From the logs I see that

Thread 0 (crashed)
	 0  chrome!blink::HTMLDocumentParser::EnqueueTokenizedChunk(std::__1::unique_ptr<blink::HTMLDocumentParser::TokenizedChunk, std::__1::default_delete<blink::HTMLDocumentParser::TokenizedChunk> >) + 0x47
	    rax = 0xa855195038989900   rdx = 0x0000000000000000
	    rcx = 0x00000000000003e8   rbx = 0x0000562d5f658d40
	    rsi = 0x00007ffefcbdbc20   rdi = 0x0000000000000000
	    rbp = 0x00007ffefcbdbba0   rsp = 0x00007ffefcbdb9c0
	     r8 = 0x0000562d577a0406    r9 = 0x0000000000000003
	    r10 = 0x0000000000000004   r11 = 0x00007f53a2a1f310
	    r12 = 0x0000562d5fddc6b8   r13 = 0x0000562d5fdddf78
	    r14 = 0x00007ffefcbdbc20   r15 = 0x0000000000000000
	    rip = 0x0000562d5e2d84f7
	    Found by: given as instruction pointer in context
	 1  chrome!blink::BackgroundHTMLParser::EnqueueTokenizedChunk() + 0x2d5
	    rbx = 0x00001ea77a1a7230   rbp = 0x00007ffefcbdbc50
	    rsp = 0x00007ffefcbdbbb0   r12 = 0x0000562d5fddc6b8
	    r13 = 0x0000562d5fdddf78   r14 = 0x00001ea77a1ec000
	    r15 = 0x00001ea77a1a72b0   rip = 0x0000562d5e2e2e55
	    Found by: call frame info
	 2  chrome!blink::BackgroundHTMLParser::PumpTokenizer() + 0x3e0
	    rbx = 0x00007ffefcbdbd18   rbp = 0x00007ffefcbdbd70
	    rsp = 0x00007ffefcbdbc60   r12 = 0x00001ea77a1ec000
	    r13 = 0x00007ffefcbdbd10   r14 = 0x00001ea77a1ec080
	    r15 = 0x0000000000000000   rip = 0x0000562d5e2e25b0
	    Found by: call frame info
...

I suspect https://chromium-review.googlesource.com/c/chromium/src/+/1029552
Assigning to the owner of the CL.
Kouhei, can you have a look?

This is still flaky. I could not find the appropriate way to disable this test.