Chrome Version: 60.0.3112.0 / 9592.0.0 Dev-channel   Paine, Kip ,Minnie,Jerry & Quawks
OS: Chrome

What steps will reproduce the problem?
(1)Sign into user -> Go to chrome://settingsmanageAccessibility page
(2)Enable 'Enable ChromeVox (spoken feedback)' option so that 'Open ChromeVox Settings' option is enabled 
(3)Now click on 'Open ChromeVox Settings' -> Navigates to 'ChromeVox Options' page  and observe Tab Crash after the page is loaded(Please refer Video)

Expected: No Tab Crash should be seen on opening 'ChromeVox Settings' page 
Actual: Instead Tab Crash is seen

This is Regression Issue as same is working fine in 60.0.3110.0/9590.0.0 Paine

@dmazzoni : Please confirm the Issue 

Below is the Crash id:
74b4c0dcf0000000

Stack Trace:
Thread 0 CRASHED [SIGILL @ 0x000057f6ff791575 ] MAGIC SIGNATURE THREAD
Stack Quality
96%Show frame trust levels

0x000057f6ff791575
(chrome+ 0x0769b575)
blink::AXMenuListOption::ComputeParent() const
0x000057f6ff7763ef
(chrome+ 0x076803ef)
blink::AXObjectImpl::DocumentFrameView() const
0x000057f6ff77635c
(chrome+ 0x0768035c)
blink::AXObjectImpl::GetDocument() const
0x000057f6ff7731c7
(chrome+ 0x0767d1c7)
blink::AXObjectImpl::AccessibilityIsIgnored()
0x000057f6ff79c4b4
(chrome+ 0x076a64b4)
blink::AXNodeObject::InsertChild(blink::AXObjectImpl*, unsigned int)
0x000057f6ff79c3db
(chrome+ 0x076a63db)
blink::AXNodeObject::AddChildren()
0x000057f6ff791568
(chrome+ 0x0769b568)
blink::AXMenuListOption::ComputeParent() const
0x000057f6ff7763ef
(chrome+ 0x076803ef)
blink::AXObjectImpl::DocumentFrameView() const
0x000057f6ff77635c
(chrome+ 0x0768035c)
blink::AXObjectImpl::GetDocument() const
0x000057f6fde16952
(chrome+ 0x05d20952)
blink::WebAXObject::UpdateLayoutAndCheckValidity()
0x000057f6fe0b9dce
(chrome+ 0x05fc3dce)
content::RenderAccessibilityImpl::SendPendingAccessibilityEvents()
0x000057f6f905b200
(chrome+ 0x00f65200)
base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x000057f6f90d2ffb
(chrome+ 0x00fdcffb)
blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(blink::scheduler::internal::WorkQueue*, bool, blink::scheduler::LazyNow, base::TimeTicks*)
0x000057f6f90d204f
(chrome+ 0x00fdc04f)
blink::scheduler::TaskQueueManager::DoWork(bool)
0x000057f6f905b200
(chrome+ 0x00f65200)
base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x000057f6f904b925
(chrome+ 0x00f55925)
base::MessageLoop::RunTask(base::PendingTask*)
0x000057f6f904c988
(chrome+ 0x00f56988)
base::MessageLoop::DoWork()
0x000057f6fb103969
(chrome+ 0x0300d969)
base::MessagePumpDefault::Run(base::MessagePump::Delegate*)
0x000057f6fb126f8f
(chrome+ 0x03030f8f)
base::RunLoop::Run()
0x000057f6fe0104c7
(chrome+ 0x05f1a4c7)
content::RendererMain(content::MainFunctionParams const&)
0x000057f6facb3fed
(chrome+ 0x02bbdfed)	

 

Deleted: Actual_ChromeVoxTabCrash.webm 911 KB

	Actual_ChromeVoxTabCrash.webm 911 KB View Download

Deleted: Expected.webm 1.1 MB

	Expected.webm 1.1 MB View Download