Issue is reproducible on the latest canary(58.0.3025.0) on Mac OS 10.12.3.

Stack trace of 1bb4e251c0000000:
=================================
Thread 0 CRASHED [SIGSEGV @ 0x00000020 ] MAGIC SIGNATURE THREAD
Stack Quality82%Show frame trust levels
0x00005600d12c2c71	(chrome -./out/Release/../../components/ntp_tiles/most_visited_sites.cc:86 )	ntp_tiles::MostVisitedSites::DoesSourceExist(ntp_tiles::NTPTileSource) const
0x00005600d3840491	(chrome -./out/Release/../../components/ntp_tiles/webui/ntp_tiles_internals_message_handler.cc:137 )	ntp_tiles::NTPTilesInternalsMessageHandler::HandleFetchSuggestions(base::ListValue const*)
0x00005600cf1b0161	(chrome -./out/Release/../../base/callback.h:85 )	content::WebUIImpl::ProcessWebUIMessage(GURL const&, std::string const&, base::ListValue const&)
0x00005600cf1b09d2	(chrome -./out/Release/../../base/tuple.h:91 )	bool IPC::MessageT<ViewHostMsg_WebUISend_Meta, std::tuple<GURL, std::string, base::ListValue>, void>::Dispatch<content::WebUIImpl, content::WebUIImpl, void, void (content::WebUIImpl::*)(GURL const&, std::string const&, base::ListValue const&)>(IPC::Message const*, content::WebUIImpl*, content::WebUIImpl*, void*, void (content::WebUIImpl::*)(GURL const&, std::string const&, base::ListValue const&))
0x00005600cf1b082f	(chrome -./out/Release/../../content/browser/webui/web_ui_impl.cc:90 )	content::WebUIImpl::OnMessageReceived(IPC::Message const&)
0x00005600cf18c3e7	(chrome -./out/Release/../../content/browser/web_contents/web_contents_impl.cc:685 )	content::WebContentsImpl::OnMessageReceived(content::RenderViewHostImpl*, IPC::Message const&)
0x00005600cf0c646c	(chrome -./out/Release/../../content/browser/renderer_host/render_view_host_impl.cc:728 )	content::RenderViewHostImpl::OnMessageReceived(IPC::Message const&)
0x00005600cf0cbe1e	(chrome -./out/Release/../../content/browser/renderer_host/render_widget_host_impl.cc:515 )	content::RenderWidgetHostImpl::OnMessageReceived(IPC::Message const&)
0x00005600d0677b69	(chrome -./out/Release/../../ipc/ipc_channel_proxy.cc:329 )	IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&)
0x00005600d01f5e9d	(chrome -./out/Release/../../base/callback.h:68 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x00005600d018cdcf	(chrome -./out/Release/../../base/message_loop/message_loop.cc:421 )	base::MessageLoop::RunTask(base::PendingTask*)
0x00005600d018c8c4	(chrome -./out/Release/../../base/message_loop/message_loop.cc:430 )	base::MessageLoop::DoWork()
0x00005600d018e598	(chrome -./out/Release/../../base/message_loop/message_pump_glib.cc:267 )	base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*)
0x00007f372b759e03	(libglib-2.0.so.0.4002.0 + 0x00048e03 )	
0x00007f372b768b3f	(libglib-2.0.so.0.4002.0 + 0x00057b3f )	
0x00007f372b75a047	(libglib-2.0.so.0.4002.0 + 0x00049047 )	
0x00007f372b75a0eb	(libglib-2.0.so.0.4002.0 + 0x000490eb )	
0x00005600d018e7f5	(chrome -./out/Release/../../base/message_loop/message_pump_glib.cc:309 )	base::MessagePumpGlib::Run(base::MessagePump::Delegate*)
0x00005600d01aaddf	(chrome -./out/Release/../../base/run_loop.cc:37 )	base::RunLoop::Run()
0x00005600d0069185	(chrome -./out/Release/../../chrome/browser/chrome_browser_main.cc:2000 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x00005600cee91407	(chrome -./out/Release/../../content/browser/browser_main_loop.cc:1183 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x00005600cee935ac	(chrome -./out/Release/../../content/browser/browser_main_runner.cc:141 )	content::BrowserMainRunnerImpl::Run()
0x00005600cee8aff8	(chrome -./out/Release/../../content/browser/browser_main.cc:46 )	content::BrowserMain(content::MainFunctionParams const&)
0x00005600cfe0ebbb	(chrome -./out/Release/../../content/app/content_main_runner.cc:812 )	content::ContentMainRunnerImpl::Run()
0x00005600cfe0d62d	(chrome -./out/Release/../../content/app/content_main.cc:20 )	content::ContentMain(content::ContentMainParams const&)
0x00005600cea70990	(chrome -./out/Release/../../chrome/app/chrome_main.cc:112 )	ChromeMain
0x00007f3726247ec4	(libc-2.19.so -libc-start.c:287 )	__libc_start_main
0x00005600cea5fa20	(chrome + 0x00b3da20 )	_start

Bisect Information:
---------------------
Using the per-revision bisect providing the bisect results,

You are probably looking for a change made after 448592 (known good), but no later than 448593 (first known bad).

CHANGE-LOG URL:
-----------------
https://chromium.googlesource.com/chromium/src/+log/ea826e787b9356bf03d88dd43045af019270ee7d..65cefe9d0f5cd6a7892476b55e6431a91c05d11b

From the CL above, assigning the issue to the concern owner
Review-Url: https://codereview.chromium.org/2572133002

sfiera@ Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Note: Since this is a recent regression adding RB-Stable, Please feel free to edit if this is not the case.

Thanks!

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d6336797781587abf6c3fa648d034315714d1134

commit d6336797781587abf6c3fa648d034315714d1134
Author: sfiera <sfiera@chromium.org>
Date: Mon Feb 27 15:44:08 2017

chrome://ntp-tiles-internals: hide when incognito

Previously I just disabled the callbacks. In addition to that, send back
an empty configuration and site list, to make the page properly display
that everything is disabled and there are no sites in incognito.

Without this change, the "View JSON" button appears for popular sites,
but causes a crash because there's no PopularSites object.

BUG= 682622 , 696471 ,681774

Review-Url: https://codereview.chromium.org/2721603002
Cr-Commit-Position: refs/heads/master@{#453220}

[modify] https://crrev.com/d6336797781587abf6c3fa648d034315714d1134/components/ntp_tiles/webui/ntp_tiles_internals_message_handler.cc
[modify] https://crrev.com/d6336797781587abf6c3fa648d034315714d1134/components/ntp_tiles/webui/resources/ntp_tiles_internals.js