Did some digging.

This is caused by the Mojo service disconnecting (which seems to happen unpredictably). This is a Java Mojo service; the Java object itself (ShareServiceImpl) is not being garbage collected.

We receive a connection error on the C++ side, but the error handler on the Java side is not called. After that, the "share" Mojo messages are dropped on the floor.

We found the problem and more specific repro steps:
1. Enable the experimental-web-platform-features flag.
2. Go to https://mgiuca.github.io/web-share/demos/share.html
3. Click Share.
4. Cancel the picker.
5. Click Share again. You can either cancel or pick something.
6. Click the home button, then switch back to Chrome.
7. Click Share. (It will do nothing.)

What's happening?

In Step 3, the Mojo callback is being stored in the static ShareHelper.TargetChosenReceiver.sLastRegisteredReceiver.
In Step 4, by cancelling the picker, we will never call the callback due to Issue 636274.
In Step 5, a new callback is stored in sLastRegisteredReceiver. The previous callback is now garbage collectible.
In Step 6, this seems to force the GC. (If it doesn't work, do some more stuff like switching tabs, etc.) This deletes the original Mojo callback.

It turns out that Mojo detects when the callback is finalized and, if it hasn't been called, throws a fit and disconnects the channel. Future Mojo calls will fail.

This can be fixed up but Mojo probably should DCHECK in this case as it represents a programmer error (apparently this DCHECKs in C++ services but not in Java).

Spin-off Mojo bugs filed:
-  Issue 643499 : document this behaviour
- Issue 643500: crash when you screw up

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/06be389804f232f4e992be8e95b24322a1062ebb

commit 06be389804f232f4e992be8e95b24322a1062ebb
Author: mgiuca <mgiuca@chromium.org>
Date: Wed Sep 07 06:17:55 2016

WebShare: Fixed the API occasionally breaking on a particular page.

On Android, the WebShare Mojo pipe would occasionally be closed due to
the Java service dropping a callback without calling it. Now always
calls the callback.

Also partially fixes crbug.com/636274; previously the navigator.share
promise would not be rejected if the user cancels the picker. Now it is
rejected (though not immediately). This needs to be fixed better but at
least the promise will (eventually) be resolved or rejected.

BUG= 640324 ,636274

Review-Url: https://codereview.chromium.org/2307733003
Cr-Commit-Position: refs/heads/master@{#416862}

[modify] https://crrev.com/06be389804f232f4e992be8e95b24322a1062ebb/chrome/android/java/src/org/chromium/chrome/browser/share/ShareHelper.java
[modify] https://crrev.com/06be389804f232f4e992be8e95b24322a1062ebb/chrome/android/java/src/org/chromium/chrome/browser/webshare/ShareServiceImpl.java