Chrome Version: 71.0.3546.0 (Developer Build) (64-bit)
OS: Mac OS X 10.13

What steps will reproduce the problem?
(1) Select Cast... from Chrome menu
(2) Select Sources > Desktop
(3) Select a Cast device

What is the expected result?

Desktop picker shows up, user can cast desktop contents.

What happens instead?

Chrome freezes and crashes.

Stack trace from Chrome debug logs below:

[33876:775:0907/151315.423852:VERBOSE1:extension_media_route_provider_proxy.cc(253)] DoCreateRoute urn:x-org.chromium.media:source:desktop=>cast:<2bb174a21daba9015a85665a86ecab2d>, presentation ID: mr_670d840e-df06-407e-97f7-a8422dec865c
[33876:775:0907/151315.450129:VERBOSE1:media_router_mojo_impl.cc(188)] MR #24442791-aeb7-4ad5-b23e-1a429ca576e3: OnRoutesUpdated
[33876:775:0907/151315.517257:VERBOSE1:media_router_ui_base.cc(409)] OnRouteResponseReceived
[34029:775:0907/151315.605763:VERBOSE1:media_stream_audio_track.cc(60)] Removed MediaStreamAudioSink@0x7fa484b03480 from MediaStreamAudioTrack@0x7fa484942630.
[33876:28419:0907/151315.784627:ERROR:binary_integrity_analyzer_mac.cc(28)] Could not initialize mac signature evaluator
[34029:775:0907/151315.867021:VERBOSE1:media_stream_audio_track.cc(108)] Stopping MediaStreamAudioTrack@0x7fa484942630.
[34029:775:0907/151315.867089:VERBOSE1:media_stream_audio_source.cc(147)] Removed MediaStreamAudioTrack@0x7fa484942630 as a consumer of MediaStreamAudioSource@0x7fa484938480.
[34029:775:0907/151315.868055:VERBOSE1:user_media_processor.cc(1345)] UserMediaProcessor::OnLocalSourceStopped
[34029:775:0907/151315.868380:VERBOSE1:user_media_processor.cc(1345)] UserMediaProcessor::OnLocalSourceStopped
[33876:12035:0907/151315.868650:VERBOSE1:media_stream_manager.cc(730)] StopStreamDevice({render_frame_id = 3} , {device_id = web-contents-media-stream://7:1?throttling=auto&local_echo=false}, session_id = 2})
[33876:12035:0907/151315.868697:VERBOSE1:media_stream_manager.cc(769)] StopDevice{type = 3}{session_id = 2}
[33876:12035:0907/151315.868729:VERBOSE1:media_stream_manager.cc(808)] CloseDevice({type = 3} {session_id = 2})
[33876:12035:0907/151315.869365:VERBOSE1:media_stream_manager.cc(730)] StopStreamDevice({render_frame_id = 3} , {device_id = web-contents-media-stream://7:1?throttling=auto&local_echo=false}, session_id = 1})
[33876:12035:0907/151315.869409:VERBOSE1:media_stream_manager.cc(769)] StopDevice{type = 4}{session_id = 1}
[33876:12035:0907/151315.869442:VERBOSE1:media_stream_manager.cc(808)] CloseDevice({type = 4} {session_id = 1})
[33876:12035:0907/151315.869533:VERBOSE1:media_stream_manager.cc(1032)] DeleteRequest({label= PkNaM8an4k2accGYP91Pk4rsyWq1AgMH3XsQ})
[33876:775:0907/151315.871401:VERBOSE2:capture_access_handler_base.cc(94)] Remove session:  render_process_id: 7 render_frame_id: 1 page_request_id: 0
[33876:775:0907/151315.875597:FATAL:thread_restrictions.cc(105)] Check failed: !g_base_sync_primitives_disallowed.Get().Get(). Waiting on a //base sync primitive is not allowed on this thread to prevent jank and deadlock. If waiting on a //base sync primitive is unavoidable, do it within the scope of a ScopedAllowBaseSyncPrimitives. If in a test, use ScopedAllowBaseSyncPrimitivesForTesting.
0   libbase.dylib                       0x00000001104bafde base::debug::StackTrace::StackTrace(unsigned long) + 174
1   libbase.dylib                       0x00000001104bb09d base::debug::StackTrace::StackTrace(unsigned long) + 29
2   libbase.dylib                       0x000000011009ec3c base::debug::StackTrace::StackTrace() + 28
3   libbase.dylib                       0x000000011010b52c logging::LogMessage::~LogMessage() + 460
4   libbase.dylib                       0x0000000110109125 logging::LogMessage::~LogMessage() + 21
5   libbase.dylib                       0x00000001103bea1c base::internal::AssertBaseSyncPrimitivesAllowed() + 188
6   libbase.dylib                       0x00000001103a2280 base::internal::ScopedBlockingCallWithBaseSyncPrimitives::ScopedBlockingCallWithBaseSyncPrimitives(base::BlockingType) + 32
7   libbase.dylib                       0x00000001103a22ab base::internal::ScopedBlockingCallWithBaseSyncPrimitives::ScopedBlockingCallWithBaseSyncPrimitives(base::BlockingType) + 27
8   libbase.dylib                       0x00000001102d8392 base::WaitableEvent::TimedWaitUntil(base::TimeTicks const&) + 66
9   libbase.dylib                       0x00000001102d881b base::WaitableEvent::TimedWait(base::TimeDelta const&) + 91
10  libcontent.dylib                    0x000000012d62a54b rtc::Event::Wait(int) + 91
11  libcontent.dylib                    0x00000001323ec338 webrtc::EventWrapperImpl::Wait(unsigned long) + 88
12  libcontent.dylib                    0x00000001323cbfc6 webrtc::DesktopConfigurationMonitor::Lock() + 118
13  libcontent.dylib                    0x000000012ead2ee3 webrtc::ScreenCapturerMac::Init() + 291
14  libcontent.dylib                    0x000000012eaddd5f webrtc::DesktopCapturer::CreateRawScreenCapturer(webrtc::DesktopCaptureOptions const&) + 735
15  libcontent.dylib                    0x00000001323c69c4 webrtc::DesktopCapturer::CreateScreenCapturer(webrtc::DesktopCaptureOptions const&) + 68
16  libcontent.dylib                    0x000000012d43c9aa content::desktop_capture::CreateScreenCapturer() + 58
17  libchrome_dll.dylib                 0x00000001165b8d42 DesktopMediaPickerFactoryImpl::CreateMediaList(std::__1::vector<content::DesktopMediaID::Type, std::__1::allocator<content::DesktopMediaID::Type> > const&) + 1026
18  libchrome_dll.dylib                 0x00000001199e7ac3 extensions::DesktopCaptureChooseDesktopMediaFunctionBase::Execute(std::__1::vector<extensions::api::desktop_capture::DesktopCaptureSourceType, std::__1::allocator<extensions::api::desktop_capture::DesktopCaptureSourceType> > const&, content::WebContents*, GURL const&, std::__1::basic_string<unsigned short, base::string16_internals::string16_char_traits, std::__1::allocator<unsigned short> >) + 2803
19  libchrome_dll.dylib                 0x00000001199e63c7 extensions::DesktopCaptureChooseDesktopMediaFunction::RunAsync() + 6343
20  libchrome_dll.dylib                 0x0000000119dec8bb ChromeAsyncExtensionFunction::Run() + 75
21  libchrome_dll.dylib                 0x00000001139e0f88 ExtensionFunction::RunWithValidation() + 1176
22  libchrome_dll.dylib                 0x00000001139e888b extensions::ExtensionFunctionDispatcher::DispatchWithCallbackInternal(ExtensionHostMsg_Request_Params const&, content::RenderFrameHost*, int, base::RepeatingCallback<void (ExtensionFunction::ResponseType, base::ListValue const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, extensions::functions::HistogramValue)> const&) + 2347
23  libchrome_dll.dylib                 0x00000001139e7436 extensions::ExtensionFunctionDispatcher::Dispatch(ExtensionHostMsg_Request_Params const&, content::RenderFrameHost*, int) + 2134
24  libchrome_dll.dylib                 0x0000000113a8d594 extensions::ExtensionWebContentsObserver::OnRequest(content::RenderFrameHost*, ExtensionHostMsg_Request_Params const&) + 308
25  libchrome_dll.dylib                 0x0000000113a90512 void IPC::DispatchToMethodImpl<extensions::ExtensionWebContentsObserver, void (extensions::ExtensionWebContentsObserver::*)(content::RenderFrameHost*, ExtensionHostMsg_Request_Params const&), content::RenderFrameHost, std::__1::tuple<ExtensionHostMsg_Request_Params>, 0ul>(extensions::ExtensionWebContentsObserver*, void (extensions::ExtensionWebContentsObserver::*)(content::RenderFrameHost*, ExtensionHostMsg_Request_Params const&), content::RenderFrameHost*, std::__1::tuple<ExtensionHostMsg_Request_Params>&&, std::__1::integer_sequence<unsigned long, 0ul>) + 162
26  libchrome_dll.dylib                 0x0000000113a90370 std::__1::enable_if<(sizeof...(ExtensionHostMsg_Request_Params const&)) == (std::tuple_size<std::__1::decay<std::__1::tuple<ExtensionHostMsg_Request_Params> >::type>::value), void>::type IPC::DispatchToMethod<extensions::ExtensionWebContentsObserver, content::RenderFrameHost, ExtensionHostMsg_Request_Params const&, std::__1::tuple<ExtensionHostMsg_Request_Params> >(extensions::ExtensionWebContentsObserver*, void (extensions::ExtensionWebContentsObserver::*)(content::RenderFrameHost*, ExtensionHostMsg_Request_Params const&), content::RenderFrameHost*, std::__1::tuple<ExtensionHostMsg_Request_Params>&&) + 112
27  libchrome_dll.dylib                 0x0000000113a8d3d5 bool IPC::MessageT<ExtensionHostMsg_Request_Meta, std::__1::tuple<ExtensionHostMsg_Request_Params>, void>::Dispatch<extensions::ExtensionWebContentsObserver, extensions::ExtensionWebContentsObserver, content::RenderFrameHost, void (extensions::ExtensionWebContentsObserver::*)(content::RenderFrameHost*, ExtensionHostMsg_Request_Params const&)>(IPC::Message const*, extensions::ExtensionWebContentsObserver*, extensions::ExtensionWebContentsObserver*, content::RenderFrameHost*, void (extensions::ExtensionWebContentsObserver::*)(content::RenderFrameHost*, ExtensionHostMsg_Request_Params const&)) + 565
28  libchrome_dll.dylib                 0x0000000113a8d13d extensions::ExtensionWebContentsObserver::OnMessageReceived(IPC::Message const&, content::RenderFrameHost*) + 333
29  libchrome_dll.dylib                 0x0000000119def409 extensions::ChromeExtensionWebContentsObserver::OnMessageReceived(IPC::Message const&, content::RenderFrameHost*) + 233
30  libcontent.dylib                    0x000000013083f087 content::WebContentsImpl::OnMessageReceived(content::RenderFrameHostImpl*, IPC::Message const&) + 247
31  libcontent.dylib                    0x000000012f93e93a content::RenderFrameHostImpl::OnMessageReceived(IPC::Message const&) + 282
32  libcontent.dylib                    0x000000013027e9a3 content::RenderProcessHostImpl::OnMessageReceived(IPC::Message const&) + 835
33  libipc.dylib                        0x0000000111341de5 IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&) + 149
34  libipc.dylib                        0x0000000111348d5f void base::internal::FunctorTraits<void (IPC::ChannelProxy::Context::*)(IPC::Message const&), void>::Invoke<void (IPC::ChannelProxy::Context::*)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context> const&, IPC::Message const&>(void (IPC::ChannelProxy::Context::*)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context> const&&&, IPC::Message const&&&) + 143
35  libipc.dylib                        0x0000000111348c5f void base::internal::InvokeHelper<false, void>::MakeItSo<void (IPC::ChannelProxy::Context::* const&)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context> const&, IPC::Message const&>(void (IPC::ChannelProxy::Context::* const&&&)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context> const&&&, IPC::Message const&&&) + 95
36  libipc.dylib                        0x0000000111348bed void base::internal::Invoker<base::internal::BindState<void (IPC::ChannelProxy::Context::*)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context>, IPC::Message>, void ()>::RunImpl<void (IPC::ChannelProxy::Context::* const&)(IPC::Message const&), std::__1::tuple<scoped_refptr<IPC::ChannelProxy::Context>, IPC::Message> const&, 0ul, 1ul>(void (IPC::ChannelProxy::Context::* const&&&)(IPC::Message const&), std::__1::tuple<scoped_refptr<IPC::ChannelProxy::Context>, IPC::Message> const&&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul>) + 125
37  libipc.dylib                        0x0000000111348aec base::internal::Invoker<base::internal::BindState<void (IPC::ChannelProxy::Context::*)(IPC::Message const&), scoped_refptr<IPC::ChannelProxy::Context>, IPC::Message>, void ()>::Run(base::internal::BindStateBase*) + 44
38  libbase.dylib                       0x000000011004456c base::OnceCallback<void ()>::Run() && + 92
39  libbase.dylib                       0x00000001100a07f9 base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) + 1033
40  libbase.dylib                       0x000000011015e13f base::MessageLoop::RunTask(base::PendingTask*) + 1199
41  libbase.dylib                       0x000000011015e63f base::MessageLoop::DeferOrRunPendingTask(base::PendingTask) + 95
42  libbase.dylib                       0x000000011015ec9a base::MessageLoop::DoWork() + 490
43  libbase.dylib                       0x000000011016d242 base::MessagePumpCFRunLoopBase::RunWork() + 98
44  libbase.dylib                       0x000000011016d1cc ___ZN4base24MessagePumpCFRunLoopBase13RunWorkSourceEPv_block_invoke + 28
45  libbase.dylib                       0x000000011011128a base::mac::CallWithEHFrame(void () block_pointer) + 10
46  libbase.dylib                       0x000000011016c0a5 base::MessagePumpCFRunLoopBase::RunWorkSource(void*) + 101
47  CoreFoundation                      0x00007fff43e3ad31 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
48  CoreFoundation                      0x00007fff43ef260c __CFRunLoopDoSource0 + 108
49  CoreFoundation                      0x00007fff43e1dce0 __CFRunLoopDoSources0 + 208
50  CoreFoundation                      0x00007fff43e1d15d __CFRunLoopRun + 1293
51  CoreFoundation                      0x00007fff43e1c9b7 CFRunLoopRunSpecific + 487
52  HIToolbox                           0x00007fff430fcd96 RunCurrentEventLoopInMode + 286
53  HIToolbox                           0x00007fff430fcb06 ReceiveNextEventCommon + 613
54  HIToolbox                           0x00007fff430fc884 _BlockUntilNextEventMatchingListInModeWithFilter + 64
55  AppKit                              0x00007fff413ada73 _DPSNextEvent + 2085
56  AppKit                              0x00007fff41b43e34 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 3044
57  libchrome_dll.dylib                 0x0000000115a3226a __71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke + 106
58  libbase.dylib                       0x000000011011128a base::mac::CallWithEHFrame(void () block_pointer) + 10
59  libchrome_dll.dylib                 0x0000000115a32108 -[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 248
60  AppKit                              0x00007fff413a2885 -[NSApplication run] + 764
61  libbase.dylib                       0x000000011016e8ac base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) + 348

[0907/151320.164460:ERROR:minidump_writable.cc(169)] offset 4381881168 out of range