Using the per-revision bisect providing the bisect results,
Good build:60.0.3101.0(Revision:471958).
Bad build:60.0.3102.0(Revision:472262).

You are probably looking for a change made after 472186 (known good), but no later than 472187 (first known bad).

CHANGE-LOG URL:
---------------
https://chromium.googlesource.com/chromium/src/+log/7fcceecb206ec84e00ce9d52b7e487fd92a27aee..f53247a6fbf1240613a9a79be36b6a3650fd19ec

From the CL above, assigning the issue to the concern owner

@dgozman : Could you please look into the issue, pardon me if it has nothing to do with your changes and if possible please assign it to concern owner.

Review-Url: https://codereview.chromium.org/2884133002
Note :Able to reproduce the issue in Win 10.0,Ubuntu 14.04 & Mac 10.12.5 and Able to reproduce in latest Canary #62.0.3166.0
Adding Release Block-Stable for this issue.Please remove if not the case.

Stack Trace:
------------
Thread 0 (id: 61449) CRASHED [Simulated Exception @ 0x0000000104ab319b ] MAGIC SIGNATURE THREAD
Stack Quality80%Show frame trust levels
0x0000000104ab319b	(Google Chrome Framework -crashpad.cc:306 )	crash_reporter::DumpWithoutCrashing()
0x0000000102195cb1	(Google Chrome Framework -dump_without_crashing.cc:23 )	base::debug::DumpWithoutCrashing()
0x0000000100f7f2f0	(Google Chrome Framework -render_process_host_impl.cc:2187 )	content::RenderProcessHostImpl::ShutdownForBadMessage(content::RenderProcessHost::CrashReportMode)
0x000000010109a903	(Google Chrome Framework -web_contents_impl.cc:3668 )	content::WebContentsImpl::DidFinishNavigation(content::NavigationHandle*)
0x0000000100de333e	(Google Chrome Framework -navigation_handle_impl.cc:203 )	content::NavigationHandleImpl::~NavigationHandleImpl()
0x0000000100de383d	(Google Chrome Framework -navigation_handle_impl.cc:181 )	content::NavigationHandleImpl::~NavigationHandleImpl()
0x0000000100decb12	(Google Chrome Framework -memory:2233 )	content::NavigatorImpl::DidNavigate(content::RenderFrameHostImpl*, FrameHostMsg_DidCommitProvisionalLoad_Params const&, std::__1::unique_ptr<content::NavigationHandleImpl, std::__1::default_delete<content::NavigationHandleImpl> >)
0x0000000100df5a8e	(Google Chrome Framework -render_frame_host_impl.cc:1583 )	content::RenderFrameHostImpl::OnDidCommitProvisionalLoad(IPC::Message const&)
0x0000000100df27d1	(Google Chrome Framework -render_frame_host_impl.cc:848 )	content::RenderFrameHostImpl::OnMessageReceived(IPC::Message const&)
0x00000001023fdbca	(Google Chrome Framework -ipc_channel_proxy.cc:329 )	IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&)
0x0000000102196801	(Google Chrome Framework -callback.h:91 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x00000001021bd01a	(Google Chrome Framework -message_loop.cc:422 )	base::MessageLoop::RunTask(base::PendingTask*)
0x00000001021bd584	(Google Chrome Framework -message_loop.cc:433 )	base::MessageLoop::DeferOrRunPendingTask(base::PendingTask)
0x00000001021bd858	(Google Chrome Framework -message_loop.cc:540 )	base::MessageLoop::DoWork()
0x00000001021c0919	(Google Chrome Framework -message_pump_mac.mm:421 )	base::MessagePumpCFRunLoopBase::RunWork()
0x00000001021b0769	(Google Chrome Framework + 0x01abb769 )	base::mac::CallWithEHFrame(void () block_pointer)
0x00000001021c023e	(Google Chrome Framework -message_pump_mac.mm:397 )	base::MessagePumpCFRunLoopBase::RunWorkSource(void*)
0x00007fffb34768d0	(CoreFoundation + 0x000a48d0 )	__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
0x00007fffb3457c6b	(CoreFoundation + 0x00085c6b )	__CFRunLoopDoSources0
0x00007fffb3457155	(CoreFoundation + 0x00085155 )	__CFRunLoopRun
0x00007fffb3456b53	(CoreFoundation + 0x00084b53 )	CFRunLoopRunSpecific
0x00007fffb29e1a5b	(HIToolbox + 0x00030a5b )	RunCurrentEventLoopInMode
0x00007fffb29e1890	(HIToolbox + 0x00030890 )	ReceiveNextEventCommon
0x00007fffb29e16c5	(HIToolbox + 0x000306c5 )	_BlockUntilNextEventMatchingListInModeWithFilter
0x00007fffb0f875b3	(AppKit + 0x000475b3 )	_DPSNextEvent
0x00007fffb1701d6a	(AppKit + 0x007c1d6a )	-[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
0x0000000101da2d8f	(Google Chrome Framework -chrome_browser_application_mac.mm:187 )	__71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke
0x00000001021b0769	(Google Chrome Framework + 0x01abb769 )	base::mac::CallWithEHFrame(void () block_pointer)
0x0000000101da2cd3	(Google Chrome Framework -chrome_browser_application_mac.mm:186 )	-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
0x00007fffb0f7bf34	(AppKit + 0x0003bf34 )	-[NSApplication run]
0x00000001021c114d	(Google Chrome Framework -message_pump_mac.mm:749 )	base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
0x00000001021bfb4b	(Google Chrome Framework -message_pump_mac.mm:141 )	base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
0x00000001021e28d2	(Google Chrome Framework -run_loop.cc:111 )	base::RunLoop::Run()
0x0000000101da8c35	(Google Chrome Framework -chrome_browser_main.cc:1967 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x0000000100cde483	(Google Chrome Framework -browser_main_loop.cc:1169 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x0000000100ce0b41	(Google Chrome Framework -browser_main_runner.cc:142 )	content::BrowserMainRunnerImpl::Run()
0x0000000100cda50b	(Google Chrome Framework -browser_main.cc:46 )	content::BrowserMain(content::MainFunctionParams const&)
0x0000000101d5fbaf	(Google Chrome Framework -content_main_runner.cc:686 )	content::ContentMainRunnerImpl::Run()
0x00000001036822a3	(Google Chrome Framework -main.cc:469 )	service_manager::Main(service_manager::MainParams const&)
0x0000000101d5f193	(Google Chrome Framework -content_main.cc:19 )	content::ContentMain(content::ContentMainParams const&)
0x00000001006f8ab7	(Google Chrome Framework -chrome_main.cc:139 )	ChromeMain
0x000000010067ddd3	(Google Chrome -chrome_exe_main_mac.cc:170 )	main
0x00007fffc8a49254	(libdyld.dylib + 0x00005254 )	start

Thank You!