Able to reproduce the issue with latest Chrome latest and previous stable(57.0.2987.133, 58.0.3029.110 ,59.0.3071.115) and Beta(60.0.3112.50) on Windows 7,10. Unable to get the crash_id's for these crashes.

Note : The crash isn't observed on mac and Linux with Stable and Beta

Tested in chrome stable #59.0.3071.115 and canary #61.0.3155.0 on Win 10.0 & 7 able to reproduce the issue.
Below are the Bisect Details:

Bisect Info:
=============
Good Build: 49.0.2599.0(Revision - 366505)
Bad Build: 49.0.2601.0 (Revision - 366761)

Bisect URL:
=========== 
You are probably looking for a change made after 366565 (known good), but no later than 366573 (first known bad).
CHANGELOG URL:
https://chromium.googlesource.com/chromium/src/+log/887f04e9a63dbb81c2abe9eeb4ce780dad92c3ac..ba587a918ca859045437211ebca414e08f61320b

From the CL above, assigning the issue to the concern owner

@ tasak : Could you please look into the issue, pardon me if it has nothing to do with your changes and if possible please assign it to concern owner.

Review-Url: https://codereview.chromium.org/1521923002
Note: Issue not observed in Mac and Linux.

I finished investigating this issue.
I think, the OOM is caused by XSSAuditor's SuffixTree.

Looking at form-crash.html, 
- the given text size is 2,943,239 (decoded_http_body_.length()=2943239).
- 2,910,047 SuffixTree<ASCIICookbook>::Node (O(text length) nodes) are created.
- ~3GB memory allocation occurs, because since sizeof(Node) * 2,910,047 is 3,049,729,256 (~3GB).
- OOM... if machines don't have enough memory.

tsepez@, would you take a look at this issue?

SuffixTree.h defines
   typedef Vector<Node*, Codebook::kCodeSize> ChildrenVector;

and each node holds a pre-allocated vector of this size, regardless of whether it needs it.  We should investigate whether we we really want this.

dcheng, you did some resize work with WTF vectors some time ago, so you might enjoy taking a stab at this? If not, bounce it back and i'll see what I can do.

NM, its not a quirk of WFT::Vector, rather a better kind of map is needed.

 Issue 742308  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6ca590e1c7edaa7c56cac9e3e3c39cf398ca8d4d

commit 6ca590e1c7edaa7c56cac9e3e3c39cf398ca8d4d
Author: Tom Sepez <tsepez@chromium.org>
Date: Fri Jul 14 20:03:51 2017

Reduce memory usage in SuffixTree.h

Convert fixed array of pointers to a flat map. Previously, we
were requiring a direct-mapped array of 128 pointers per byte of
input string.

Add a small unit test for SuffixTree.

Bug:  740873 
Change-Id: I03836f5f9f893861bec3076fafaffd7c4e3e04eb
Reviewed-on: https://chromium-review.googlesource.com/571193
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#486859}
[modify] https://crrev.com/6ca590e1c7edaa7c56cac9e3e3c39cf398ca8d4d/third_party/WebKit/Source/platform/BUILD.gn
[modify] https://crrev.com/6ca590e1c7edaa7c56cac9e3e3c39cf398ca8d4d/third_party/WebKit/Source/platform/text/SuffixTree.h
[add] https://crrev.com/6ca590e1c7edaa7c56cac9e3e3c39cf398ca8d4d/third_party/WebKit/Source/platform/text/SuffixTreeTest.cpp