (chrome) of 5000 ms on behalf of :1.75
[0411/001447:INFO:suspend_delay_controller.cc(62)] Registering dark suspend delay 80576520 (chrome) of 5000 ms on behalf of :1.75
[0411/001447:INFO:daemon.cc(788)] D-Bus org.chromium.DisplayService ownership changed to :1.75
[0411/001447:INFO:display_power_setter.cc(81)] Asking DisplayService to turn all displays on
[0411/001448:INFO:daemon.cc(1332)] Chrome is using normal display mode
[0411/001448:INFO:suspend_delay_controller.cc(121)] Unregistering suspend delay 80543754 (chrome) due to D-Bus client :1.75 going away
[0411/001448:INFO:suspend_delay_controller.cc(121)] Unregistering dark suspend delay 80576520 (chrome) due to D-Bus client :1.75 going away
[0411/001448:INFO:suspend_delay_controller.cc(62)] Registering suspend delay 80543755 (chrome) of 5000 ms on behalf of :1.76
[0411/001448:INFO:suspend_delay_controller.cc(62)] Registering dark suspend delay 80576521 (chrome) of 5000 ms on behalf of :1.76
[0411/001448:INFO:daemon.cc(788)] D-Bus org.chromium.DisplayService ownership changed to :1.76
[0411/001448:INFO:display_power_setter.cc(81)] Asking DisplayService to turn all displays on
[0411/001448:INFO:daemon.cc(1332)] Chrome is using normal display mode
[0411/001448:INFO:suspend_delay_controller.cc(121)] Unregistering suspend delay 80543755 (chrome) due to D-Bus client :1.76 going away
[0411/001448:INFO:suspend_delay_controller.cc(121)] Unregistering dark suspend delay 80576521 (chrome) due to D-Bus client :1.76 going away
[0411/001449:INFO:suspend_delay_controller.cc(62)] Registering suspend delay 80543756 (chrome) of 5000 ms on behalf of :1.77
[0411/001449:INFO:suspend_delay_controller.cc(62)] Registering dark suspend delay 80576522 (chrome) of 5000 ms on behalf of :1.77
[0411/001449:INFO:daemon.cc(788)] D-Bus org.chromium.DisplayService ownership changed to :1.77
[0411/001449:INFO:display_power_setter.cc(81)] Asking DisplayService to turn all displays on
[0411/001449:INFO:daemon.cc(1332)] Chrome is using normal display mode
[0411/001449:INFO:suspend_delay_controller.cc(121)] Unregistering suspend delay 80543756 (chrome) due to D-Bus client :1.77 going away
[0411/001449:INFO:suspend_delay_controller.cc(121)] Unregistering dark suspend delay 80576522 (chrome) due to D-Bus client :1.77 going away
[0411/001449:INFO:suspend_delay_controller.cc(62)] Registering suspend delay 80543757 (chrome) of 5000 ms on behalf of :1.78
[0411/001449:INFO:suspend_delay_controller.cc(62)] Registering dark suspend delay 80576523 (chrome) of 5000 ms on behalf of :1.78
[0411/001449:INFO:daemon.cc(788)] D-Bus org.chromium.DisplayService ownership changed to :1.78
[0411/001449:INFO:display_power_setter.cc(81)] Asking DisplayService to turn all displays on
[0411/001449:INFO:daemon.cc(1332)] Chrome is using normal display mode
[0411/001450:INFO:suspend_delay_controller.cc(121)] Unregistering suspend delay 80543757 (chrome) due to D-Bus client :1.78 going away
[0411/001450:INFO:suspend_delay_controller.cc(121)] Unregistering dark suspend delay 80576523 (chrome) due to D-Bus client :1.78 going away
[0411/001450:INFO:suspend_delay_controller.cc(62)] Registering suspend delay 80543758 (chrome) of 5000 ms on behalf of :1.79
[0411/001450:INFO:suspend_delay_controller.cc(62)] Registering dark suspend delay 80576524 (chrome) of 5000 ms on behalf of :1.79
[0411/001450:INFO:daemon.cc(788)] D-Bus org.chromium.DisplayService ownership changed to :1.79
[0411/001450:INFO:display_power_setter.cc(81)] Asking DisplayService to turn all displays on
[0411/001450:INFO:daemon.cc(1332)] Chrome is using normal display mode
[0411/001450:INFO:suspend_delay_controller.cc(121)] Unregistering suspend delay 80543758 (chrome) due to D-Bus client :1.79 going away
[0411/001450:INFO:suspend_delay_controller.cc(121)] Unregistering dark suspend delay 80576524 (chrome) due to D-Bus client :1.79 going away
[0411/001450:INFO:suspend_delay_controller.cc(75)] Unregistering suspend delay 80543746 (shill) on behalf of :1.9
[0411/001450:INFO:suspend_delay_controller.cc(75)] Unregistering dark suspend delay 80576514 (shill) on behalf of :1.9
EOF

This is causing automatic reboots:

2018-04-11T00:14:50.595221+00:00 WARNING crash_reporter[5528]: [user] Received crash notification for chrome[5453] sig 11, user 1000 (ignoring call by k
ernel - chrome crash; waiting for chrome to call us directly)
2018-04-11T00:14:50.669949+00:00 INFO session_manager[5024]: [INFO:child_exit_handler.cc(77)] Handling 5453 exit.
2018-04-11T00:14:50.669965+00:00 ERR session_manager[5024]: [ERROR:child_exit_handler.cc(85)]   Exited with signal 11
2018-04-11T00:14:50.669976+00:00 INFO session_manager[5024]: [INFO:session_manager_service.cc(296)] Exiting process is chrome.
2018-04-11T00:14:50.669985+00:00 INFO session_manager[5024]: [INFO:browser_job.cc(156)] Terminating process group: Ensuring browser processes are gone.
2018-04-11T00:14:50.669995+00:00 INFO session_manager[5024]: [INFO:system_utils_impl.cc(94)] Sending 9 to -5453 as 1000
2018-04-11T00:14:50.671784+00:00 WARNING session_manager[5024]: [WARNING:session_manager_service.cc(320)] Child stopped, shutting down
2018-04-11T00:14:50.672060+00:00 INFO session_manager[5024]: [INFO:session_manager_service.cc(478)] SessionManagerService quitting run loop
2018-04-11T00:14:50.672271+00:00 INFO session_manager[5024]: [INFO:session_manager_service.cc(200)] SessionManagerService exiting
2018-04-11T00:14:50.673247+00:00 WARNING session_manager[5024]: [WARNING:session_manager_main.cc(240)] session_manager exiting with code 2
2018-04-11T00:14:50.675535+00:00 WARNING kernel: [  115.231778] init: ui main process (5024) terminated with status 2
2018-04-11T00:14:50.692522+00:00 NOTICE ui-respawn[5557]: Rebooting to mitigate crashiness.
2018-04-11T00:14:50.696579+00:00 WARNING kernel: [  115.253103] init: reboot: Undeclared imported variable RUNLEVEL=6
2018-04-11T00:14:50.696590+00:00 WARNING kernel: [  115.253115] init: reboot: Undeclared imported variable PREVLEVEL=N
2018-04-11T00:14:50.697505+00:00 NOTICE ui-respawn[5560]: ui failed with exit status 2.
2018-04-11T00:14:50.703210+00:00 NOTICE ui-respawn[5566]: Respawning ui.
...
2018-04-11T00:14:50.828250+00:00 NOTICE pre-shutdown[5687]: Shutting down for reboot: not-via-powerd

 Issue 831428  has been merged into this issue.

Does this happen when you sign out while in laptop mode?

There is no issue after sign-out while in laptop mode

This hasn't been updated since April 11 and it's tagged as a release blocker.  Please triage and escalate.  Thanks

This is easy to trigger on ToT. Here's a stack trace:

Received signal 11 SEGV_MAPERR 000000000018
#0 0x64b0ddf39d9c base::debug::StackTrace::StackTrace()
#1 0x64b0ddf39901 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7b9440a272e0 <unknown>
#3 0x64b0de90dda3 PrefService::GetPreferenceValue()
#4 0x64b0de90dd2e PrefService::GetBoolean()
#5 0x64b0dffbe9e4 ash::TouchDevicesController::UpdateTouchpadEnabled()
#6 0x64b0dffbe80f ash::TouchDevicesController::SetTouchpadEnabled()
#7 0x64b0e0098c60 ash::ScopedDisableInternalMouseAndKeyboardOzone::Disabler::~Disabler()
#8 0x64b0e0098c0d ash::ScopedDisableInternalMouseAndKeyboardOzone::~ScopedDisableInternalMouseAndKeyboardOzone()
#9 0x64b0dfff5f06 ash::TabletModeController::LidEventReceived()
#10 0x64b0dfff4db3 ash::TabletModeController::OnGetSwitchStates()
#11 0x64b0de8490a1 chromeos::PowerManagerClientImpl::OnGetSwitchStates()
#12 0x64b0dc59609e _ZN4base8internal7InvokerINS0_9BindStateIMN7content28BackgroundFetchDelegateProxy4CoreEFvNS_12OnceCallbackIFvRKN3gfx4SizeEEEESA_EJNS_7WeakPtrIS5_EESC_EEESB_E7RunOnceEPNS0_13BindStateBaseESA_
#13 0x64b0de8b6bd4 dbus::ObjectProxy::OnCallMethod()
#14 0x64b0de8b9813 _ZN4base8internal7InvokerINS0_9BindStateIMN4dbus11ObjectProxyEFvRKNSt3__112basic_stringIcNS5_11char_traitsIcEENS5_9allocatorIcEEEESD_NS_12OnceCallbackIFvPNS3_8ResponseEEEESG_PNS3_13ErrorResponseEEJ13scoped_refptrIS4_ESB_SB_SI_EEEFvSG_SK_EE7RunOnceEPNS0_13BindStateBaseESG_SK_
#15 0x64b0de8b7146 dbus::ObjectProxy::RunResponseOrErrorCallback()
#16 0x64b0de8ba071 _ZN4base8internal7InvokerINS0_9BindStateIMN4dbus11ObjectProxyEFvNS4_19ReplyCallbackHolderENS_9TimeTicksEPNS3_8ResponseEPNS3_13ErrorResponseEEJ13scoped_refptrIS4_ES5_S6_S8_SA_EEEFvvEE7RunOnceEPNS0_13BindStateBaseE
#17 0x64b0ddf0f4c9 base::(anonymous namespace)::PostTaskAndReplyRelay::RunTaskAndPostReply()
#18 0x64b0ddf0f701 _ZN4base8internal7InvokerINS0_9BindStateIPFvNS_12_GLOBAL__N_121PostTaskAndReplyRelayEEJS4_EEEFvvEE7RunOnceEPNS0_13BindStateBaseE
#19 0x64b0ddeb57cc base::debug::TaskAnnotator::RunTask()
#20 0x64b0ddecca67 base::MessageLoop::RunTask()
#21 0x64b0ddeccf47 base::MessageLoop::DoWork()
#22 0x64b0ddf475d9 base::MessagePumpLibevent::Run()
#23 0x64b0ddeecb25 base::RunLoop::Run()
#24 0x64b0ddbc9d78 ChromeBrowserMainParts::MainMessageLoopRun()
#25 0x64b0dc5d17e4 content::BrowserMainLoop::RunMainMessageLoopParts()
#26 0x64b0dc5d4242 content::BrowserMainRunnerImpl::Run()
#27 0x64b0dc5cdcb3 content::BrowserMain()
#28 0x64b0ddbb5183 content::ContentMainRunnerImpl::Run()
#29 0x64b0ddbbec84 service_manager::Main()
#30 0x64b0ddbb3271 content::ContentMain()
#31 0x64b0dbbf46fc ChromeMain
#32 0x7b943fa9b736 __libc_start_main
#33 0x64b0dbbf4529 _start
  r8: 0000000000000000  r9: 00000d2b960a2270 r10: 0000000000000000 r11: 000000000000108e
 r12: 0000000000000018 r13: 000064b0de848eb0 r14: 00007ffe09221cd0 r15: 0000000000000000
  di: 0000000000000000  si: 00007ffe09221cd0  bp: 00007ffe09221c90  bx: 0000000000000021
  dx: 0000000000000018  ax: 50bd5ad3cc3e4a00  cx: 0000000000000020  sp: 00007ffe09221b30
  ip: 000064b0de90dda3 efl: 0000000000010206 cgf: 0000000000000033 erf: 0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000018
[end of stack trace]

Just looking at recent changes, any chance https://chromium-review.googlesource.com/990677 could be related?

Sounds related. will look into.

Issue 833670 has been merged into this issue.

@derat; can you tell me the reproducible steps? I think I have a fix, but couldn't reproduce on my environment somehow.

I tried running a chrome with --ash-debug-shortcuts, Ctrl-alt-shift-t -> open uber tray -> logout; but this seems to quit successfully.

For me, it was just:

a) Boot the device in laptop mode
b) Type password to log in
c) Fold the lid back far enough that the device enters tablet mode
d) Open the system tray and tap "Sign out"

The UI freezes for me at this point, and /var/log/ui/ui.LATEST shows that Chrome is continually segfaulting.

Since the stack trace makes it look like the crash is triggered by a GetSwitchStates D-Bus reply from powerd, I could believe that this is timing-dependent (e.g. maybe sometimes the reply is received before prefs have been initialized).

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f14c9698e27b8708b0ad15fcb7931e3001809f27

commit f14c9698e27b8708b0ad15fcb7931e3001809f27
Author: Jun Mukai <mukai@google.com>
Date: Tue Apr 24 01:40:46 2018

fix a crash on exiting tablet mode

Bug:  831423 
Test: None
Change-Id: If8e8a2e88d009dfea258b79f6b914444f28816ee
Reviewed-on: https://chromium-review.googlesource.com/1024735
Reviewed-by: Dan Erat <derat@chromium.org>
Commit-Queue: Jun Mukai <mukai@chromium.org>
Cr-Commit-Position: refs/heads/master@{#552948}
[modify] https://crrev.com/f14c9698e27b8708b0ad15fcb7931e3001809f27/ash/touch/touch_devices_controller.cc

crrev.com/552948 should fix the issue. derat -- can you confirm that?

Thanks! I can confirm that I no longer see the crash when following the same steps using Chrome r553243.

Approving merge to M67 Chrome OS.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/815be2205db97e3fb3fd5b876ebc74f797e809e2

commit 815be2205db97e3fb3fd5b876ebc74f797e809e2
Author: Jun Mukai <mukai@google.com>
Date: Tue Apr 24 22:57:38 2018

fix a crash on exiting tablet mode

Bug:  831423 
Test: None
Change-Id: If8e8a2e88d009dfea258b79f6b914444f28816ee
Reviewed-on: https://chromium-review.googlesource.com/1024735
Reviewed-by: Dan Erat <derat@chromium.org>
Commit-Queue: Jun Mukai <mukai@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#552948}(cherry picked from commit f14c9698e27b8708b0ad15fcb7931e3001809f27)
Reviewed-on: https://chromium-review.googlesource.com/1026592
Reviewed-by: Jun Mukai <mukai@chromium.org>
Cr-Commit-Position: refs/branch-heads/3396@{#270}
Cr-Branched-From: 9ef2aa869bc7bc0c089e255d698cca6e47d6b038-refs/heads/master@{#550428}
[modify] https://crrev.com/815be2205db97e3fb3fd5b876ebc74f797e809e2/ash/touch/touch_devices_controller.cc

Verified on ChromeOS  10575.58.0, 67.0.3396.99 stable-channel eve