Update:

This is Regression issue seen in M-71, and below is the bisect info:
Good Build: 71.0.3575.0 (Revision:597883)
Bad Build: 71.0.3576.0 (Revision:598282)

Narrow Bisect:

CHANGE-LOG URL:

https://chromium.googlesource.com/chromium/src/+log/af9906ef20544c312f97d8774e045139758da24a..37eac9aac4bc503d8e1073538228c1d2c3d82f97?pretty=fuller&n=10000

Suspecting: r598194 ?

siyua @: Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Note:
1. Unable to provide 'per-revision' bisect as it shows "We don't have enough builds to bisect. revlist: []" error message.
2. Tried on other machines but still getting the same error again.
3. Hence provided suspect through 'Chromium bisect'

Thank You!

Please find the stack trace for the crash id:
---------------------------------------------
Thread 0 (id: 0x165dd) CRASHED [EXC_BAD_ACCESS / KERN_INVALID_ADDRESS @ 0x00000000 ] MAGIC SIGNATURE THREAD
Stack Quality83%Show frame trust levels
0x000000010bdb4924	(Google Chrome Framework -md_settings_localized_strings_provider.cc:1551 )	settings::AddLocalizedStrings(content::WebUIDataSource*, Profile*)
0x000000010bdb7872	(Google Chrome Framework -md_settings_ui.cc:403 )	settings::MdSettingsUI::MdSettingsUI(content::WebUI*)
0x000000010bcd1b41	(Google Chrome Framework -chrome_web_ui_controller_factory.cc:238 )	content::WebUIController* (anonymous namespace)::NewWebUI<settings::MdSettingsUI>(content::WebUI*, GURL const&)
0x000000010bcd0836	(Google Chrome Framework -chrome_web_ui_controller_factory.cc:724 )	ChromeWebUIControllerFactory::CreateWebUIControllerForURL(content::WebUI*, GURL const&) const
0x000000010814db41	(Google Chrome Framework -web_ui_controller_factory_registry.cc:50 )	content::WebUIControllerFactoryRegistry::CreateWebUIControllerForURL(content::WebUI*, GURL const&) const
0x0000000108121f68	(Google Chrome Framework -web_contents_impl.cc:6431 )	content::WebContentsImpl::CreateWebUI(GURL const&)
0x0000000108122031	(Google Chrome Framework -web_contents_impl.cc:6164 )	non-virtual thunk to content::WebContentsImpl::CreateWebUIForRenderFrameHost(GURL const&)
0x0000000107e4b891	(Google Chrome Framework -render_frame_host_impl.cc:4546 )	content::RenderFrameHostImpl::UpdatePendingWebUI(GURL const&, int)
0x0000000107e5cfc1	(Google Chrome Framework -render_frame_host_manager.cc:590 )	content::RenderFrameHostManager::GetFrameHostForNavigation(content::NavigationRequest const&)
0x0000000107e5ce11	(Google Chrome Framework -render_frame_host_manager.cc:479 )	content::RenderFrameHostManager::DidCreateNavigationRequest(content::NavigationRequest*)
0x0000000107e0bd28	(Google Chrome Framework -frame_tree_node.cc:403 )	content::FrameTreeNode::CreatedNavigationRequest(std::__1::unique_ptr<content::NavigationRequest, std::__1::default_delete<content::NavigationRequest> >)
0x0000000107e2e276	(Google Chrome Framework -navigator_impl.cc:354 )	content::NavigatorImpl::Navigate(std::__1::unique_ptr<content::NavigationRequest, std::__1::default_delete<content::NavigationRequest> >, content::ReloadType, content::RestoreType)
0x0000000107e14908	(Google Chrome Framework -navigation_controller_impl.cc:2412 )	content::NavigationControllerImpl::NavigateWithoutEntry(content::NavigationController::LoadURLParams const&)
0x0000000107e14425	(Google Chrome Framework -navigation_controller_impl.cc:771 )	content::NavigationControllerImpl::LoadURLWithParams(content::NavigationController::LoadURLParams const&)
0x000000010bd20ce5	(Google Chrome Framework -browser_navigator.cc:344 )	(anonymous namespace)::LoadURLInContents(content::WebContents*, GURL const&, NavigateParams*)
0x000000010bd205a3	(Google Chrome Framework -browser_navigator.cc:615 )	Navigate(NavigateParams*)
0x000000010bd55526	(Google Chrome Framework -singleton_tabs.cc:61 )	ShowSingletonTabOverwritingNTP(Browser*, NavigateParams)
0x000000010bd24f5c	(Google Chrome Framework -chrome_pages.cc:317 )	chrome::ShowSettings(Browser*)
0x00007fff4c43d366	(AppKit + 0x00314366 )	
0x000000010914a4da	(Google Chrome Framework -chrome_browser_application_mac.mm:313 )	__43-[BrowserCrApplication sendAction:to:from:]_block_invoke
0x000000010955acd9	(Google Chrome Framework + 0x02562cd9 )	base::mac::CallWithEHFrame(void () block_pointer)
0x000000010914a3d1	(Google Chrome Framework -chrome_browser_application_mac.mm:312 )	-[BrowserCrApplication sendAction:to:from:]
0x00007fff4c49a3d2	(AppKit + 0x003713d2 )	
0x00007fff4c49a145	(AppKit + 0x00371145 )	
0x00007fff4c498fa7	(AppKit + 0x0036ffa7 )	
0x00007fff4c940746	(AppKit + 0x00817746 )	
0x00007fff4c14f81c	(AppKit + 0x0002681c )	
0x000000010914abb3	(Google Chrome Framework -chrome_browser_application_mac.mm:352 )	__34-[BrowserCrApplication sendEvent:]_block_invoke
0x000000010955acd9	(Google Chrome Framework + 0x02562cd9 )	base::mac::CallWithEHFrame(void () block_pointer)
0x000000010914a85c	(Google Chrome Framework -chrome_browser_application_mac.mm:333 )	-[BrowserCrApplication sendEvent:]
0x00007fff4c13cd80	(AppKit + 0x00013d80 )	
0x00000001095696bb	(Google Chrome Framework -message_pump_mac.mm:808 )	base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
0x000000010956823d	(Google Chrome Framework -message_pump_mac.mm:184 )	base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
0x000000010958b1f4	(Google Chrome Framework -run_loop.cc:102 )	<name omitted>
0x00000001091506ec	(Google Chrome Framework -chrome_browser_main.cc:2023 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x0000000107cc7b53	(Google Chrome Framework -browser_main_loop.cc:998 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x0000000107cca181	(Google Chrome Framework -browser_main_runner_impl.cc:165 )	content::BrowserMainRunnerImpl::Run()
0x0000000107cc48ca	(Google Chrome Framework -browser_main.cc:47 )	content::BrowserMain(content::MainFunctionParams const&)
0x0000000109105bfa	(Google Chrome Framework -content_main_runner_impl.cc:541 )	content::ContentMainRunnerImpl::Run(bool)
0x000000010ae16d4c	(Google Chrome Framework -main.cc:472 )	service_manager::Main(service_manager::MainParams const&)
0x0000000109104de3	(Google Chrome Framework -content_main.cc:19 )	content::ContentMain(content::ContentMainParams const&)
0x0000000106ffbd5e	(Google Chrome Framework -chrome_main.cc:102 )	ChromeMain
0x0000000106fdcdcd	(Google Chrome -chrome_exe_main_mac.cc:101 )	main
0x00007fff7bdbd010	(libdyld.dylib + 0x00017010 )	

Adding release blocker label for this issue.Please reduce priority or remove if not the case.

Thank You!

Pls revert suspected CL or provide fix ASAP as we're branching M71 today. Thank you.

Ack. Will start working on this now.

Sent a fix for review: https://chromium-review.googlesource.com/c/chromium/src/+/1277814

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/531265ba09c218fb9b06244e3efbb700d3d5d3b3

commit 531265ba09c218fb9b06244e3efbb700d3d5d3b3
Author: siyua <siyua@chromium.org>
Date: Fri Oct 12 00:06:17 2018

Fix migration requirements checks that broke settings page previously

Reason: When the user browses in guest window the sync service and identity
manager are not available.

Bug:  894377 
Change-Id: I8dd48d39f51d54230e7db8ec34bdbb9abd065530
Reviewed-on: https://chromium-review.googlesource.com/c/1277814
Commit-Queue: Siyu An <siyua@chromium.org>
Reviewed-by: Hector Carmona <hcarmona@chromium.org>
Cr-Commit-Position: refs/heads/master@{#599024}
[modify] https://crrev.com/531265ba09c218fb9b06244e3efbb700d3d5d3b3/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc

[Auto-generated comment by a script] We noticed that this issue is targeted for M-71; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-71 label, otherwise remove Merge-TBD label. Thanks.

Hi,

Retested the above issue on Win(7,8,8.1,10), Linux(14.04 LTS) and Mac(10.13.1, 10.13.6, 10.14.1) using latest Canary build #71.0.3578.0 and issue is fixed.

Now, Browser does not crash when navigated to chrome://settings in Guest Mode.

Kindly refer the attached screen-cast for reference.

Thank You!

Deleted: Canary Behaviour.mp4 391 KB

	Canary Behaviour.mp4 391 KB View Download

This fix has been picked up by M71 branching. Removed the label