Note : Issue is seen in iPhones too tested on iPhone7+(11.4.1)

I haven't been able to reproduce this issue. Apparently it was still reproducible 2 days ago, so it might still exist.

Could you please try reproducing again and maybe sharing the account where you were able to reproduce? Is this happening constantly? Which iPad did you use? Any additional info would be helpful. 

Ed, this is crashing on TabGridURLLoader, I'll keep trying to fix it but might re-assign it to you if the fix seems complicated since you own that class. 

Tested in 70.0.3503.0 Canary, iPad Air  iOS11.4 
Also tested on iPhone 8plus iOS 11.4.1 (comment #3)

Not able to reproduce the crash.

Could we also test on M69 dev? This might have been fixed on ToT but a cherrypick to M69 might be needed?

Tested in 69.0.3497.15 dev, iPad Air  iOS11.4 Not able to reproduce the issue.

https://drive.google.com/file/d/19-IgvkZ9-K2O9cWkJd6LLG3jG7eqR9gr/view

Able to repro the issue in the build 69.0.3497.16 beta tested on iPhone 7+(iOS 11.4),iPad (iOS 10.3.3).

Steps to Repro:

Precondition :
Enable UI+refresh if bijou hasnt been enabled.

Steps :
  1.Launch Chrome in Portrait mode.
  2. Tap on Menu > tap on new incognito tab.
  3. Tap on tabswithcer > Close all the incognito tabs
  4. Scroll to Recent tabs.
  4. Tap on Show full history > Tap on Search in history screen.
  5. Change the device orientation to landscape mode.
  6. Long tap on any url in history screen.
  7. Tap on Open in New Incognito tab

Video :
iPhone :
https://drive.google.com/file/d/1Wr4GZtX6ieJLvYO8fktzIuOyRGu_Eu3q/view?usp=sharing

iPad :
https://drive.google.com/file/d/1vfjXvv-QojQhXu_6t0MoCxXECEuS5XUO/view?usp=sharing

Crash Id :
https://crash.corp.google.com/browse?stbtiq=4bcb361418b79d8e

Thanks pmadalla@ I was able to repro with these simplified steps as well:

  1.Launch Chrome.
  2. Tap on Menu > tap on new incognito tab.
  3. Tap on tabswithcer > Close all the incognito tabs
  4. Scroll to Recent tabs.
  4. Tap on Show full history
  5. Long tap on any url in history screen.
  6. Tap on Open in New Incognito tab

Sent https://chromium-review.googlesource.com/c/chromium/src/+/1154146 for review.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e8077c5445db3ad3acedcdaa51b6a12b3f46f05c

commit e8077c5445db3ad3acedcdaa51b6a12b3f46f05c
Author: sczs <sczs@chromium.org>
Date: Tue Jul 31 00:48:48 2018

[ios] Updates TabGrid loader when incognito TabModel changes.

When the last incognito tab is closed, it re-creates the TabModel.
This CL updates the tabGridLoader with the new TabModel browserState
and WebstateList.

Bug:  865937 
Cq-Include-Trybots: luci.chromium.try:ios-simulator-full-configs;master.tryserver.chromium.mac:ios-simulator-cronet
Change-Id: I707dc818eed50736fc0d35922075ecb3360d014a
Reviewed-on: https://chromium-review.googlesource.com/1154146
Commit-Queue: edchin <edchin@chromium.org>
Reviewed-by: edchin <edchin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#579265}
[modify] https://crrev.com/e8077c5445db3ad3acedcdaa51b6a12b3f46f05c/ios/chrome/browser/ui/tab_grid/tab_grid_adaptor.h
[modify] https://crrev.com/e8077c5445db3ad3acedcdaa51b6a12b3f46f05c/ios/chrome/browser/ui/tab_grid/tab_grid_adaptor.mm
[modify] https://crrev.com/e8077c5445db3ad3acedcdaa51b6a12b3f46f05c/ios/chrome/browser/ui/tab_grid/tab_grid_coordinator.mm
[modify] https://crrev.com/e8077c5445db3ad3acedcdaa51b6a12b3f46f05c/ios/chrome/browser/ui/tab_grid/tab_grid_url_loader.h
[modify] https://crrev.com/e8077c5445db3ad3acedcdaa51b6a12b3f46f05c/ios/chrome/browser/ui/tab_grid/tab_grid_url_loader.mm

[Auto-generated comment by a script] We noticed that this issue is targeted for M-69; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-69 label, otherwise remove Merge-TBD label. Thanks.

Please add merge request label if this needs to be merged to M69.

Still waiting for the latest canary to verify. Adding the Merque-Request label per c18

Your change meets the bar and is auto-approved for M69. Please go ahead and merge the CL to branch 3497 manually. Please contact milestone owner if you have questions.
Owners: amineer@(Android), kariahda@(iOS), cindyb@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I've verified this on Canary, Kariah PTAL for manual approval

Manual approval.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/158379246451092577f5802c758d17362ba850fd

commit 158379246451092577f5802c758d17362ba850fd
Author: sczs <sczs@chromium.org>
Date: Wed Aug 01 20:58:27 2018

[ios] Updates TabGrid loader when incognito TabModel changes.

When the last incognito tab is closed, it re-creates the TabModel.
This CL updates the tabGridLoader with the new TabModel browserState
and WebstateList.

TBR=sczs@chromium.org

(cherry picked from commit e8077c5445db3ad3acedcdaa51b6a12b3f46f05c)

Bug:  865937 
Cq-Include-Trybots: luci.chromium.try:ios-simulator-full-configs;master.tryserver.chromium.mac:ios-simulator-cronet
Change-Id: I707dc818eed50736fc0d35922075ecb3360d014a
Reviewed-on: https://chromium-review.googlesource.com/1154146
Commit-Queue: edchin <edchin@chromium.org>
Reviewed-by: edchin <edchin@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#579265}
Reviewed-on: https://chromium-review.googlesource.com/1159235
Reviewed-by: Sergio Collazos <sczs@chromium.org>
Cr-Commit-Position: refs/branch-heads/3497@{#321}
Cr-Branched-From: 271eaf50594eb818c9295dc78d364aea18c82ea8-refs/heads/master@{#576753}
[modify] https://crrev.com/158379246451092577f5802c758d17362ba850fd/ios/chrome/browser/ui/tab_grid/tab_grid_adaptor.h
[modify] https://crrev.com/158379246451092577f5802c758d17362ba850fd/ios/chrome/browser/ui/tab_grid/tab_grid_adaptor.mm
[modify] https://crrev.com/158379246451092577f5802c758d17362ba850fd/ios/chrome/browser/ui/tab_grid/tab_grid_coordinator.mm
[modify] https://crrev.com/158379246451092577f5802c758d17362ba850fd/ios/chrome/browser/ui/tab_grid/tab_grid_url_loader.h
[modify] https://crrev.com/158379246451092577f5802c758d17362ba850fd/ios/chrome/browser/ui/tab_grid/tab_grid_url_loader.mm

This has been merged. Removing Merge-TBD.

Verified as per steps in #12
Verified in build 69.0.3497.31 Beta on iPhoneX iOS 11.4, iPhone 7+ iOS 10.3.3, iPad Pro 12'9 iOs 11.4
App does not crash.