So, despite us ensuring that the client-side doesn't delete its command buffer as long as we hold a TextureRef (which should keep the service-side command buffer, ContextGroup and associated TextureManager alive, thus preventing this crash), it looks like the service-side gets shut-down before the client-side has cleaned up:

#0  0x00007ffff1348d27 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff134a418 in __GI_abort () at abort.c:89
#2  0x00007ffff255ee69 in base::debug::BreakDebugger () at ../../../../third_party/chromium/src/base/debug/debugger_posix.cc:241
#3  0x00007ffff2586ed5 in logging::LogMessage::~LogMessage (this=0x7fffa080a920, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/base/logging.cc:640
#4  0x00007ffff27272cb in gpu::gles2::TextureManager::~TextureManager (this=0x7fff81400170, __in_chrg=<optimised out>)
    at ../../../../third_party/chromium/src/gpu/command_buffer/service/texture_manager.cc:103
#5  0x00007ffff26c3521 in operator() (this=0x7fff80010268, ptr=0x7fff81400170) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:127
#6  reset (p=0x0, this=0x7fff80010268) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:247
#7  reset (p=0x0, this=0x7fff80010268) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:376
#8  gpu::gles2::ContextGroup::Destroy (this=0x7fff800101f0, decoder=decoder@entry=0x7fff829140e0, have_context=have_context@entry=true)
    at ../../../../third_party/chromium/src/gpu/command_buffer/service/context_group.cc:312
#9  0x00007ffff26f4a84 in gpu::gles2::GLES2DecoderImpl::Destroy (this=0x7fff829140e0, have_context=<optimised out>)
    at ../../../../third_party/chromium/src/gpu/command_buffer/service/gles2_cmd_decoder.cc:3684
#10 0x00007ffff319ae56 in content::GpuCommandBufferStub::Destroy (this=this@entry=0x7fff8140f2f0)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_command_buffer_stub.cc:437
#11 0x00007ffff319b0e2 in content::GpuCommandBufferStub::~GpuCommandBufferStub (this=this@entry=0x7fff8140f2f0, __in_chrg=<optimised out>)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_command_buffer_stub.cc:205
#12 0x00007ffff319b2f9 in content::GpuCommandBufferStub::~GpuCommandBufferStub (this=0x7fff8140f2f0, __in_chrg=<optimised out>)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_command_buffer_stub.cc:209
#13 0x00007ffff319326c in release_all (table=0x7fff8000a530) at ../../../../third_party/chromium/src/base/id_map.h:224
#14 ~IDMap (this=0x7fff8000a4f0, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/base/id_map.h:53
#15 content::GpuChannel::~GpuChannel (this=this@entry=0x7fff8000a3c0, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel.cc:430
#16 0x00007ffff31934d9 in content::GpuChannel::~GpuChannel (this=0x7fff8000a3c0, __in_chrg=<optimised out>)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel.cc:434
#17 0x00007ffff31950bf in STLDeleteValues<__gnu_cxx::hash_map<int, content::GpuChannel*, base_hash::hash<int>, std::equal_to<int>, std::allocator<std::pair<int const, content::GpuChannel*> > > > (container=0x29d3, container@entry=0x7fff80009308) at ../../../../third_party/chromium/src/base/stl_util.h:152
#18 0x00007ffff3195118 in clear (this=0x7fff80009308) at ../../../../third_party/chromium/src/base/containers/scoped_ptr_hash_map.h:122
#19 content::GpuChannelManager::~GpuChannelManager (this=0x7fff800092e0, __in_chrg=<optimised out>)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel_manager.cc:122
#20 0x00007ffff3195329 in content::GpuChannelManager::~GpuChannelManager (this=0x7fff800092e0, __in_chrg=<optimised out>)
    at ../../../../third_party/chromium/src/content/common/gpu/gpu_channel_manager.cc:127
#21 0x00007ffff4ccada7 in operator() (this=0x7fff800025b8, ptr=<optimised out>) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:127
#22 ~scoped_ptr_impl (this=0x7fff800025b8, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:221
#23 ~scoped_ptr (this=0x7fff800025b8, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:311
#24 content::GpuChildThread::~GpuChildThread (this=0x7fff80002430, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/content/gpu/gpu_child_thread.cc:92
#25 0x00007ffff4ccae49 in content::GpuChildThread::~GpuChildThread (this=0x7fff80002430, __in_chrg=<optimised out>)
    at ../../../../third_party/chromium/src/content/gpu/gpu_child_thread.cc:94
#26 0x00007ffff4c533f3 in operator() (this=0x7fff80002028, ptr=<optimised out>) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:127
#27 reset (p=0x0, this=0x7fff80002028) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:247
#28 reset (p=0x0, this=0x7fff80002028) at ../../../../third_party/chromium/src/base/memory/scoped_ptr.h:376
#29 content::ChildProcess::~ChildProcess (this=0x7fff80001fd0, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/content/child/child_process.cc:68
#30 0x00007ffff4cca8f3 in ~GpuProcess (this=0x7fff80001fd0, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/content/gpu/gpu_process.cc:12
#31 content::GpuProcess::~GpuProcess (this=0x7fff80001fd0, __in_chrg=<optimised out>) at ../../../../third_party/chromium/src/content/gpu/gpu_process.cc:13
#32 0x00007ffff25b9035 in base::Thread::ThreadMain (this=0x7fff84022600) at ../../../../third_party/chromium/src/base/threading/thread.cc:232
#33 0x00007ffff25b561e in base::(anonymous namespace)::ThreadFunc (params=<optimised out>) at ../../../../third_party/chromium/src/base/threading/platform_thread_posix.cc:80
#34 0x00007ffff10fc0a5 in start_thread (arg=0x7fffa080b700) at pthread_create.c:309
#35 0x00007ffff140c77d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111