Able to reproduce this issue on reported version 66.0.3359.139 and latest canary 68.0.3432.0 using Mac 10.13.3, Windows 10 and Ubuntu 14.04.

Good Build: 62.0.3176.0
Bad Build: 62.0.3177.0

You are probably looking for a change made after 491987 (known good), but no later than 491988 (first known bad).
CHANGELOG URL:
The script might not always return single CL as suspect as some perf builds might get missing due to failure.
  https://chromium.googlesource.com/chromium/src/+log/e9c88ae167d9ad473d1e8223fc876e1869177920..1d3f2f6aca0f08ed8ac3fe8203921744d8d91b87

Reviewed-on: https://chromium-review.googlesource.com/593529

Suspecting same from changelog.

@ yoichio: Please confirm the bug and help in re-assigning if this is not related to your change. 

Thanks!

Confirmed

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/deb6bb60b6d562719d04c6a564717b332d9c55bd

commit deb6bb60b6d562719d04c6a564717b332d9c55bd
Author: Yoichi Osato <yoichio@chromium.org>
Date: Thu Jun 21 06:09:27 2018

Let SelectionPaintRange iterator iterate on a flat tree.

SelectionPaintRange::Iterator iterated LayoutObjects using layout order
but we marks SelectionStatus on flat tree order.
This causes invalidation leak if they are not same order.
Ruby element is a reported example for that.

This patch changes SelectionPaintRange::Iterator iterate on a flat tree
considering first-letter.

Bug:  843144 
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: I02cbad86e64d0a7781f8fb37e2d13c7aa00228fb
Reviewed-on: https://chromium-review.googlesource.com/1063521
Commit-Queue: Yoichi Osato <yoichio@chromium.org>
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#569168}
[modify] https://crrev.com/deb6bb60b6d562719d04c6a564717b332d9c55bd/third_party/blink/renderer/core/editing/layout_selection.cc
[modify] https://crrev.com/deb6bb60b6d562719d04c6a564717b332d9c55bd/third_party/blink/renderer/core/editing/layout_selection_test.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/94766d09cff6f8aa625093bef39a844f70444ede

commit 94766d09cff6f8aa625093bef39a844f70444ede
Author: Yoichi Osato <yoichio@chromium.org>
Date: Thu Jun 28 11:24:10 2018

Revert "Let SelectionPaintRange iterator iterate on a flat tree."

This reverts commit deb6bb60b6d562719d04c6a564717b332d9c55bd.

Reason for revert: This causes much crash on clusterfuzz.
Original change's description:
> Let SelectionPaintRange iterator iterate on a flat tree.
> 
> SelectionPaintRange::Iterator iterated LayoutObjects using layout order
> but we marks SelectionStatus on flat tree order.
> This causes invalidation leak if they are not same order.
> Ruby element is a reported example for that.
> 
> This patch changes SelectionPaintRange::Iterator iterate on a flat tree
> considering first-letter.
> 
> Bug:  843144 
> Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
> Change-Id: I02cbad86e64d0a7781f8fb37e2d13c7aa00228fb
> Reviewed-on: https://chromium-review.googlesource.com/1063521
> Commit-Queue: Yoichi Osato <yoichio@chromium.org>
> Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
> Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#569168}

TBR=yosin@chromium.org,yoichio@chromium.org,xiaochengh@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug:  843144 ,  855026 
Change-Id: I745ab57ed70bd10e59bac20cf4f6fd591e170abd
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Reviewed-on: https://chromium-review.googlesource.com/1118098
Reviewed-by: Yoichi Osato <yoichio@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Yoichi Osato <yoichio@chromium.org>
Cr-Commit-Position: refs/heads/master@{#571076}
[modify] https://crrev.com/94766d09cff6f8aa625093bef39a844f70444ede/third_party/blink/renderer/core/editing/layout_selection.cc
[modify] https://crrev.com/94766d09cff6f8aa625093bef39a844f70444ede/third_party/blink/renderer/core/editing/layout_selection_test.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5d3212dab69f0b09168daaf14e3634e0a9d5ae62

commit 5d3212dab69f0b09168daaf14e3634e0a9d5ae62
Author: Yoichi Osato <yoichio@chromium.org>
Date: Mon Jul 23 06:24:38 2018

Stabilize LayoutSelection

This patch stabilizes LayoutSelection by letting it be off from
LayoutObject reference.
Design doc: https://bit.ly/2KT87L9

Algorithm updates:
 Mark SelectionState::kContain to all ascendants of each leaf selected node on flat tree.
 Do nothing while Node/LayoutObject::RemoveChild().
 At prepaint phase, collect all selected LayoutObject from root using kContain on flat tree.

Bug:  843144 
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng;luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ib4b39c621043d5fe03f46e0ce8b4d2b972e9ed3e
Reviewed-on: https://chromium-review.googlesource.com/1125709
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Commit-Queue: Yoichi Osato <yoichio@chromium.org>
Cr-Commit-Position: refs/heads/master@{#577114}
[modify] https://crrev.com/5d3212dab69f0b09168daaf14e3634e0a9d5ae62/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/selection/selection-clear-expected.txt
[modify] https://crrev.com/5d3212dab69f0b09168daaf14e3634e0a9d5ae62/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/selection/selection-clear-expected.txt
[modify] https://crrev.com/5d3212dab69f0b09168daaf14e3634e0a9d5ae62/third_party/WebKit/LayoutTests/platform/mac/paint/invalidation/selection/selection-clear-expected.txt
[modify] https://crrev.com/5d3212dab69f0b09168daaf14e3634e0a9d5ae62/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/selection/selection-clear-expected.txt
[modify] https://crrev.com/5d3212dab69f0b09168daaf14e3634e0a9d5ae62/third_party/blink/renderer/core/editing/layout_selection.cc
[modify] https://crrev.com/5d3212dab69f0b09168daaf14e3634e0a9d5ae62/third_party/blink/renderer/core/editing/layout_selection.h
[modify] https://crrev.com/5d3212dab69f0b09168daaf14e3634e0a9d5ae62/third_party/blink/renderer/core/editing/layout_selection_test.cc
[modify] https://crrev.com/5d3212dab69f0b09168daaf14e3634e0a9d5ae62/third_party/blink/renderer/core/layout/api/selection_state.h
[modify] https://crrev.com/5d3212dab69f0b09168daaf14e3634e0a9d5ae62/third_party/blink/renderer/core/paint/replaced_painter.cc