I can confirm it's still happening in 53.0.2785.92-2
Thread 33 "Chrome_InProcRe" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff4b7fe700 (LWP 13286)]
0x0000555558837c85 in
blink::LayoutObject::isDescendantOf(blink::LayoutObject const*) const ()
(gdb) bt
#0 0x0000555558837c85 in
blink::LayoutObject::isDescendantOf(blink::LayoutObject const*) const ()
#1 0x00005555588b93bc in
blink::CompositedLayerMapping::containingSquashedLayer(blink::LayoutObject
const*, WTF::Vector<blink::GraphicsLayerPaintInfo, 0ul,
WTF::PartitionAllocator> const&, unsigned int) ()
#2 0x0000555558936b8b in
blink::CompositingLayerAssigner::getReasonsPreventingSquashing(blink::PaintLayer
const*, blink::CompositingLayerAssigner::SquashingState const&) [clone
.part.27] ()
#3 0x0000555558937b0e in
blink::CompositingLayerAssigner::assignLayersToBackingsInternal(blink::PaintLayer*,
blink::CompositingLayerAssigner::SquashingState&,
WTF::Vector<blink::PaintLayer*, 0ul, WTF::PartitionAllocator>&) ()
#4 0x0000555558937811 in
blink::CompositingLayerAssigner::assignLayersToBackingsInternal(blink::PaintLayer*,
blink::CompositingLayerAssigner::SquashingState&,
WTF::Vector<blink::PaintLayer*, 0ul, WTF::PartitionAllocator>&) ()
#5 0x0000555558937811 in
blink::CompositingLayerAssigner::assignLayersToBackingsInternal(blink::PaintLayer*,
blink::CompositingLayerAssigner::SquashingState&,
WTF::Vector<blink::PaintLayer*, 0ul, WTF::PartitionAllocator>&) ()
#6 0x0000555558937bf1 in
blink::CompositingLayerAssigner::assign(blink::PaintLayer*,
WTF::Vector<blink::PaintLayer*, 0ul, WTF::PartitionAllocator>&) ()
#7 0x00005555588bfc79 in blink::PaintLayerCompositor::updateIfNeeded() ()
#8 0x00005555588c10be in
blink::PaintLayerCompositor::updateIfNeededRecursiveInternal() ()
#9 0x00005555588c12fc in
blink::PaintLayerCompositor::updateIfNeededRecursive() ()
#10 0x00005555584210b5 in
blink::FrameView::updateLifecyclePhasesInternal(blink::DocumentLifecycle::LifecycleState)
()
#11 0x0000555558561b1d in
blink::PageAnimator::updateAllLifecyclePhases(blink::LocalFrame&) ()
#12 0x00005555578c1a5a in blink::WebViewImpl::updateAllLifecyclePhases() ()
#13 0x0000555559b871b3 in
content::RenderWidgetCompositor::UpdateLayerTreeHost() ()
#14 0x000055555a72b3d1 in
cc::ProxyMain::BeginMainFrame(std::unique_ptr<cc::BeginMainFrameAndCommitState,
std::default_delete<cc::BeginMainFrameAndCom
