I ran into this again on https://docs.google.com/presentation/d/19aVlNPhv9Zm-ctjKRzA62ysdXST5szLHI71Xkcx8WL4/edit?usp=drive_web&ouid=102315256206748175053, another slides page.

I'm running in to this with a CL I've been working on (https://chromium-review.googlesource.com/c/chromium/src/+/1387448/7). One of the telemetry_perf_unittests is crashing visiting a google doc.

In my case, the DCHECK appears when I change the timing of javascript: url navigation. It looks like the page is injecting an iframe with src="javascript:''". On trunk, that javascript url is processed synchronously during iframe node insertion and doesn't crash. With my CL, it's processed asynchronously and does crash.

Executing the JS url replaces an empty document with a different empty document. My operating theory is that some state is getting mixed between these two documents because of the timing change, but I don't know the font code well enough to have any detailed explanation.

I've found a fairly simple repro (https://chromium-review.googlesource.com/c/chromium/src/+/1401272). It appears this DCHECK occurs any time you try to put a FontFace in multiple FontFaceSets

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3311671f45292074b4caf897a9bca48fc9a6713b

commit 3311671f45292074b4caf897a9bca48fc9a6713b
Author: Nate Chapin <japhet@chromium.org>
Date: Thu Jan 10 18:50:06 2019

Allow a CSSFontFace to be associated with multiple CSSSegmentedFontFaces

This can happen if a FontFace is put in to multiple FontFaceSets

Bug: 873845
Change-Id: Iede71f9e4d4310a1c6c3bcd54eb2ee24059e7db9
Reviewed-on: https://chromium-review.googlesource.com/c/1403676
Commit-Queue: Nate Chapin <japhet@chromium.org>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Reviewed-by: Dominik Röttsches <drott@chromium.org>
Cr-Commit-Position: refs/heads/master@{#621674}
[modify] https://crrev.com/3311671f45292074b4caf897a9bca48fc9a6713b/third_party/blink/renderer/core/css/css_font_face.cc
[modify] https://crrev.com/3311671f45292074b4caf897a9bca48fc9a6713b/third_party/blink/renderer/core/css/css_font_face.h
[modify] https://crrev.com/3311671f45292074b4caf897a9bca48fc9a6713b/third_party/blink/renderer/core/css/css_segmented_font_face.cc
[add] https://crrev.com/3311671f45292074b4caf897a9bca48fc9a6713b/third_party/blink/web_tests/http/tests/webfont/font-face-in-multiple-sets.html