Update: 
Unable to provide bisect using per-revision script(Error:'We don't have enough builds to bisect.revlist:[]' is seen),Hence providing bisect with old script.

Narrow Bisect info : 
https://chromium.googlesource.com/chromium/src/+log/94651a5239f6fab495d81547e32b96e29ef3f123..4bc98b372c0784b7dbabd72d361b6b197dcd8ff0?pretty=fuller&n=10000

Suspecting: r552063

@Erik Chen : Could you please help to reassign if your change is not the cause for this change.
Note:
1.Issue is not seen on Windows(7,8,8.1,10) and Linux (14.04 LTS)OS.

Thank You!

Please find the stack trace for the crash id:
----------------------------------------------
Thread 0 (id: 56224) CRASHED [EXC_BAD_ACCESS / KERN_INVALID_ADDRESS @ 0x0000000200000021 ] MAGIC SIGNATURE THREAD
Stack Quality84%Show frame trust levels
0x0000000109fbf6a2	(Google Chrome Framework -__functional_base:55 )	base::SupportsUserData::GetUserData(void const*) const
0x000000010c4dd384	(Google Chrome Framework -tab_helpers.cc:158 )	TabHelpers::AttachTabHelpers(content::WebContents*)
0x000000010c532330	(Google Chrome Framework -browser_tab_strip_model_delegate.cc:89 )	chrome::BrowserTabStripModelDelegate::WillAddWebContents(content::WebContents*)
0x000000010c56681c	(Google Chrome Framework -tab_strip_model.cc:194 )	TabStripModel::InsertWebContentsAt(int, content::WebContents*, int)
0x000000010c5322ae	(Google Chrome Framework -browser_tab_strip_model_delegate.cc:75 )	chrome::BrowserTabStripModelDelegate::CreateNewStripWithContents(std::__1::vector<TabStripModelDelegate::NewStripContents, std::__1::allocator<TabStripModelDelegate::NewStripContents> > const&, gfx::Rect const&, bool)
0x000000010c663cca	(Google Chrome Framework -browser_window_controller.mm:1245 )	-[BrowserWindowController detachTabsToNewWindow:draggedTab:]
0x000000010c6eec0b	(Google Chrome Framework -tab_strip_drag_controller.mm:295 )	-[TabStripDragController continueDrag:]
0x000000010c6ee03c	(Google Chrome Framework -tab_strip_drag_controller.mm:137 )	-[TabStripDragController maybeStartDrag:forTab:]
0x000000010c6f212b	(Google Chrome Framework -tab_view.mm:370 )	-[TabView mouseDown:]
0x00007fffa0d6824e	(AppKit + 0x0094024e )	-[NSWindow(NSEventRouting) _handleMouseDownEvent:isDelayedEvent:]
0x00007fffa0d64a6b	(AppKit + 0x0093ca6b )	-[NSWindow(NSEventRouting) _reallySendEvent:isDelayedEvent:]
0x00007fffa0d63f09	(AppKit + 0x0093bf09 )	-[NSWindow(NSEventRouting) sendEvent:]
0x000000010c67196e	(Google Chrome Framework -chrome_event_processing_window.mm:78 )	-[ChromeEventProcessingWindow sendEvent:]
0x00007fffa0be8680	(AppKit + 0x007c0680 )	-[NSApplication(NSEvent) sendEvent:]
0x0000000109bbc0db	(Google Chrome Framework -chrome_browser_application_mac.mm:328 )	__34-[BrowserCrApplication sendEvent:]_block_invoke
0x0000000109f77419	(Google Chrome Framework + 0x02145419 )	base::mac::CallWithEHFrame(void () block_pointer)
0x0000000109bbbd87	(Google Chrome Framework -chrome_browser_application_mac.mm:311 )	-[BrowserCrApplication sendEvent:]
0x00007fffa0463426	(AppKit + 0x0003b426 )	-[NSApplication run]
0x0000000109f872db	(Google Chrome Framework -message_pump_mac.mm:808 )	base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
0x0000000109f85e5d	(Google Chrome Framework -message_pump_mac.mm:184 )	base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
0x0000000109faaee4	(Google Chrome Framework -run_loop.cc:130 )	<name omitted>
0x0000000109bc1fe7	(Google Chrome Framework -chrome_browser_main.cc:2122 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x000000010888ef23	(Google Chrome Framework -browser_main_loop.cc:990 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x0000000108891601	(Google Chrome Framework -browser_main_runner.cc:161 )	content::BrowserMainRunnerImpl::Run()
0x000000010888b8da	(Google Chrome Framework -browser_main.cc:46 )	content::BrowserMain(content::MainFunctionParams const&)
0x0000000109b73148	(Google Chrome Framework -content_main_runner.cc:923 )	content::ContentMainRunnerImpl::Run()
0x000000010b3e87f4	(Google Chrome Framework -main.cc:452 )	service_manager::Main(service_manager::MainParams const&)
0x0000000109b726f3	(Google Chrome Framework -content_main.cc:19 )	content::ContentMain(content::ContentMainParams const&)
0x0000000107e36372	(Google Chrome Framework -chrome_main.cc:101 )	ChromeMain
0x0000000107dbadd3	(Google Chrome -chrome_exe_main_mac.cc:165 )	main
0x00007fffb8541234	(libdyld.dylib + 0x00005234 )	start
0x00007fffb8541234	(libdyld.dylib + 0x00005234 )	start

1)This crash is first started on 49.0.2623.112 and on latest Canary 68.0.3401.0 seeing 2 from 2 different clients.
2)This crash seen on only Mac>Browser and it is in 1st rank position.
3)This crash seen only on Mac.

68.0.3401.0	37.50%	6   - Canary
63.0.3239.132	43.75%	7
63.0.3239.84	12.50%	2
49.0.2623.112	6.25%	1

Link to the list of builds:
---------------------------
https://crash.corp.google.com/browse?q=product.name%3D%27Chrome_Mac%27%20AND%20expanded_custom_data.ChromeCrashProto.ptype%3D%27browser%27%20AND%20expanded_custom_data.ChromeCrashProto.magic_signature_1.name%3D%27TabHelpers%3A%3AAttachTabHelpers%27

As this is a recent regression adding release blocker label for this issue.Please reduce priority or remove if not the case.

Thank You!

Confirmed that issue repros with Mac Cocoa, but not MacViews. Reverting CL.

Reverted: https://chromium-review.googlesource.com/c/chromium/src/+/1021971

 Issue 835488  has been merged into this issue.