Bisected. I think the culprit CL is: https://codereview.chromium.org/2651443002

I could not myself conflict the bisect conclusions by tzik@, but I'm moving ahead with the revert.

You'll just break other things if you revert. Please let me take a look
first.

Sorry, stopping the revert cl: https://codereview.chromium.org/2658603004/

Assigning to rockot@ for further investigations, please reassign if the issue is unrelated to your CL, thanks.

Thanks, looking into it!

This is a shutdown race in single-process mode, caused by the fact that we leak RenderThreadImpl in the browser process and therefore leak ClientGpuMemoryBufferManager. The latter object has a background thread running which may use the Mojo SyncHandleRegistry even during AtExit handlers on the main thread, which themselves will ultimately destroy the Mojo SyncHandleRegistry's LazyInstance<ThreadLocalPointer>. Hence the race.

Ideally we would have a way to cleanly shutdown RenderThreadImpl in single-process mode, but I think a reasonable solution for now would be to make SyncHandleRegistry's TLP LazyInstance leaky.

"
Ideally we would have a way to cleanly shutdown RenderThreadImpl in single-process mode, but I think a reasonable solution for now would be to make SyncHandleRegistry's TLP LazyInstance leaky."

That sounds good.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8499f3a55d732d50c2a743fc3a499c43cc086234

commit 8499f3a55d732d50c2a743fc3a499c43cc086234
Author: rockot <rockot@chromium.org>
Date: Wed Jan 25 19:22:52 2017

Mojo C++ Bindings: Make SyncHandleRegistry Leaky

This avoids a potential data race on the ThreadLocalPointer
if someone happens to leave a Mojo-using thread alive during
shutdown.

BUG= 685157 
R=yzshen@chromium.org

Review-Url: https://codereview.chromium.org/2658583003
Cr-Commit-Position: refs/heads/master@{#446080}

[modify] https://crrev.com/8499f3a55d732d50c2a743fc3a499c43cc086234/mojo/public/cpp/bindings/lib/sync_handle_registry.cc