Using the per-revision bisect providing the bisect results,

Good build: 57.0.2983.0 (Revision: 443819).
Bad build: 57.0.2984.0 (Revision: 443964).

You are probably looking for a change made after 443837 (known good), but no later than 443838 (first known bad).
CHANGELOG URL:
The script might not always return single CL as suspects some perf builds might get missing due to failure.
  https://chromium.googlesource.com/chromium/src/+log/dc7d397153bcbccbc21e12f2ea3568f594699220..e3df8cd8ac45539711b1f0b6a00420f87d09d279

@tibell -- Could you please look into the issue, please help us to find an owner if not with respect to your change. 

Thanks.!

Looks like something got messed up in the mojoification... tibell, can you investigate?

I'm looking into this.

Fix in review: http://crrev.com/2639823002

 Issue 682428  has been merged into this issue.

 Issue 682140  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/73a0a9657be8e61ebb32464455454cd631ee2a80

commit 73a0a9657be8e61ebb32464455454cd631ee2a80
Author: treib <treib@chromium.org>
Date: Fri Jan 20 16:31:04 2017

Retrieve NTP thumbnail URLs from the right frame

The SearchBox instance, which stores state used in NTP, only lives on the main
frame. In one instance where we looked this up we mistakenly looked in the child
frame.

BUG= 681749 

Review-Url: https://codereview.chromium.org/2646133003
Cr-Commit-Position: refs/heads/master@{#445072}

[modify] https://crrev.com/73a0a9657be8e61ebb32464455454cd631ee2a80/chrome/renderer/chrome_content_renderer_client.cc
[modify] https://crrev.com/73a0a9657be8e61ebb32464455454cd631ee2a80/chrome/renderer/chrome_content_renderer_client_browsertest.cc

A friendly reminder that M57 Beta launch is coming soon on February 2nd! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix and get it merged into the release branch (2987) ASAP so it gets enough baking time in Dev (before Beta promotion). Thank you!

Your change meets the bar and is auto-approved for M57. Please go ahead and merge the CL to branch 2987 manually. Please contact milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), ketakid@(cros), govind@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bda82aa1bd8d279e005a2c158786318e0e3a0b18

commit bda82aa1bd8d279e005a2c158786318e0e3a0b18
Author: Sam McNally <sammc@chromium.org>
Date: Mon Jan 23 05:47:25 2017

Retrieve NTP thumbnail URLs from the right frame

The SearchBox instance, which stores state used in NTP, only lives on the main
frame. In one instance where we looked this up we mistakenly looked in the child
frame.

BUG= 681749 

Review-Url: https://codereview.chromium.org/2646133003
Cr-Commit-Position: refs/heads/master@{#445072}
(cherry picked from commit 73a0a9657be8e61ebb32464455454cd631ee2a80)

Review-Url: https://codereview.chromium.org/2649833002 .
Cr-Commit-Position: refs/branch-heads/2987@{#17}
Cr-Branched-From: ad51088c0e8776e8dcd963dbe752c4035ba6dab6-refs/heads/master@{#444943}

[modify] https://crrev.com/bda82aa1bd8d279e005a2c158786318e0e3a0b18/chrome/renderer/chrome_content_renderer_client.cc
[modify] https://crrev.com/bda82aa1bd8d279e005a2c158786318e0e3a0b18/chrome/renderer/chrome_content_renderer_client_browsertest.cc

I am still seeing this on :

Google Chrome	58.0.3004.3 (Official Build) dev (64-bit)
Revision	748a9b8eaae6a2a2d9870544166f8adf670b7a80-refs/branch-heads/3004@{#4}
OS	Linux
JavaScript	V8 5.8.110

Just tested on the exact config you mentioned and the NTP and thumbnails work for me following the original repro instructions. Could you provide complete repro? Thanks!