From a recent Chrome ToT build @ #613608

Running on kevin with --enable-features=SingleProcessMash

1. Attach an external monitor to a device (in this case, kevin)
2. Enable a11y in the system menu (Settings > Advanced > Accessibility > Always show a11y options...)
3. In the system menu, enable Accessibility > On-screen keyboard
4. Disable the on-screen keyboard (you may need to enable / disable a second time).

Crash:

#0  ChangeFailed () at ../../ui/aura/mus/in_flight_change.cc:148
#1  0x0f13df10 in OnChangeCompleted () at ../../ui/aura/mus/window_tree_client.cc:1486
#2  0x0bad0bfc in Accept () at gen/services/ws/public/mojom/window_tree.mojom.cc:9137
#3  0x0e14f9ae in HandleValidatedMessage () at ../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:423
#4  0x0e15be0c in Accept () at ../../mojo/public/cpp/bindings/lib/filter_chain.cc:40
#5  0x0e15081a in HandleIncomingMessage () at ../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:306
#6  0x0e154a2e in ProcessIncomingMessage () at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:869
#7  0x0e1542d0 in Accept () at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:590
#8  0x0e15be0c in Accept () at ../../mojo/public/cpp/bindings/lib/filter_chain.cc:40
#9  0x0e14dc12 in ReadSingleMessage () at ../../mojo/public/cpp/bindings/lib/connector.cc:476
#10 0x0e14e32c in ReadAllAvailableMessages () at ../../mojo/public/cpp/bindings/lib/connector.cc:505
#11 0x0e14e1ea in OnHandleReadyInternal () at ../../mojo/public/cpp/bindings/lib/connector.cc:387
#12 0x0b9a8fa4 in Run () at ../../base/callback.h:129
#13 DiscardReadyState () at ../../mojo/public/cpp/system/simple_watcher.h:194
#14 0x0e1648e0 in Run () at ../../base/callback.h:129
#15 OnHandleReady () at ../../mojo/public/cpp/system/simple_watcher.cc:273
#16 0x0e164c68 in Invoke<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher> const&, int const&, unsigned int const&, mojo::HandleSignalsState const&> () at ../../base/bind_internal.h:516
#17 MakeItSo<void (mojo::SimpleWatcher::* const&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher> const&, int const&, unsigned int const&, mojo::HandleSignalsState const&> () at ../../base/bind_internal.h:636
#18 RunImpl<void (mojo::SimpleWatcher::* const&)(int, unsigned int, mojo::HandleSignalsState const&), std::__1::tuple<base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState> const&, 0, 1, 2, 3> () at ../../base/bind_internal.h:689
#19 0x0e10ddc4 in Run () at ../../base/callback.h:99
#20 RunTask () at ../../base/debug/task_annotator.cc:99
#21 0x0e0870b2 in RunTask () at ../../base/message_loop/message_loop_impl.cc:374
#22 0x0e0874f6 in DeferOrRunPendingTask () at ../../base/message_loop/message_loop_impl.cc:385
#23 DoWork () at ../../base/message_loop/message_loop_impl.cc:473
#24 0x0e10b418 in Run () at ../../base/message_loop/message_pump_libevent.cc:210
#25 0x0e086d30 in Run () at ../../base/message_loop/message_loop_impl.cc:326
#26 0x0e0a3b62 in Run () at ../../base/run_loop.cc:102
#27 0x0dcf08d0 in MainMessageLoopRun () at ../../chrome/browser/chrome_browser_main.cc:1865

Changing the DVLOG to VLOG and enabling it I get:

VERBOSE1:window_tree_client.cc(1484)] Change failed id=331 type=DELETE_WINDOW

I suspect the Ash keyboard window or the embedded keyboard window may be the deleted window, but it's not clear to me what failed or why this is triggering a crash.