Using the per-revision bisect providing the bisect results,
Good build:61.0.3153.0(Revision:485143).
Bad build:61.0.3154.0(Revision:485485).

You are probably looking for a change made after 485161 (known good), but no later than 485162 (first known bad).

CHANGE-LOG URL:
---------------
https://chromium.googlesource.com/chromium/src/+log/3dc858ba5d7474567884f9b82234b281b14520f9..29ea4e7b80e011404572ca22b5f819e66974368d

From the CL above, assigning the issue to the concern owner

@dcheng: Could you please look into the issue, pardon me if it has nothing to do with your changes and if possible please assign it to concern owner.

Reviewed-on:https://chromium-review.googlesource.com/564072
Note :1.Mac specific issue and Able to reproduce in latest Canary #61.0.3154.0
2.This crash not seen on today's dev build #61.0.3153.0(Win) and 61.0.3153.4(Mac & Linux).
3.Adding Release Block-Dev for this issue.Please remove if not the case.

Stack Trace:
------------
Thread 0 (id: 47366) CRASHED [EXC_BAD_ACCESS / KERN_INVALID_ADDRESS @ 0x00000008 ] MAGIC SIGNATURE THREAD
Stack Quality79%Show frame trust levels
0x000000010be41123	(Google Chrome Framework -memory:2519 )	ukm::UkmEntryBuilder::AddMetric(char const*, long long)
0x0000000109e74d6f	(Google Chrome Framework -process_memory_metrics_emitter.cc:22 )	ProcessMemoryMetricsEmitter::ReceivedMemoryDump(bool, unsigned long long, mojo::StructPtr<memory_instrumentation::mojom::GlobalMemoryDump>)
0x0000000109e7538b	(Google Chrome Framework -bind_internal.h:209 )	base::internal::Invoker<base::internal::BindState<void (ProcessMemoryMetricsEmitter::*)(bool, unsigned long long, mojo::StructPtr<memory_instrumentation::mojom::GlobalMemoryDump>), scoped_refptr<ProcessMemoryMetricsEmitter> >, void (bool, unsigned long long, mojo::StructPtr<memory_instrumentation::mojom::GlobalMemoryDump>)>::Run(base::internal::BindStateBase*, bool&&, unsigned long long&&, mojo::StructPtr<memory_instrumentation::mojom::GlobalMemoryDump>&&)
0x0000000108a68995	(Google Chrome Framework -callback.h:91 )	memory_instrumentation::mojom::Coordinator_RequestGlobalMemoryDump_ForwardToCallback::Accept(mojo::Message*)
0x000000010a2777ef	(Google Chrome Framework -interface_endpoint_client.cc:399 )	mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*)
0x000000010a27d44a	(Google Chrome Framework -multiplex_router.cc:876 )	mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::Message*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*)
0x000000010a27cf65	(Google Chrome Framework -multiplex_router.cc:606 )	mojo::internal::MultiplexRouter::Accept(mojo::Message*)
0x000000010a27610e	(Google Chrome Framework -connector.cc:390 )	mojo::Connector::ReadSingleMessage(unsigned int*)
0x000000010a2766f0	(Google Chrome Framework -connector.cc:419 )	mojo::Connector::ReadAllAvailableMessages()
0x000000010a284e55	(Google Chrome Framework -callback.h:80 )	mojo::SimpleWatcher::OnHandleReady(int, unsigned int)
0x000000010a1b85a1	(Google Chrome Framework -callback.h:91 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x000000010a1de71a	(Google Chrome Framework -message_loop.cc:422 )	base::MessageLoop::RunTask(base::PendingTask*)
0x000000010a1deb04	(Google Chrome Framework -message_loop.cc:433 )	base::MessageLoop::DeferOrRunPendingTask(base::PendingTask)
0x000000010a1dedd8	(Google Chrome Framework -message_loop.cc:540 )	base::MessageLoop::DoWork()
0x000000010a1e2249	(Google Chrome Framework -message_pump_mac.mm:421 )	base::MessagePumpCFRunLoopBase::RunWork()
0x000000010a1d22b9	(Google Chrome Framework + 0x01ac92b9 )	base::mac::CallWithEHFrame(void () block_pointer)
0x000000010a1e1b6e	(Google Chrome Framework -message_pump_mac.mm:397 )	base::MessagePumpCFRunLoopBase::RunWorkSource(void*)
0x00007fffc2fc38d0	(CoreFoundation + 0x000a48d0 )	__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
0x00007fffc2fa4c6b	(CoreFoundation + 0x00085c6b )	__CFRunLoopDoSources0
0x00007fffc2fa4155	(CoreFoundation + 0x00085155 )	__CFRunLoopRun
0x00007fffc2fa3b53	(CoreFoundation + 0x00084b53 )	CFRunLoopRunSpecific
0x00007fffc252ea5b	(HIToolbox + 0x00030a5b )	RunCurrentEventLoopInMode
0x00007fffc252e890	(HIToolbox + 0x00030890 )	ReceiveNextEventCommon
0x00007fffc252e6c5	(HIToolbox + 0x000306c5 )	_BlockUntilNextEventMatchingListInModeWithFilter
0x00007fffc0ad45b3	(AppKit + 0x000475b3 )	_DPSNextEvent
0x00007fffc124ed6a	(AppKit + 0x007c1d6a )	-[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
0x0000000109dca10f	(Google Chrome Framework -chrome_browser_application_mac.mm:187 )	__71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke
0x000000010a1d22b9	(Google Chrome Framework + 0x01ac92b9 )	base::mac::CallWithEHFrame(void () block_pointer)
0x0000000109dca053	(Google Chrome Framework -chrome_browser_application_mac.mm:186 )	-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
0x00007fffc0ac8f34	(AppKit + 0x0003bf34 )	-[NSApplication run]
0x000000010a1e2a7d	(Google Chrome Framework -message_pump_mac.mm:749 )	base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
0x000000010a1e147b	(Google Chrome Framework -message_pump_mac.mm:141 )	base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
0x000000010a203ff2	(Google Chrome Framework -run_loop.cc:111 )	base::RunLoop::Run()
0x0000000109dcffb4	(Google Chrome Framework -chrome_browser_main.cc:1962 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x0000000108cf0a83	(Google Chrome Framework -browser_main_loop.cc:1147 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x0000000108cf3141	(Google Chrome Framework -browser_main_runner.cc:142 )	content::BrowserMainRunnerImpl::Run()
0x0000000108cecd3b	(Google Chrome Framework -browser_main.cc:46 )	content::BrowserMain(content::MainFunctionParams const&)
0x0000000109d8665f	(Google Chrome Framework -content_main_runner.cc:686 )	content::ContentMainRunnerImpl::Run()
0x000000010b6c8823	(Google Chrome Framework -main.cc:469 )	service_manager::Main(service_manager::MainParams const&)
0x0000000109d85c43	(Google Chrome Framework -content_main.cc:19 )	content::ContentMain(content::ContentMainParams const&)
0x000000010870cab7	(Google Chrome Framework -chrome_main.cc:134 )	ChromeMain
0x0000000108691dd3	(Google Chrome -chrome_exe_main_mac.cc:167 )	main
0x00007fffd85a0254	(libdyld.dylib + 0x00005254 )	start
0x00007fffd85a0254	(libdyld.dylib + 0x00005254 )	start

Just to update, as per the available canary crash data(61.0.3154.0) there have been 169 crashes from 167 clients so far and this is ranked as #1 browser crash on Mac canary.

Link to the crashes:
====================
https://goto.google.com/mlros

Based on the code search on 'process_memory_metrics_emitter.cc', https://chromium-review.googlesource.com/c/531804/ looks more plausible suspect from the below regression range:

https://chromium.googlesource.com/chromium/src/+log/61.0.3153.0..61.0.3154.0?pretty=fuller&n=10000

jchinlee@: Could you please take a look at these crashes and revert the CL if the suspected CL is related.

Note: The above issue is also reproducible on LINUX (14.04 LTS) on #61.0.3154.0

Crash Report ID 18d97a8f08000000 (Local Crash ID: Chrome)  

Steps to reproduce on LINUX
1. Launch chrome, navigate to NTP and open devtools
2. Now go to 'Application' section and click on 'Clear storage' and then click on 'Clear site data' button.
3. Now reload the page and observe 'Cache storage' option under Cache.
4. Continuously keep on refreshing and observe.

As per the crash server this is happening across Android and Windows canary version: 61.0.3154.0 as well and canary is supercrashy due to this.

Looping stability sheriff as well for getting the CL reverted and increasing the priority to P0.

Pls revert suspected CL asap as latest Canary #61.0.3154.0 is supercrashy due to this. 

I believe this already reverted it?
https://chromium-review.googlesource.com/c/566518

Yeah, looks like it. 
Please merge the revert to Canary branch #3154 so we can trigger new canary with the revert in. Thank you.

(stability sheriff) Merging per comment 9.

Merged.

Issue https://chromium-review.googlesource.com/566889 has been submitted.
Landed as: https://chromium.googlesource.com/chromium/src/+/b8a421ba69381f135dbaaa2eda587b6318e69d4

Marking as Fixed given the reverts.

Issue 740940 has been merged into this issue.

Thank you for the quick revert and merge to #3154 branch. I'm triggering new Canary from branch #3154 now for Desktop. 

Note: amineer@ already triggered new Canary for Android.

We(Android) also observed same crash on arm_64 device(HTC ONE A9)
Steps:
1. Launch the app(61.0.3154.0)
2. Open new tab and tap on menu(3 dots)

Crash id -https://crash.corp.google.com/browse?stbtiq=cb3af48268000000

Crash seen on ChromeOS as well.

Crash report snappy: https://crash.corp.google.com/browse?stbtiq=0a0884af08000000
Crash report kevin: https://crash.corp.google.com/browse?stbtiq=e91d8caf08000000

Crash observed on Hana & Chell:

Chell: https://crash.corp.google.com/browse?stbtiq=19e8dcbe40000000
Hana: 
Crash Report ID c9f650af08000000 (Local Crash ID: Chrome)
Crash Report ID f38550af08000000 (Local Crash ID: Chrome)
Crash Report ID c5fc174fb8000000 (Local Crash ID: Chrome)
Crash Report ID 9f995cbe40000000 (Local Crash ID: Chrome)

Issue 740881 has been merged into this issue.

Most crashes are observed on Windows, Android and Mac.

https://crash.corp.google.com/browse?q=custom_data.ChromeCrashProto.magic_signature_1.name%3D%27ukm%3A%3AUkmEntryBuilder%3A%3AAddMetric%27&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D#-property-selector,samplereports:5,productversion,operatingsystem:30

Issue 741250 has been merged into this issue.

Not able to reproduce this issue on build 9565.5.0/61.03163.11


Did not notice any recent crashes.
https://crash.corp.google.com/browse?q=custom_data.ChromeCrashProto.magic_signature_1.name%3D%27ukm%3A%3AUkmEntryBuilder%3A%3AAddMetric%27&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D#-property-selector,samplereports:5,productversion,operatingsystem:30

Issue 741818 has been merged into this issue.