This test occasionally crashes on the trybots, and after some repetitions can be made to fail locally as well. The first ten frames of the crash stack look like this (apologies for release build):


(lldb) bt
* thread #1: tid = 0x5b422, 0x000000010b7d638e libzombies.dylib`(anonymous namespace)::ZombieObjectCrash(object=0x000000012140df00, aSelector="remove:", viaSelector=<no value available>) + 398 at objc_zombie.mm:237, name = 'CrBrowserMain', queue = 'com.apple.main-thread', stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
  * frame #0: 0x000000010b7d638e libzombies.dylib`(anonymous namespace)::ZombieObjectCrash(object=0x000000012140df00, aSelector="remove:", viaSelector=<no value available>) + 398 at objc_zombie.mm:237 [opt]
    frame #1: 0x000000010b7d61f1 libzombies.dylib`::-[CrZombie forwardingTargetForSelector:](self=<unavailable>, _cmd=<unavailable>, aSelector=<unavailable>) + 17 at objc_zombie.mm:272 [opt]
    frame #2: 0x00007fffc94e2928 CoreFoundation`___forwarding___ + 184
    frame #3: 0x00007fffc94e27e8 CoreFoundation`__forwarding_prep_0___ + 120
    frame #4: 0x000000010bcd0a91 libcontent.dylib`content::DownloadItemImpl::~DownloadItemImpl(this=0x000000011d839200) + 209 at download_item_impl.cc:351 [opt]
    frame #5: 0x000000010bcd0d5e libcontent.dylib`content::DownloadItemImpl::~DownloadItemImpl() [inlined] content::DownloadItemImpl::~DownloadItemImpl(this=0x000000011d839200) + 14 at download_item_impl.cc:343 [opt]
    frame #6: 0x000000010bcd0d59 libcontent.dylib`content::DownloadItemImpl::~DownloadItemImpl(this=0x000000011d839200) + 9 at download_item_impl.cc:343 [opt]
    frame #7: 0x000000010bcd8dba libcontent.dylib`content::DownloadManagerImpl::Shutdown() [inlined] std::__1::default_delete<content::DownloadItemImpl>::operator(__ptr=<unavailable>)(content::DownloadItemImpl*) const + 362 at memory:2233 [opt]
    frame #8: 0x000000010bcd8db4 libcontent.dylib`content::DownloadManagerImpl::Shutdown() [inlined] std::__1::unique_ptr<content::DownloadItemImpl, std::__1::default_delete<content::DownloadItemImpl> >::reset(content::DownloadItemImpl*) + 17 at memory:2546 [opt]
    frame #9: 0x000000010bcd8da3 libcontent.dylib`content::DownloadManagerImpl::Shutdown() [inlined] std::__1::unique_ptr<content::DownloadItemImpl, std::__1::default_delete<content::DownloadItemImpl> >::~unique_ptr() at memory:2500 [opt]
    frame #10: 0x000000010bcd8da3 libcontent.dylib`content::DownloadManagerImpl::Shutdown() [inlined] std::__1::unique_ptr<content::DownloadItemImpl, std::__1::default_delete<content::DownloadItemImpl> >::~unique_ptr() at memory:2500 [opt]

I suspect that the issue is the weak pointer DownloadItemController holds to shelf_ not being invalidated when shelf_ disappears.

sdy@, can you take a peek? for now I will disable the test.