The supposed cause is this assert https://cs.chromium.org/chromium/src/third_party/breakpad/breakpad/src/common/simple_string_dictionary.h?q=simple_string_dictionary.h&sq=package:chromium&dr=CSs&l=223, although the symbolized stack is very unhelpful in diagnosing what's actually happening.

The stack trace seems to be corrupted. The function is invoked only when you take a JS heap snapshot in DevTools. I guess that is not what the test was doing.

I'm still getting the same crashes when synced to way before I started seeing the flakiness. I think --single-process is just causing weirdness, not actually giving us information on the renderer crash.

It does indeed look unrelated - adding logging when the condition that fails the assert is met results in stuff being logged with --single-process but not without it. Back to square one...

In the logcat output, we do get "Terminating render process for bad Mojo message: Received bad user message: SubmitFrame called with wrong frame inde" when this reproduces, which points to https://cs.chromium.org/chromium/src/chrome/browser/android/vr/vr_shell_gl.cc?type=cs&q=%22SubmitFrame+called+with+wrong+frame+inde%22&sq=package:chromium&g=0&l=681.

The mismatch is caused by VrShellGl expecting frame index -1, but getting frame index 0. Attached is a logcat snippet of the failure with a little bit of extra logging, and a NOTREACHED added for when the error case is hit.

Deleted: bad_frame_index_logcat.txt 89.0 KB

bad_frame_index_logcat.txt 89.0 KB View Download

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/fa0094b3d551f532f69267b3d1d5b5eceb6355a0

commit fa0094b3d551f532f69267b3d1d5b5eceb6355a0
Author: Klaus Weidner <klausw@chromium.org>
Date: Sat Jun 30 01:47:24 2018

Don't submit WebXR missing frames with id=-1

The "Don't submit exclusive WebXR frames without valid frame ID"
patch from https://crrev.com/1117770 was incomplete, it results
in closing Mojo connections due to a sanity check that treats
the received frame_id==-1 as invalid. Just ignore these on the
Renderer side instead of attempting to submit as missing frames.

BUG= 855722 , 858838 

Change-Id: I5a5c70979be2bb9a2c9429b6efa78fdd6029d4db
Reviewed-on: https://chromium-review.googlesource.com/1121344
Reviewed-by: Bill Orr <billorr@chromium.org>
Reviewed-by: Brian Sheedy <bsheedy@chromium.org>
Commit-Queue: Klaus Weidner <klausw@chromium.org>
Cr-Commit-Position: refs/heads/master@{#571737}
[modify] https://crrev.com/fa0094b3d551f532f69267b3d1d5b5eceb6355a0/third_party/blink/renderer/modules/xr/xr_frame_provider.cc

Looks like this has been fixed.