Able to reproduce the issue on Mac 10.12.3 using chrome version 58.0.3020.0

Stack Trace:
-------------
Thread 0 CRASHED [EXCEPTION_BREAKPOINT @ 0x00007fff88842722 ] MAGIC SIGNATURE THREAD
Stack Quality100%Show frame trust levels
0x00007fff88842722	(chrome_child.dll -v8perisolatedata.cpp:47 )	blink::beforeCallEnteredCallback
0x00007fff888426d9	(chrome_child.dll -api.cc:242 )	v8::`anonymous namespace'::CallDepthScope<1>::CallDepthScope<1>
0x00007fff88916cd1	(chrome_child.dll -api.cc:5129 )	v8::Function::NewInstance(v8::Local<v8::Context>,int,v8::Local<v8::Value> * const)
0x00007fff88916bee	(chrome_child.dll -v8scriptrunner.cpp:724 )	blink::V8ScriptRunner::instantiateObject(v8::Isolate *,v8::Local<v8::Function>,int,v8::Local<v8::Value> * const)
0x00007fff88916b5b	(chrome_child.dll -v8objectconstructor.cpp:40 )	blink::V8ObjectConstructor::newInstance(v8::Isolate *,v8::Local<v8::Function>)
0x00007fff889154bc	(chrome_child.dll -v8percontextdata.cpp:96 )	blink::V8PerContextData::createWrapperFromCacheSlowCase(blink::WrapperTypeInfo const *)
0x00007fff884c3389	(chrome_child.dll -v8domwrapper.cpp:61 )	blink::V8DOMWrapper::createWrapper(v8::Isolate *,v8::Local<v8::Object>,blink::WrapperTypeInfo const *)
0x00007fff885ef385	(chrome_child.dll -scriptwrappable.cpp:29 )	blink::ScriptWrappable::wrap(v8::Isolate *,v8::Local<v8::Object>)
0x00007fff885ed711	(chrome_child.dll -tov8.h:40 )	blink::ToV8(blink::ScriptWrappable *,v8::Local<v8::Object>,v8::Isolate *)
0x00007fff88617fb8	(chrome_child.dll -v8abstracteventlistener.cpp:98 )	blink::V8AbstractEventListener::handleEvent(blink::ScriptState *,blink::Event *)
0x00007fff8861773e	(chrome_child.dll -v8abstracteventlistener.cpp:89 )	blink::V8AbstractEventListener::handleEvent(blink::ExecutionContext *,blink::Event *)
0x00007fff88617267	(chrome_child.dll -eventtarget.cpp:712 )	blink::EventTarget::fireEventListeners(blink::Event *,blink::EventTargetData *,blink::HeapVector<blink::RegisteredEventListener,1> &)
0x00007fff88616d95	(chrome_child.dll -eventtarget.cpp:574 )	blink::EventTarget::fireEventListeners(blink::Event *)
0x00007fff88616af1	(chrome_child.dll -windoweventcontext.cpp:56 )	blink::WindowEventContext::handleLocalEvents(blink::Event &)
0x00007fff886168f3	(chrome_child.dll -eventdispatcher.cpp:229 )	blink::EventDispatcher::dispatchEventAtBubbling()
0x00007fff884a65af	(chrome_child.dll -eventdispatcher.cpp:156 )	blink::EventDispatcher::dispatch()
0x00007fff886272e5	(chrome_child.dll -eventdispatcher.cpp:59 )	blink::EventDispatcher::dispatchEvent(blink::Node &,blink::EventDispatchMediator *)
0x00007fff885104a9	(chrome_child.dll -node.cpp:2082 )	blink::Node::dispatchScopedEvent(blink::Event *)
0x00007fff88ff8081	(chrome_child.dll -node.cpp:2100 )	blink::Node::dispatchSubtreeModifiedEvent()
0x00007fff887ae5a3	(chrome_child.dll -element.cpp:2572 )	blink::Element::appendAttributeInternal(blink::QualifiedName const &,WTF::AtomicString const &,blink::Element::SynchronizationOfLazyAttribute)
0x00007fff884ac813	(chrome_child.dll -element.cpp:1234 )	blink::Element::setAttribute(WTF::AtomicString const &,WTF::AtomicString const &,blink::ExceptionState &)
0x00007fff88d948f4	(chrome_child.dll -webelement.cpp:99 )	blink::WebElement::setAttribute(blink::WebString const &,blink::WebString const &)
0x00007fff889470b7	(chrome_child.dll -password_autofill_agent.cc:578 )	autofill::`anonymous namespace'::AnnotateFormsWithSignatures
0x00007fff889468d5	(chrome_child.dll -password_autofill_agent.cc:1058 )	autofill::PasswordAutofillAgent::SendPasswordForms(bool)
0x00007fff889462e1	(chrome_child.dll -password_autofill_agent.cc:1138 )	autofill::PasswordAutofillAgent::DidFinishDocumentLoad()
0x00007fff88538f52	(chrome_child.dll -render_frame_impl.cc:3825 )	content::RenderFrameImpl::didFinishDocumentLoad(blink::WebLocalFrame *)
0x00007fff88d77337	(chrome_child.dll -frameloaderclientimpl.cpp:367 )	blink::FrameLoaderClientImpl::dispatchDidFinishDocumentLoad()
0x00007fff88b2ce5c	(chrome_child.dll -frameloader.cpp:633 )	blink::FrameLoader::finishedParsing()
0x00007fff88b2d55c	(chrome_child.dll -document.cpp:5276 )	blink::Document::finishedParsing()
0x00007fff88612b1d	(chrome_child.dll -htmldocumentparser.cpp:949 )	blink::HTMLDocumentParser::end()
0x00007fff88612a8d	(chrome_child.dll -htmldocumentparser.cpp:252 )	blink::HTMLDocumentParser::prepareToStopParsing()
0x00007fff88613194	(chrome_child.dll -htmldocumentparser.cpp:544 )	blink::HTMLDocumentParser::processTokenizedChunkFromBackgroundParser(std::unique_ptr<blink::HTMLDocumentParser::TokenizedChunk,std::default_delete<blink::HTMLDocumentParser::TokenizedChunk> >)
0x00007fff88b2df12	(chrome_child.dll -htmldocumentparser.cpp:628 )	blink::HTMLDocumentParser::pumpPendingSpeculations()
0x00007fff88ce9c77	(chrome_child.dll -htmlparserscheduler.cpp:150 )	blink::HTMLParserScheduler::continueParsing()
0x00007fff88985fd2	(chrome_child.dll -bind_internal.h:339 )	base::internal::Invoker<base::internal::BindState<void ( blink::ScriptRunner::*)(void),blink::WeakPersistent<blink::ScriptRunner> >,void >::Run(base::internal::BindStateBase *)
0x00007fff88cfa790	(chrome_child.dll -webtaskrunner.cpp:75 )	blink::TaskHandle::Runner::run(blink::TaskHandle const &)
0x00007fff88cfa75c	(chrome_child.dll -bind_internal.h:339 )	base::internal::Invoker<base::internal::BindState<void ( blink::TaskHandle::Runner::*)(blink::TaskHandle const &),base::WeakPtr<blink::TaskHandle::Runner>,blink::TaskHandle>,void >::Run(base::internal::BindStateBase *)
0x00007fff886d90c3	(chrome_child.dll -callback.h:68 )	base::internal::RunMixin<base::Callback<void ,0,0> >::Run( ?? )
0x00007fff886d900d	(chrome_child.dll -task_annotator.cc:59 )	base::debug::TaskAnnotator::RunTask(char const *,base::PendingTask *)
0x00007fff886d47d9	(chrome_child.dll -task_queue_manager.cc:533 )	blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(blink::scheduler::internal::WorkQueue *,bool,blink::scheduler::LazyNow,base::TimeTicks *)
0x00007fff8866d942	(chrome_child.dll -task_queue_manager.cc:331 )	blink::scheduler::TaskQueueManager::DoWork(bool)
0x00007fff8866c5aa	(chrome_child.dll -bind_internal.h:339 )	base::internal::Invoker<base::internal::BindState<void ( blink::scheduler::TaskQueueManager::*)(bool),base::WeakPtr<blink::scheduler::TaskQueueManager>,bool>,void >::Run(base::internal::BindStateBase *)
0x00007fff886d90c3	(chrome_child.dll -callback.h:68 )	base::internal::RunMixin<base::Callback<void ,0,0> >::Run( ?? )
0x00007fff886d900d	(chrome_child.dll -task_annotator.cc:59 )	base::debug::TaskAnnotator::RunTask(char const *,base::PendingTask *)
0x00007fff886d4322	(chrome_child.dll -message_loop.cc:423 )	base::MessageLoop::RunTask(base::PendingTask *)
0x00007fff886d8c26	(chrome_child.dll -message_loop.cc:527 )	base::MessageLoop::DoWork()
0x00007fff886d8442	(chrome_child.dll -message_pump_default.cc:33 )	base::MessagePumpDefault::Run(base::MessagePump::Delegate *)
0x00007fff888b6fc1	(chrome_child.dll -run_loop.cc:37 )	base::RunLoop::Run()
0x00007fff887ed4df	(chrome_child.dll -renderer_main.cc:200 )	content::RendererMain(content::MainFunctionParams const &)
0x00007fff887e9b59	(chrome_child.dll -content_main_runner.cc:491 )	content::RunNamedProcessTypeMain(std::basic_string<char,std::char_traits<char>,std::allocator<char> > const &,content::MainFunctionParams const &,content::ContentMainDelegate *)
0x00007fff887eae42	(chrome_child.dll -content_main_runner.cc:836 )	content::ContentMainRunnerImpl::Run()
0x00007fff887eaf10	(chrome_child.dll -content_main.cc:20 )	content::ContentMain(content::ContentMainParams const &)
0x00007fff88b081ec	(chrome_child.dll -chrome_main.cc:113 )	ChromeMain
0x00007ff72523760b	(chrome.exe -main_dll_loader_win.cc:201 )	MainDllLoader::Launch(HINSTANCE__ *,base::TimeTicks)
0x00007ff7252326bc	(chrome.exe -chrome_exe_main_win.cc:283 )	wWinMain
0x00007ff7252bf9e2	(chrome.exe -exe_common.inl:253 )	__scrt_common_main_seh
0x00007fffce328101	(KERNEL32.DLL + 0x00018101 )	BaseThreadInitThunk
0x00007fffd041c5b3	(ntdll.dll + 0x0005c5b3 )	RtlUserThreadStart

Bisect Information:
---------------------
Using the per-revision bisect providing the bisect results,

You are probably looking for a change made after 451718 (known good), but no later than 451719 (first known bad).

CHANGE-LOG URL:
-----------------
https://chromium.googlesource.com/chromium/src/+log/f384edd5ac54a0f81cd1f4be3bb271d6502c85cf..c8ff75bcb4213239787068128437f9829a2f0de8

From the CL above, assigning the issue to the concern owner
Review-Url: https://codereview.chromium.org/2704503002

kolos@ - Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!

Somehow I am unable to reproduce the  crash on the latest M-58(58.0.3025.5) on Windows-10. Hence closing the issue.


Note: I was able to reproduce the issue on the reported version: 58.0.3020.0 on Windows-10.