Chromium network service crashes when using headless=new with rr

This only seems to happen with the new headless mode, not sure what's going on. The crash does not happen when running without rr.

[2222385:2222385:0716/184629.478804:ERROR:network_service_instance_impl.cc(600)] Network service crashed, restarting service.

rr record ./out/linux-x64-release/chrome --user-data-dir=/tmp/.chrome-user-1 --disable-crash-reporter --no-report-upload --js-flags="--expose-gc --allow-natives-syntax" --allow-running-insecure-content --allow-insecure-localhost --ignore-certificate-errors --disable-breakpad --enable-logging=stderr --v=0 --allow-sandbox-debugging --disable-gpu-sandbox --disable-seccomp-filter-sandbox --disable-setuid-sandbox --disable-namespace-sandbox --no-sandbox --disable-gpu-process-crash-limit --headless=new --timeout=5000 --dump-dom --disable-hang-monitor --vmodule=render_frame_impl=1 "https://localhost/hello_world.html"

Backtrace:

#0  content::GetNetworkService() () at ../../content/browser/network_service_instance_impl.cc:600
#1  0x0000569d147c7284 in IntranetRedirectDetector::SetupDnsConfigClient() (this=0x30d4000414a0) at ../../chrome/browser/intranet_redirect_detector.cc:249
#2  0x0000569d0def7b60 in base::OnceCallback<void ()>::Run() && (this=<optimized out>) at ../../base/functional/callback.h:156
#3  0x0000569d1546c80b in mojo::InterfaceEndpointClient::NotifyError(std::__Cr::optional<mojo::DisconnectReason> const&) (this=<optimized out>, reason=...)
    at ../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:759
#4  0x0000569d1547a7c9 in mojo::internal::MultiplexRouter::ProcessNotifyErrorTask(mojo::internal::MultiplexRouter::Task*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*)
    (this=this@entry=0x30d400b6e000, task=task@entry=0x30d400365130, client_call_behavior=client_call_behavior@entry=mojo::internal::MultiplexRouter::ALLOW_DIRECT_CLIENT_CALLS, current_task_runner=current_task_runner@entry=0x1d300035ca80) at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:1034
#5  0x0000569d15476f7e in mojo::internal::MultiplexRouter::ProcessTasks(mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*)
    (this=this@entry=0x30d400b6e000, client_call_behavior=mojo::internal::MultiplexRouter::ALLOW_DIRECT_CLIENT_CALLS, current_task_runner=0x1d300035ca80)
    at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:947
#6  0x0000569d1547593f in mojo::internal::MultiplexRouter::OnPipeConnectionError(bool) (this=0x30d400b6e000, force_async_dispatch=false)
    at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:856
#7  0x0000569d0def7b60 in base::OnceCallback<void ()>::Run() && (this=<optimized out>) at ../../base/functional/callback.h:156
#8  0x0000569d15466543 in mojo::Connector::HandleError(bool, bool) (this=<optimized out>, force_pipe_reset=<optimized out>, force_async_handler=<optimized out>)
#0  content::GetNetworkService() () at ../../content/browser/network_service_instance_impl.cc:600
#1  0x0000569d147c7284 in IntranetRedirectDetector::SetupDnsConfigClient() (this=0x30d4000414a0) at ../../chrome/browser/intranet_redirect_detector.cc:249
#2  0x0000569d0def7b60 in base::OnceCallback<void ()>::Run() && (this=<optimized out>) at ../../base/functional/callback.h:156
#3  0x0000569d1546c80b in mojo::InterfaceEndpointClient::NotifyError(std::__Cr::optional<mojo::DisconnectReason> const&) (this=<optimized out>, reason=...)
    at ../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:759
#4  0x0000569d1547a7c9 in mojo::internal::MultiplexRouter::ProcessNotifyErrorTask(mojo::internal::MultiplexRouter::Task*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*)
    (this=this@entry=0x30d400b6e000, task=task@entry=0x30d400365130, client_call_behavior=client_call_behavior@entry=mojo::internal::MultiplexRouter::ALLOW_DIRECT_CLIENT_CALLS, current_task_runner=current_task_runner@entry=0x1d300035ca80) at ../../mojo/public/cpp/bindings/lib/multiplex_router.cc:1034
...

Start by reproducing the exact rr record command with Chromium's --headless=new option. Inspect the reported paths content/browser/network_service_instance_impl.cc and chrome/browser/intranet_redirect_detector.cc, along with the Mojo disconnect frames. Done means the network service no longer crashes under this reproduction, with the cause and verification documented.