Oh, and a sample crash ID is 3ed251fdc2e2d5ed.

Users experienced this crash on the following builds:

Mac Dev 66.0.3346.8 -  0.10 CPM, 2 reports, 2 clients (signature [Cocoa Zombie] -[DownloadItemController handleButtonClick:])

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

Users experienced this crash on the following builds:

Mac Beta 65.0.3325.88 -  0.10 CPM, 5 reports, 5 clients (signature [Cocoa Zombie] -[DownloadItemController handleButtonClick:])

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

It looks like this only affects macOS earlier than 10.13 :/.

This is currently top#4 browser crash on latest Chrome stable i.e., 65.0.3325.146 with 73 crashes from 72 clients. 

please find the crash history here : https://goto.google.com/wgvnd

We're planning stable respin early next week. 
sdy@ and  ellyjones@, could you ptal comment #5. If it is real blocker, it needs to be fixed ASAP. Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e73502d816bfe339d9ef76d365c143166f6d1a26

commit e73502d816bfe339d9ef76d365c143166f6d1a26
Author: Sidney San Martín <sdy@chromium.org>
Date: Sat Mar 10 06:26:44 2018

Clear the download item's target on dealloc.

This fixes a crash if the download item controller goes away while the
button is tracking the mouse and then sends its action on mouse up.

Bug:  815161 
Change-Id: I4ab377ca5fe190e3d95aa81b989c13c96b46f5b4
Reviewed-on: https://chromium-review.googlesource.com/957843
Commit-Queue: Avi Drissman <avi@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#542357}
[modify] https://crrev.com/e73502d816bfe339d9ef76d365c143166f6d1a26/chrome/browser/ui/cocoa/download/download_item_controller.mm

Thank you sdy@ for quick fix.
 Please update the bug with canary result on Monday morning and request a merge to M66 and M65 if canary result looks good. Thank you.

The NextAction date has arrived: 2018-03-12

Fix is not available in the latest available canary(67.0.3368.0 cut @542340). We will have to wait for new canary to verify this fix or to check if this hasnot introduced any regression.

I just uploaded a CL that unit tests the fix (https://crrev.com/c/958209). Based on the test, I feel confident that the fix is correct.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9cd1e6375511429c74b9e5f20aba2c69413084e1

commit 9cd1e6375511429c74b9e5f20aba2c69413084e1
Author: Sidney San Martín <sdy@chromium.org>
Date: Mon Mar 12 15:41:52 2018

Add a unit test for a download being removed from the shelf while its button is pressed.

Bug:  815161 
Change-Id: I1c55ee5d540faab02d8383776c041dad76317f1e
Reviewed-on: https://chromium-review.googlesource.com/958209
Reviewed-by: Avi Drissman <avi@chromium.org>
Commit-Queue: Sidney San Martín <sdy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#542491}
[modify] https://crrev.com/9cd1e6375511429c74b9e5f20aba2c69413084e1/chrome/browser/ui/cocoa/download/download_item_controller_unittest.mm

This bug requires manual review: Request affecting a post-stable build
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), bhthompson@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/095124b89302cccce7715fc44900dee80e76a269

commit 095124b89302cccce7715fc44900dee80e76a269
Author: Sidney San Martín <sdy@chromium.org>
Date: Mon Mar 12 18:04:33 2018

Clear the download item's target on dealloc.

This fixes a crash if the download item controller goes away while the
button is tracking the mouse and then sends its action on mouse up.

Bug:  815161 
Change-Id: I4ab377ca5fe190e3d95aa81b989c13c96b46f5b4
Reviewed-on: https://chromium-review.googlesource.com/957843
Commit-Queue: Avi Drissman <avi@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#542357}(cherry picked from commit e73502d816bfe339d9ef76d365c143166f6d1a26)
Reviewed-on: https://chromium-review.googlesource.com/958985
Reviewed-by: Sidney San Martín <sdy@chromium.org>
Cr-Commit-Position: refs/branch-heads/3368@{#1}
Cr-Branched-From: 0f36d3901569535a63173a1835f8dfbcf7b66d60-refs/heads/master@{#542340}
[modify] https://crrev.com/095124b89302cccce7715fc44900dee80e76a269/chrome/browser/ui/cocoa/download/download_item_controller.mm

I am comfortable merging this to M65 without canary coverage.

Approving merge to M65 branch 3325 based on comment #18 and per offline chat with sdy@.

Also triggered new canary of branch 3368 with this merge in. Pls verify this on new canary.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0294d597a95077148c3e9a9aa51eec180bdd0e1d

commit 0294d597a95077148c3e9a9aa51eec180bdd0e1d
Author: Sidney San Martín <sdy@chromium.org>
Date: Mon Mar 12 18:13:29 2018

Clear the download item's target on dealloc.

This fixes a crash if the download item controller goes away while the
button is tracking the mouse and then sends its action on mouse up.

Bug:  815161 
Change-Id: I4ab377ca5fe190e3d95aa81b989c13c96b46f5b4
Reviewed-on: https://chromium-review.googlesource.com/957843
Commit-Queue: Avi Drissman <avi@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#542357}(cherry picked from commit e73502d816bfe339d9ef76d365c143166f6d1a26)
Reviewed-on: https://chromium-review.googlesource.com/958986
Reviewed-by: Sidney San Martín <sdy@chromium.org>
Cr-Commit-Position: refs/branch-heads/3325@{#693}
Cr-Branched-From: bc084a8b5afa3744a74927344e304c02ae54189f-refs/heads/master@{#530369}
[modify] https://crrev.com/0294d597a95077148c3e9a9aa51eec180bdd0e1d/chrome/browser/ui/cocoa/download/download_item_controller.mm

Pls verify this crash on canary version 67.0.3368.1 or higher.

Just to update, there have been no crashes reported on 67.0.3368.1 of Mac so far, for '[Cocoa Zombie] -[DownloadItemController handleButtonClick:]', also not seeing any new major regression on Mac canary version 67.0.3368.1 based on the available crash data.

Great to hear.

Your change meets the bar and is auto-approved for M66. Please go ahead and merge the CL to branch 3359 manually. Please contact milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/43909c98644197bd9b35947d5c60f6699edb28c5

commit 43909c98644197bd9b35947d5c60f6699edb28c5
Author: Sidney San Martín <sdy@chromium.org>
Date: Tue Mar 13 17:43:32 2018

Clear the download item's target on dealloc.

This fixes a crash if the download item controller goes away while the
button is tracking the mouse and then sends its action on mouse up.

Bug:  815161 
Change-Id: I4ab377ca5fe190e3d95aa81b989c13c96b46f5b4
Reviewed-on: https://chromium-review.googlesource.com/957843
Commit-Queue: Avi Drissman <avi@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#542357}(cherry picked from commit e73502d816bfe339d9ef76d365c143166f6d1a26)
Reviewed-on: https://chromium-review.googlesource.com/960934
Reviewed-by: Sidney San Martín <sdy@chromium.org>
Cr-Commit-Position: refs/branch-heads/3359@{#208}
Cr-Branched-From: 66afc5e5d10127546cc4b98b9117aff588b5e66b-refs/heads/master@{#540276}
[modify] https://crrev.com/43909c98644197bd9b35947d5c60f6699edb28c5/chrome/browser/ui/cocoa/download/download_item_controller.mm

So far with 50% roll out of Stable 65.0.3325.162 on Mac there aren't any crashes. 
Thank you Sidney.

Great to hear. Thanks for checking.