Issue is also seen in Windows.

Deleted: Actual.ogv 1.6 MB

	Actual.ogv 1.6 MB View Download

Using the per-revision bisect providing the bisect results,
Good Build -- 58.0.3021.0 (revision : 452347)
Bad Build  -- 58.0.3022.0 (revision : 452713)

You are probably looking for a change made after 452510 (known good), but no later than 452511 (first known bad).
CHANGELOG URL:
  https://chromium.googlesource.com/chromium/src/+log/d0b0e164df66904125ecdcf3473212a1d97a11ce..fbb1bb97ae95653a5d4cc6b55d3f71260ac5fc5d

@kinuko -- Could you please look into the issue, kindly re-assign if this is not related to your changes.

Thank You.

Could reproduce on Mac, looking.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ef33cbc2c4e56e2aa5c1503b7cbaf0b826c3affe

commit ef33cbc2c4e56e2aa5c1503b7cbaf0b826c3affe
Author: kinuko <kinuko@chromium.org>
Date: Fri Feb 24 18:08:10 2017

NetworkStateNotifier: also remove NetworkStateObserver in finalizer too

I was wrong that contextDestroy is not always called before the
document gets destructed.

Make sure we remove NetworkStateNotifier in finalizer too to avoid crash.

BUG= 695783 
TEST=See the bug for repro

Review-Url: https://codereview.chromium.org/2714643008
Cr-Commit-Position: refs/heads/master@{#452870}

[modify] https://crrev.com/ef33cbc2c4e56e2aa5c1503b7cbaf0b826c3affe/third_party/WebKit/Source/core/dom/Document.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6e78ba0f584de89a6abc55d43c283fb16a4b3afd

commit 6e78ba0f584de89a6abc55d43c283fb16a4b3afd
Author: kinuko <kinuko@chromium.org>
Date: Mon Feb 27 10:41:40 2017

Don't attach NetworkStateObserver until Document is initialized/attached

BUG= 695783 
TEST=See the bug page

Review-Url: https://codereview.chromium.org/2719873002
Cr-Commit-Position: refs/heads/master@{#453183}

[modify] https://crrev.com/6e78ba0f584de89a6abc55d43c283fb16a4b3afd/third_party/WebKit/Source/core/dom/Document.cpp

Issue is not reproducible on latest #59.0.3036.0 for Windows,Ubuntu 14.04

Verified the fix on the latest Mac canary(59.0.3036.0) as well. This is working as intended and no crash is seen. Adding the verified label for M-59.

kinuko@: Could you please close the issue if there is no further work to be done here. No merge required here as the fix landed before M-58 branch point(#454471)

[Auto-generated comment by a script] We noticed that this issue is targeted for M-58; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-58 label, otherwise remove Merge-TBD label. Thanks.

No merge is needed per comment #7 and it is if fixed per comment #8.