open content_shell and click right-button in the address bar; 100% reproducible. I'm running with --single-process.

gistfile1.txt

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe4a12700 (LWP 17695)]
0x0000000000fdd182 in ozonewayland::WaylandShellSurface::Surface (this=0x0) at ../../ozone/wayland/shell_surface.h:25
25	  WaylandSurface* Surface() const { return surface_; }
(gdb) bt
#0  0x0000000000fdd182 in ozonewayland::WaylandShellSurface::Surface (this=0x0) at ../../ozone/wayland/shell_surface.h:25
#1  0x0000000000fdcf7d in ozonewayland::WaylandWindow::RealizeAcceleratedWidget (this=0xc3f8c7a560) at ../../ozone/wayland/window.cc:84
#2  0x0000000000fca45b in ozonewayland::OzoneDisplay::RealizeAcceleratedWidget (this=0x7ffff0fa05c8, w=2) at ../../ozone/impl/ozone_display.cc:125
#3  0x0000000003e865d1 in gfx::GLSurface::CreateViewGLSurface (window=2) at ../../ui/gl/gl_surface_egl.cc:733
#4  0x00000000039f11e8 in content::ImageTransportSurface::CreateNativeSurface (manager=0xc3f6d37a20, stub=0xc3f84eafe0, handle=...)
    at ../../content/common/gpu/image_transport_surface_linux.cc:18
#5  0x00000000039edefb in content::ImageTransportSurface::CreateSurface (manager=0xc3f6d37a20, stub=0xc3f84eafe0, handle=...) at ../../content/common/gpu/image_transport_surface.cc:36
#6  0x00000000039e39e6 in content::GpuCommandBufferStub::OnInitialize (this=0xc3f84eafe0, shared_state_handle=..., reply_message=0xc3f6ffbe30)
    at ../../content/common/gpu/gpu_command_buffer_stub.cc:443
#7  0x00000000039ebdf3 in DispatchToMethod<content::GpuCommandBufferStub, void (content::GpuCommandBufferStub::*)(base::FileDescriptor, IPC::Message*), base::FileDescriptor, IPC::Message&> (obj=0xc3f84eafe0, method=
    (void (content::GpuCommandBufferStub::*)(content::GpuCommandBufferStub * const, base::FileDescriptor, IPC::Message *)) 0x39e3428 <content::GpuCommandBufferStub::OnInitialize(base::FileDescriptor, IPC::Message*)>, in=..., out=0x7fffe4a10900) at ../../base/tuple.h:803
#8  0x00000000039e9f26 in IPC::SyncMessageSchema<Tuple1<base::FileDescriptor>, Tuple1<bool&> >::DispatchDelayReplyWithSendParams<content::GpuCommandBufferStub, void (content::GpuCommandBufferStub::*)(base::FileDescriptor, IPC::Message*)> (ok=true, send_params=..., msg=0xc3f6ffb770, obj=0xc3f84eafe0, func=
    (void (content::GpuCommandBufferStub::*)(content::GpuCommandBufferStub * const, base::FileDescriptor, IPC::Message *)) 0x39e3428 <content::GpuCommandBufferStub::OnInitialize(base::FileDescriptor, IPC::Message*)>) at ../../ipc/ipc_message_utils.h:845
#9  0x00000000039e8461 in GpuCommandBufferMsg_Initialize::DispatchDelayReply<content::GpuCommandBufferStub, void (content::GpuCommandBufferStub::*)(base::FileDescriptor, IPC::Message*)>
    (msg=0xc3f6ffb770, obj=0xc3f84eafe0, func=
    (void (content::GpuCommandBufferStub::*)(content::GpuCommandBufferStub * const, base::FileDescriptor, IPC::Message *)) 0x39e3428 <content::GpuCommandBufferStub::OnInitialize(base::FileDescriptor, IPC::Message*)>) at ../../content/common/gpu/gpu_messages.h:525
#10 0x00000000039e19b8 in content::GpuCommandBufferStub::OnMessageReceived (this=0xc3f84eafe0, message=...) at ../../content/common/gpu/gpu_command_buffer_stub.cc:193
#11 0x00000000039be898 in content::MessageRouter::RouteMessage (this=0x7ffff0f9cb40, msg=...) at ../../content/common/message_router.cc:49
#12 0x00000000039d205c in content::GpuChannel::HandleMessage (this=0x7ffff0f9caa0) at ../../content/common/gpu/gpu_channel.cc:815
#13 0x00000000039de3e6 in base::internal::RunnableAdapter<void (content::GpuChannel::*)()>::Run (this=0x7fffe4a111f0, object=0x7ffff0f9caa0) at ../../base/bind_internal.h:134
#14 0x00000000039dd19e in base::internal::InvokeHelper<true, void, base::internal::RunnableAdapter<void (content::GpuChannel::*)()>, void (base::WeakPtr<content::GpuChannel> const&)>::MakeItSo(base::internal::RunnableAdapter<void (content::GpuChannel::*)()>, base::WeakPtr<content::GpuChannel> const&) (runnable=..., weak_ptr=...) at ../../base/bind_internal.h:882
#15 0x00000000039db4af in base::internal::Invoker<1, base::internal::BindState<base::internal::RunnableAdapter<void (content::GpuChannel::*)()>, void (content::GpuChannel*), void (base::WeakPtr<content::GpuChannel>)>, void (content::GpuChannel*)>::Run(base::internal::BindStateBase*) (base=0xc3f7f4ed40) at ../../base/bind_internal.h:1169
#16 0x000000000042aacf in base::Callback<void ()>::Run() const (this=0x7fffe4a11548) at ../../base/callback.h:396
#17 0x00000000005e7f02 in base::MessageLoop::RunTask (this=0xc3f6dfae20, pending_task=...) at ../../base/message_loop/message_loop.cc:511
#18 0x00000000005e8026 in base::MessageLoop::DeferOrRunPendingTask (this=0xc3f6dfae20, pending_task=...) at ../../base/message_loop/message_loop.cc:523
#19 0x00000000005e854b in base::MessageLoop::DoWork (this=0xc3f6dfae20) at ../../base/message_loop/message_loop.cc:637
#20 0x00000000005f0a40 in base::MessagePumpDefault::Run (this=0x7ffff0f6a9b0, delegate=0xc3f6dfae20) at ../../base/message_loop/message_pump_default.cc:32
#21 0x00000000005e7a77 in base::MessageLoop::RunInternal (this=0xc3f6dfae20) at ../../base/message_loop/message_loop.cc:461
#22 0x00000000005e7930 in base::MessageLoop::RunHandler (this=0xc3f6dfae20) at ../../base/message_loop/message_loop.cc:433
#23 0x000000000060eeb4 in base::RunLoop::Run (this=0x7fffe4a119a0) at ../../base/run_loop.cc:47
#24 0x00000000005e7116 in base::MessageLoop::Run (this=0xc3f6dfae20) at ../../base/message_loop/message_loop.cc:321
#25 0x0000000003a3f902 in base::Thread::Run (this=0x7ffff0f6a140, message_loop=0xc3f6dfae20) at ../../base/threading/thread.cc:172
#26 0x0000000003a3fb52 in base::Thread::ThreadMain (this=0x7ffff0f6a140) at ../../base/threading/thread.cc:225
#27 0x000000000062ef7d in base::(anonymous namespace)::ThreadFunc (params=0x7fffe5a12260) at ../../base/threading/platform_thread_posix.cc:80
#28 0x00007ffff5abbe9a in start_thread (arg=0x7fffe4a12700) at pthread_create.c:308
#29 0x00007ffff495b3fd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
warning: (Internal error: pc 0x0 in read in psymtab, but not in symtab.)

#30 0x0000000000000000 in ?? ()
(gdb)