Thanks to mathp@ for reporting this.

23677:223677:0621/142701.058893:FATAL:simple_url_loader.cc(1029)] Check failed: element.type() != DataElement::TYPE_FILE && element.type() != DataElement::TYPE_BYTES. 
#0 0x7f8d7b3b9c2d base::debug::StackTrace::StackTrace()
#1 0x7f8d7b1024bc base::debug::StackTrace::StackTrace()
#2 0x7f8d7b17150a logging::LogMessage::~LogMessage()
#3 0x7f8d6ff19673 network::(anonymous namespace)::SimpleURLLoaderImpl::SimpleURLLoaderImpl()
#4 0x7f8d6ff18a3e network::SimpleURLLoader::Create()
#5 0x55c9c7d87f6e ContextualSuggestionsService::StartDownloadAndTransferLoader()
#6 0x55c9c7d89a23 ContextualSuggestionsService::AccessTokenAvailable()
#7 0x55c9c7d8a4cd _ZN4base8internal13FunctorTraitsIM28ContextualSuggestionsServiceFvNSt3__110unique_ptrIN7network15ResourceRequestENS3_14default_deleteIS6_EEEEN3net27NetworkTrafficAnnotationTagENS_12OnceCallbackIFvNS4_INS5_15SimpleURLLoaderENS7_ISD_EEEEEEENSC_IFvPKSD_NS4_INS3_12basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEENS7_ISP_EEEEEEE22GoogleServiceAuthErrorSP_EvE6InvokeISW_PS2_JS9_SB_SH_ST_SU_SP_EEEvT_OT0_DpOT1_
#8 0x55c9c7d8a0c4 _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIM28ContextualSuggestionsServiceFvNSt3__110unique_ptrIN7network15ResourceRequestENS5_14default_deleteIS8_EEEEN3net27NetworkTrafficAnnotationTagENS_12OnceCallbackIFvNS6_INS7_15SimpleURLLoaderENS9_ISF_EEEEEEENSE_IFvPKSF_NS6_INS5_12basic_stringIcNS5_11char_traitsIcEENS5_9allocatorIcEEEENS9_ISR_EEEEEEE22GoogleServiceAuthErrorSR_EJPS4_SB_SD_SJ_SV_SW_SR_EEEvOT_DpOT0_
#9 0x55c9c7d89fc0 _ZN4base8internal7InvokerINS0_9BindStateIM28ContextualSuggestionsServiceFvNSt3__110unique_ptrIN7network15ResourceRequestENS4_14default_deleteIS7_EEEEN3net27NetworkTrafficAnnotationTagENS_12OnceCallbackIFvNS5_INS6_15SimpleURLLoaderENS8_ISE_EEEEEEENSD_IFvPKSE_NS5_INS4_12basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS8_ISQ_EEEEEEE22GoogleServiceAuthErrorSQ_EJNS0_17UnretainedWrapperIS3_EESA_SC_SI_SU_EEEFvSV_SQ_EE7RunImplISX_NS4_5tupleIJSZ_SA_SC_SI_SU_EEEJLm0ELm1ELm2ELm3ELm4EEEEvOT_OT0_NS4_16integer_sequenceImJXspT1_EEEEOSV_OSQ_
#10 0x55c9c7d89d79 _ZN4base8internal7InvokerINS0_9BindStateIM28ContextualSuggestionsServiceFvNSt3__110unique_ptrIN7network15ResourceRequestENS4_14default_deleteIS7_EEEEN3net27NetworkTrafficAnnotationTagENS_12OnceCallbackIFvNS5_INS6_15SimpleURLLoaderENS8_ISE_EEEEEEENSD_IFvPKSE_NS5_INS4_12basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEENS8_ISQ_EEEEEEE22GoogleServiceAuthErrorSQ_EJNS0_17UnretainedWrapperIS3_EESA_SC_SI_SU_EEEFvSV_SQ_EE7RunOnceEPNS0_13BindStateBaseEOSV_OSQ_
#11 0x55c9c29433ec _ZNO4base12OnceCallbackIFv22GoogleServiceAuthErrorNSt3__112basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEEEE3RunES1_S8_
#12 0x55c9c2941611 identity::PrimaryAccountAccessTokenFetcher::RunCallbackAndMaybeDie()
#13 0x55c9c2941446 identity::PrimaryAccountAccessTokenFetcher::OnGetTokenSuccess()
#14 0x55c9c25dd95c OAuth2TokenService::RequestImpl::InformConsumer()
#15 0x55c9c25dee3d OAuth2TokenService::Fetcher::InformWaitingRequests()
#16 0x55c9c25df41d OAuth2TokenService::Fetcher::InformWaitingRequestsAndDelete()
#17 0x55c9c25df3bf OAuth2TokenService::Fetcher::OnGetTokenSuccess()
#18 0x55c9c25cb4c4 OAuth2AccessTokenFetcher::FireOnGetTokenSuccess()
#19 0x55c9c25cfeb0 OAuth2AccessTokenFetcherImpl::OnGetTokenSuccess()
#20 0x55c9c25cec8f OAuth2AccessTokenFetcherImpl::EndGetAccessToken()
#21 0x55c9c25d0001 OAuth2AccessTokenFetcherImpl::OnURLFetchComplete()
#22 0x7f8d78f08ec9 net::URLFetcherCore::InformDelegateFetchIsComplete()
#23 0x7f8d78f08da9 net::URLFetcherCore::OnCompletedURLRequest()
#24 0x7f8d78f0c13a _ZN4base8internal13FunctorTraitsIMN3net14URLFetcherCoreEFvNS_9TimeDeltaEEvE6InvokeIS6_RK13scoped_refptrIS3_EJRKS4_EEEvT_OT0_DpOT1_
#25 0x7f8d78f0c08f _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN3net14URLFetcherCoreEFvNS_9TimeDeltaEEJRK13scoped_refptrIS5_ERKS6_EEEvOT_DpOT0_
#26 0x7f8d78f0c01d _ZN4base8internal7InvokerINS0_9BindStateIMN3net14URLFetcherCoreEFvNS_9TimeDeltaEEJ13scoped_refptrIS4_ES5_EEEFvvEE7RunImplIRKS7_RKNSt3__15tupleIJS9_S5_EEEJLm0ELm1EEEEvOT_OT0_NSG_16integer_sequenceImJXspT1_EEEE
#27 0x7f8d78f0bf2c _ZN4base8internal7InvokerINS0_9BindStateIMN3net14URLFetcherCoreEFvNS_9TimeDeltaEEJ13scoped_refptrIS4_ES5_EEEFvvEE3RunEPNS0_13BindStateBaseE
#28 0x7f8d7b0b11ee _ZNO4base12OnceCallbackIFvvEE3RunEv
#29 0x7f8d7b103982 base::debug::TaskAnnotator::RunTask()
#30 0x7f8d7b190c09 base::internal::IncomingTaskQueue::RunTask()
#31 0x7f8d7b19a9e7 base::MessageLoop::RunTask()
#32 0x7f8d7b19ac58 base::MessageLoop::DeferOrRunPendingTask()
#33 0x7f8d7b19af89 base::MessageLoop::DoWork()
#34 0x7f8d7b19edcc base::MessagePumpGlib::HandleDispatch()
#35 0x7f8d7b19f521 base::(anonymous namespace)::WorkSourceDispatch()
#36 0x7f8d5a121f07 g_main_context_dispatch
#37 0x7f8d5a122138 <unknown>
#38 0x7f8d5a1221cc g_main_context_iteration
#39 0x7f8d7b19eebf base::MessagePumpGlib::Run()
#40 0x7f8d7b19a1db base::MessageLoop::Run()
#41 0x7f8d7b2437ed base::RunLoop::Run()
#42 0x55c9c420b29f ChromeBrowserMainParts::MainMessageLoopRun()
#43 0x7f8d749fa4c1 content::BrowserMainLoop::RunMainMessageLoopParts()
#44 0x7f8d74a028d0 content::BrowserMainRunnerImpl::Run()
#45 0x7f8d749ed7d9 content::BrowserMain()
#46 0x7f8d76860612 content::RunBrowserProcessMain()
#47 0x7f8d76862dd2 content::ContentMainRunnerImpl::Run()
#48 0x7f8d76857155 content::ContentServiceManagerMainDelegate::RunEmbedderProcess()
#49 0x7f8d7b65ade4 service_manager::Main()
#50 0x7f8d7685d3b5 content::ContentMain()
#51 0x55c9c2520246 ChromeMain
#52 0x55c9c2520152 main
#53 0x7f8d57f9f2b1 __libc_start_main
#54 0x55c9c252002a _start

This is experiment/flag dependent. Code-wise ZeroSuggestRedirectToChrome feature is part of it, but not quite enough to reproduce.

Seems to be due to me trying to stick an upload into request manually,
and SimpleURLLoader being unhappy about it. Easy enough to change...