Reproducible on the latest canary(55.0.2869.0) on Mac OS 10.11.6 as well.

Changelog:
=========
https://chromium.googlesource.com/chromium/src/+log/55.0.2860.0..55.0.2861.0?pretty=fuller&n=10000

Stack trace of the crash id ac701d9e00000000:
=============================================
Thread 0 CRASHED [EXC_BAD_INSTRUCTION / EXC_I386_INVOP @ 0x0000000103e05548 ] MAGIC SIGNATURE THREAD
0x0000000103e05548	(Google Chrome Framework -web_ui_message_handler.h:105 )	settings::ClearBrowsingDataHandler::UpdateCounterText(std::__1::unique_ptr<browsing_data::BrowsingDataCounter::Result, std::__1::default_delete<browsing_data::BrowsingDataCounter::Result> >)
0x0000000103e05887	(Google Chrome Framework -bind_internal.h:214 )	base::internal::Invoker<base::internal::BindState<void (settings::ClearBrowsingDataHandler::*)(std::__1::unique_ptr<browsing_data::BrowsingDataCounter::Result, std::__1::default_delete<browsing_data::BrowsingDataCounter::Result> >), base::internal::UnretainedWrapper<settings::ClearBrowsingDataHandler> >, void (std::__1::unique_ptr<browsing_data::BrowsingDataCounter::Result, std::__1::default_delete<browsing_data::BrowsingDataCounter::Result> >)>::Run(base::internal::BindStateBase*, std::__1::unique_ptr<browsing_data::BrowsingDataCounter::Result, std::__1::default_delete<browsing_data::BrowsingDataCounter::Result> >&&)
0x0000000103bb1fef	(Google Chrome Framework -callback.h:64 )	browsing_data::BrowsingDataCounter::ReportResult(std::__1::unique_ptr<browsing_data::BrowsingDataCounter::Result, std::__1::default_delete<browsing_data::BrowsingDataCounter::Result> >)
0x0000000103bb275d	(Google Chrome Framework -history_counter.cc:150 )	browsing_data::HistoryCounter::OnGetLocalHistoryCount(history::HistoryCountResult)
0x0000000103aa802c	(Google Chrome Framework -callback.h:64 )	void base::internal::ReplyAdapter<history::HistoryCountResult, history::HistoryCountResult>(base::Callback<void (history::HistoryCountResult), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, history::HistoryCountResult*)
0x0000000101dc615a	(Google Chrome Framework -callback.h:64 )	(anonymous namespace)::RunIfNotCanceledThenUntrack(base::CancellationFlag const*, base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&)
0x0000000101dd65ee	(Google Chrome Framework -callback.h:64 )	base::(anonymous namespace)::PostTaskAndReplyRelay::RunReplyAndSelfDestruct()
0x0000000101d72738	(Google Chrome Framework -callback.h:64 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&)
0x0000000101d9451b	(Google Chrome Framework -message_loop.cc:469 )	base::MessageLoop::RunTask(base::PendingTask const&)
0x0000000101d9482b	(Google Chrome Framework -message_loop.cc:478 )	base::MessageLoop::DeferOrRunPendingTask(base::PendingTask)
0x0000000101d94bd2	(Google Chrome Framework -message_loop.cc:602 )	base::MessageLoop::DoWork()
0x0000000101d96cdc	(Google Chrome Framework -message_pump_mac.mm:330 )	base::MessagePumpCFRunLoopBase::RunWork()
0x0000000101d8a3b9	(Google Chrome Framework + 0x019dc3b9 )	base::mac::CallWithEHFrame(void () block_pointer)
0x0000000101d966f3	(Google Chrome Framework -message_pump_mac.mm:306 )	base::MessagePumpCFRunLoopBase::RunWorkSource(void*)
0x00007fff8e5b9880	(CoreFoundation + 0x000aa880 )	__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
0x00007fff8e598fbb	(CoreFoundation + 0x00089fbb )	__CFRunLoopDoSources0
0x00007fff8e5984de	(CoreFoundation + 0x000894de )	__CFRunLoopRun
0x00007fff8e597ed7	(CoreFoundation + 0x00088ed7 )	CFRunLoopRunSpecific
0x00007fff98061934	(HIToolbox + 0x00030934 )	RunCurrentEventLoopInMode
0x00007fff9806176e	(HIToolbox + 0x0003076e )	ReceiveNextEventCommon
0x00007fff980615ae	(HIToolbox + 0x000305ae )	_BlockUntilNextEventMatchingListInModeWithFilter
0x00007fff8c6a2df5	(AppKit + 0x00048df5 )	_DPSNextEvent
0x00007fff8c6a2225	(AppKit + 0x00048225 )	-[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
0x00007fff8c696d7f	(AppKit + 0x0003cd7f )	-[NSApplication run]
0x0000000101d974fd	(Google Chrome Framework -message_pump_mac.mm:665 )	base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
0x0000000101d96b3b	(Google Chrome Framework -message_pump_mac.mm:238 )	base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
0x0000000101db0ce0	(Google Chrome Framework -run_loop.cc:35 )	base::RunLoop::Run()
0x000000010198aa24	(Google Chrome Framework -chrome_browser_main.cc:2107 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x000000010101d523	(Google Chrome Framework -browser_main_loop.cc:957 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x000000010101fb11	(Google Chrome Framework -browser_main_runner.cc:155 )	content::BrowserMainRunnerImpl::Run()
0x000000010101994b	(Google Chrome Framework -browser_main.cc:46 )	content::BrowserMain(content::MainFunctionParams const&)
0x000000010194843d	(Google Chrome Framework -content_main_runner.cc:786 )	content::ContentMainRunnerImpl::Run()
0x0000000101947675	(Google Chrome Framework -content_main.cc:20 )	content::ContentMain(content::ContentMainParams const&)
0x00000001003b156b	(Google Chrome Framework -chrome_main.cc:97 )	ChromeMain
0x0000000100147d49	(Google Chrome Canary + 0x00000d49 )	
0x0000000100147b33	(Google Chrome Canary + 0x00000b33 )	

Based on the code search on 'history_counter.cc' suspecting: https://chromium.googlesource.com/chromium/src/+/85ec579564402fad9b6f0d593decf686846fb61f to be the related change.

ricea@: Could you please take a look at this crash and help in further investigation.

Thank you! 

Users experienced this crash on the following builds:

Mac Canary 55.0.2869.0 -  2.06 CPM, 1 reports, 1 clients (signature settings::ClearBrowsingDataHandler::UpdateCounterText)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

My change was part of a large-scale automated change. It is expected to make no semantic difference, and judging by the large scale without breaking tests, I have good confidence that is does indeed make no difference.

I tried to reproduce the crash with 55.0.2861.0 and 55.0.2869.0, built locally, but did not succeed. Perhaps it only crashes on Chrome-branded builds, or maybe I'm missing some crucial step. I believe I followed the instructions precisely.

@dpapad, is this already fixed?

I have no prior knowledge of this crash. Assigning to @tommycli.

Users experienced this crash on the following builds:

Mac Canary 56.0.2886.0 -  1.69 CPM, 1 reports, 1 clients (signature settings::ClearBrowsingDataHandler::UpdateCounterText)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ff49185dcc63d419a850902ed5220377701d1e3c

commit ff49185dcc63d419a850902ed5220377701d1e3c
Author: tommycli <tommycli@chromium.org>
Date: Wed Nov 30 18:40:38 2016

MD Settings: Fix WebUI lifecycle issues in Clear Browsing Data handler.

BUG= 649644 

Review-Url: https://codereview.chromium.org/2536003003
Cr-Commit-Position: refs/heads/master@{#435353}

[modify] https://crrev.com/ff49185dcc63d419a850902ed5220377701d1e3c/chrome/browser/ui/webui/settings/settings_clear_browsing_data_handler.cc

I theorize the above patch fixes these crashes. Let's monitor.